Skip to content

Tailscale VPN

Tailscale VPN

Plan & Sign up

For this course, each team will need to sign up for Tailscale's Starter plan. You can sign up for the Starter plan at Tailscale Pricing.

Create & Setup GitHub Repository for Tailscale AMI

  1. Create a new private GitHub repository for AMI in the GitHub organization you created.
  2. GitHub repository name must be ami-tailscale.
  3. Update README.md in your repository with instructions for using packer.
  4. Fork the GitHub repository in your namespace. You will do all development work on your fork.
  5. All code for Tailscale AMI should be in this repository.
  6. Add appropriate .gitignore to your repository. A collection of useful .gitignore templates can be found here.

Building Tailscale AMI using Packer

  1. Use Ubuntu 24.04 LTS as your source image to create a custom AMI using packer.
  2. All AMI you build should be private. Only your team can deploy EC2 instances from it.
  3. All AMI builds should happen in your ROOT AWS account.
  4. AMI builds should be set up to run in your default VPC.
  5. The AMI should include everything needed to run Tailscale except for credentials and route configuration.
  6. The AMI should configure tailscale to start automatically on boot with systemd

Tailscale Configuration & Deployment

  1. The Tailscale instance should be deployed in the public subnet of the VPC created by your terraform aws-infra repository.
  2. The route configuration and credentials for Tailscale should be passed as user data when launching the EC2 instance.
  3. The Tailscale EC2 instance should be deployed in the public subnet of the VPC created by your terraform aws-infra repository.
  4. The Tailscale instance should be configured to allow access to the private subnets in the VPC.
  5. The Tailscale instance should have deletion protection enabled to prevent accidental deletion.
  6. The Tailscale instance's EBS volume should be encrypted using the custom AWS KMS key created in your aws-infra repository.
  7. Tailscale instances should not be terminated or deleted once created. They may be stopped and started as needed to save costs.
  8. Tailscale instances do not need to be configured with Elastic IPs. They can use the public IP assigned by AWS.