EXTENSIONS

Run commands, copy files, and open port forwards across a declared set of

Drift detection and change proposal for GitOps-managed Tailscale ACLs. Extends @john/tailscale-acl with `drift` (compare the live tailnet policy against a policy.hujson file, ignoring comments and key ordering) and `propose` (stage an ACL change as a reviewable pull request, writing HuJSON verbatim so comments survive). Neither method writes to the tailnet — the GitOps pipeline stays the sole writer.

Sets aclsExternallyManagedOn on a Tailscale tailnet and verifies the change applied. The base @john/tailscale-settings update method strips this field via its zod schema and sends an empty PATCH, reporting success without changing anything; this method sends it explicitly and asserts the read-back value.

Install Tailscale on remote VMs over SSH and sync tailnet machine inventory from tailscale status JSON into per-machine resources.

Tailscale tailnet device inventory via the API — sync all devices, delete stale entries

Tailscale for swamp: a `setup-tailscale` workflow that installs Tailscale and joins hosts of an @swamp/ssh fleet to the tailnet (auth key via vault + SSH env), plus a `net` model that syncs `tailscale status --json` into one resource per machine so downstream models and workflows can look up nodes by name.

Tailscale TCP serve rule management via SSH — sync, set, unset

Tailnet health reporting — find devices running outdated Tailscale clients and alert via Slack

Tailscale tailnet management — 10 model types covering devices, users, ACLs, DNS, auth keys, webhooks, settings, contacts, posture, and log config. 22 workflows for device inventory, user lifecycle, ACL audit, security audit, compliance, incident response, monitoring, and more. Fix: OAuth token cache now keys on credentials so different tailnets/OAuth clients no longer share tokens.