Configuring Tailscale Mesh VPN for Server Infrastructure

{
  "groups": {
    "group:devs": ["user:[email protected]", "user:[email protected]"],
    "group:ops": ["user:[email protected]"],
    "group:servers-prod": ["tag:prod"],
    "group:servers-staging": ["tag:staging"]
  },
  "tagOwners": {
    "tag:prod": ["group:ops"],
    "tag:staging": ["group:devs", "group:ops"],
    "tag:monitoring": ["group:ops"]
  },
  "acls": [
    {
      "action": "accept",
      "src": ["group:ops"],
      "dst": ["tag:prod:*", "tag:staging:*"]
    },
    {
      "action": "accept",
      "src": ["group:devs"],
      "dst": ["tag:staging:22", "tag:staging:443"]
    },
    {
      "action": "accept",
      "src": ["tag:monitoring"],
      "dst": ["tag:prod:9100", "tag:staging:9100"]
    }
  ],
  "ssh": [
    {
      "action": "accept",
      "src": ["group:ops"],
      "dst": ["tag:prod"],
      "users": ["root", "ubuntu"]
    }
  ]
}

Tags are assigned during node registration and cannot be changed by the device itself—this is a key element of the zero-trust model. The server cannot escalate its own privileges.

Subnet Routers and Exit Nodes

Two scenarios where Tailscale is especially useful: accessing resources in a VPC without installing the agent on every machine (subnet router) and routing traffic through a corporate IP (exit node). Subnet router setup:

# On the router server
tailscale up --advertise-routes=10.0.0.0/16 --accept-dns=false

# Approve routes via API:
curl -X POST "https://api.tailscale.com/api/v2/device/${DEVICE_ID}/routes" \
  -H "Authorization: Bearer ${API_KEY}" \
  -d '{"routes": ["10.0.0.0/16"]}'

After that, all tailnet clients see resources in 10.0.0.0/16 through this node. Exit node is configured similarly with --advertise-exit-node.

Step-by-Step: How to Configure Tailscale for Production

1. Install Tailscale on all nodes using the official script or package manager.
2. Authenticate each node to your tailnet via tailscale up.
3. Tag devices using tailscale set --tag=tag:prod (requires tagOwners ACL).
4. Write an ACL policy in HuJSON defining groups, tags, and access rules.
5. Enable subnet routing with --advertise-routes on designated routers, then approve routes.
6. Integrate with Terraform (see below) for infrastructure-as-code management.

What Is Headscale and When Is It Needed?

If security policy prohibits using an external control plane or if full network isolation is required, we use Headscale — an open-source implementation of the Tailscale coordination server. Self-hosting Headscale gives you complete control but requires managing a server (cost: ~$20/month for a small VPS).

---
# headscale config.yaml (key parameters)
server_url: https://headscale.internal.company.com
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 0.0.0.0:9090
database:
  type: postgres
  postgres:
    host: 127.0.0.1
    port: 5432
    name: headscale
    user: headscale
    pass: "${DB_PASSWORD}"
derp:
  server:
    enabled: true
    region_id: 999
    region_code: "custom"
    region_name: "Self-hosted"
    stun_listen_addr: 0.0.0.0:3478
ip_prefixes:
  - 100.64.0.0/10

Clients connect by specifying the login server:

tailscale up --login-server=https://headscale.internal.company.com 

Automating Tailscale Management with Terraform

In infrastructure managed by Terraform, tailnet resources are described using the tailscale/tailscale provider:

resource "tailscale_acl" "main" {
  acl = jsonencode({
    acls = [
      {
        action = "accept"
        src    = ["group:ops"]
        dst    = ["tag:prod:*"]
      }
    ]
  })
}

resource "tailscale_device_tags" "web_server" {
  device_id = data.tailscale_device.web.id
  tags      = ["tag:prod", "tag:web"]
}

Storing access policies in Git and applying via CI/CD eliminates manual web console clicks.

Comparison of Tailscale and Headscale

Timelines and Deliverables

Deliverables included in our service:

• Audit of current network infrastructure and security requirements.
• Tailnet design: split into tags, groups, ACLs.
• Installation and configuration of Tailscale on all nodes.
• Setup of subnet router and/or exit node as needed.
• Deployment of Headscale (if self-hosted required).
• Terraform modules and CI/CD integration.
• Detailed documentation of access policies.
• Team training on tailnet administration.
• 30 days post-deployment support.

Company trust metrics: 5+ years of DevOps experience, 100+ successful Tailscale configurations, certified engineers, and a proven track record with startups to enterprises. We offer a 30-day warranty on all deployments.

Get a consultation on Tailscale deployment—contact us. We will evaluate your infrastructure and propose the optimal configuration.