Step 7 — Join the Private Network
Why it matters: this is the single biggest security decision in the whole guide. Right now your server has a public address anyone on earth can reach. After this step, it does not need one.
-
Go to tailscale.com and create an account for your company. That account is your private network — Tailscale calls it a tailnet.
-
On the server:
curl -fsSL https://tailscale.com/install.sh | shsudo tailscale upIt prints a login link. Open it, sign in, and the server appears in your Tailscale admin console with a private address starting 100. and a stable name like acme-agent-01.your-tailnet.ts.net.
Use that name from now on instead of the public IP.
-
Install Tailscale on your laptop from tailscale.com/download and sign in with the same account. Your laptop and server can now see each other.
In the Tailscale admin console, find your server in Machines and disable key expiry for it.
Personal devices are built to re-authenticate periodically. A server is not. Skip this and your server silently falls off the network in about 90 days, at the worst possible moment — and the symptom looks nothing like an expiry problem. :::
- Confirm you can reach it by its private name:
ssh yourname@acme-agent-01.your-tailnet.ts.net