🔐 Administrator Documentation

🌐 Network Overview

Users in System

🔑 Authentication Methods

# Create a key that expires in 7 days
headscale preauthkeys create --user dom --expiration 7d

# Create a reusable key
headscale preauthkeys create --user dom --expiration 30d --reusable

# Create a key that never expires (not recommended)
headscale preauthkeys create --user dom --expiration 90d --reusable

# List pending devices
headscale nodes list

# Approve a device
headscale nodes register --user dom --key nodekey:xxxxxx

https://headscale.tappedin.fm/register/DEVICE_KEY

👥 User Management

Creating New Users

# Create a new user
headscale users create matt-turner

# List all users
headscale users list

# Delete a user (WARNING: removes all their devices)
headscale users destroy matt-turner

User Settings (via Admin Dashboard)

• Device Limit: Maximum devices per user (default: 10)
• Exit Node Permission: Allow/deny exit node usage
• IP Range: Auto-assign or custom IP range
• Subnet Routes: Allow advertising subnet routes

📱 Device Management

Viewing Connected Devices

Admin Dashboard shows all devices with:

• Device name (e.g., "John's iPhone")
• IP addresses (IPv4 and IPv6)
• Owner/User
• Online/Offline status
• Last seen timestamp

Removing Devices

# List all devices
headscale nodes list

# Remove a specific device
headscale nodes delete --identifier 1

# Force remove offline device
headscale nodes delete --identifier 1 --force

Device Expiration

By default, devices do not expire. To set expiration:

# Expire a device manually
headscale nodes expire --identifier 1

🛡️ Access Control & Security

ACL (Access Control List)

Control which users/devices can communicate with each other.

ACL File: /etc/headscale/acl.yaml

Example: Allow All Traffic

{
  "acls": [
    {
      "action": "accept",
      "src": ["*"],
      "dst": ["*:*"]
    }
  ]
}

Example: Restrict Access

{
  "acls": [
    {
      "action": "accept",
      "src": ["dom"],
      "dst": ["dom:*"]
    },
    {
      "action": "accept",
      "src": ["tappedin"],
      "dst": ["tappedin:*", "dom:80,443"]
    }
  ]
}

Firewall Ports (Already Configured)

🌍 Exit Node Configuration

How Exit Nodes Work

Exit nodes allow devices to route all internet traffic through the VPN server, making it appear as if they're browsing from the server's location.

Approving Exit Node Routes

# List routes that need approval
headscale routes list

# Approve exit node for a device
headscale routes enable --identifier NODE_ID --route 0.0.0.0/0
headscale routes enable --identifier NODE_ID --route ::/0

Use Cases

• Secure browsing on public WiFi
• Accessing region-locked content
• Bypassing corporate firewalls
• Privacy protection

🔧 Troubleshooting

Dashboard Not Showing Devices

# Check Headscale is running
systemctl status headscale

# Check PHP-FPM
systemctl status ea-php81-php-fpm

# Test API directly
curl -sk "https://tailscale.tappedin.fm/api/nodes"

# Restart services
systemctl restart headscale
systemctl restart ea-php81-php-fpm
systemctl reload nginx

Device Can't Connect

1. Verify auth key hasn't expired: headscale preauthkeys list --user USERNAME
2. Check device is using correct login server URL
3. Verify firewall ports are open
4. Check Headscale logs: journalctl -u headscale -n 50

Exit Node Not Working

# Verify NAT rules
iptables -t nat -L POSTROUTING -n | grep 100.64.0.0

# Check IP forwarding
sysctl net.ipv4.ip_forward

# Re-apply exit node config
/usr/local/bin/setup-exit-node.sh

Check Service Status

# Monitor all services
/home/devinecr/apps/hubnode/monitoring/universal-service-monitor.sh

# View monitoring logs
tail -f /var/log/universal-service-monitor.log

📞 Support & Resources

• ← Back to Admin Dashboard
• Headscale Official Docs
• Tailscale Knowledge Base

⬇️ Download Tailscale Clients

Direct download links for all platforms: