Skip to main content

SEND TAILSCALE TAILNET EVENTS TO A SLACK WEBHOOK

This guide shows you how to post tailnet events that need attention to a Slack channel, check that delivery works, and rotate the webhook's signing secret. The events are devices and users waiting for approval, and node keys that are about to expire.

Prerequisites

  • TAILSCALE_API_KEY set to an API access token for the tailnet
  • A Slack incoming webhook URL, stored in the default vault under the key slack-tailnet-alerts-url (see Storing Secrets)

Pull the extension

swamp extension pull @swamp/tailscale

The output looks like:

INF extension·pull: Pulling "@swamp/tailscale"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/tailscale"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/tailscale"@"2026.10.13.1"
INF extension·pull: Extracted 54 files:

Define the webhook

Create a behavior of type @swamp/tailscale/webhook named tailnet-alerts (see Create and Run a Behavior) with these global arguments:

globalArguments:
  name: tailnet-alerts
  endpointUrl: "${{ vault.get('default', 'slack-tailnet-alerts-url') }}"
  providerType: slack
  subscriptions:
    - nodeNeedsApproval
    - nodeKeyExpiringInOneDay
    - userNeedsApproval

name is required. It is the instance name that identifies this webhook within the behavior. providerType: slack makes Tailscale send events in the format Slack expects. For Mattermost, Google Chat or Discord, set providerType to mattermost, googlechat or discord instead.

To receive other events, add them to subscriptions. Examples include nodeKeyExpired, nodeDeleted, policyUpdate, userSuspended and userRoleUpdated. The Tailscale extensions reference lists every event name.

Create the webhook

swamp behavior run tailnet-alerts create

This command creates the webhook in the tailnet and writes its state to the behavior's data. It writes the signing secret that Tailscale returns to a vault.

Send a test event

swamp behavior run tailnet-alerts test

This command asks Tailscale to send a test event to the endpoint. Check the Slack channel for the message.

If no message arrives, check that the URL stored in the vault is the channel's current incoming webhook URL.

Rotate the signing secret

swamp behavior run tailnet-alerts rotate_secret

This command rotates the webhook's signing secret in Tailscale and replaces the secret stored in the vault with the new one.

To change the events or the endpoint later, edit the definition and run update. To remove the webhook from the tailnet, run delete.