Tailscale as an iii worker — tailscale::* functions for connectivity and peers, exit nodes and preferences, Serve and Funnel publishing, Taildrop, certificates, Taildrive, accounts, tailnet lock, and updates, plus a Console page with QR links.
iiiverifiedexact versions are immutable; binary and bundle artifacts are digest-pinned.
List the Tailscale accounts logged in on this device and which one is active.
Accounts logged in on this device.
Login name.
Short id used by `switch`.
Nickname, when set.
Whether this account is active.
Tailnet name.
Switch this device to another logged-in Tailscale account by id, tailnet, or login name.
Account id, tailnet, login name, or nickname from accounts::list.
Accounts logged in on this device.
Login name.
Short id used by `switch`.
Nickname, when set.
Whether this account is active.
Tailnet name.
Generate a Tailscale bug report identifier that support can look up; optional note and in-depth diagnosis.
Run additional in-depth checks.
Free-text note attached to the report.
The CLI's own output.
Shareable bug report identifier.
Fetch a Let's Encrypt certificate and key for one of this node's MagicDNS domains (`tailscale cert`). Requires HTTPS enabled for the tailnet.
Absolute path to write the certificate to.
One of this node's certificate domains, as reported by dns::status `cert_domains`.
Absolute path to write the private key to.
Path of the written certificate.
Domain the certificate was issued for.
Path of the written private key.
The CLI's own output.
Return the non-secret worker settings and the current Serve configuration. The CLI path is omitted.
Whether public Funnel shares are permitted by the operator.
Per-command timeout for the Tailscale CLI.
Local Console URL the Console share routes proxy to.
HTTPS port used when a share request omits one.
Active Serve and Funnel routes on this node.
MagicDNS host name the route answers on.
`serve` for a tailnet-only route, `funnel` when the same listener is also published to the internet.
URL path prefix the route serves.
HTTPS port of the listener.
Local target the route proxies to, or the file path it serves.
Full HTTPS URL a device opens to reach the route.
Raw `tailscale serve status --json` output.
Connect this node to the tailnet (`tailscale up`). When the node still needs a sign-in, returns the Tailscale login URL instead of connecting.
Tailscale sign-in page when the node still needs a login; open it, then call connect again.
Backend state reported by the client after the call.
True when the node is connected to the tailnet after the call.
Disconnect this node from the tailnet (`tailscale down`). Shared routes stop answering until the node connects again.
Backend state reported by the client after the call, normally `Stopped` or `NeedsLogin`.
False once the node has left the tailnet.
Resolve a name through the Tailscale DNS forwarder (100.100.100.100).
Name to resolve.
Record type such as A, AAAA, CNAME, TXT; defaults to A.
Answer records as the forwarder returned them.
Name that was resolved.
Record type that was queried.
Report the MagicDNS and split-DNS configuration the local Tailscale DNS forwarder is using.
Domains this node can obtain HTTPS certificates for.
Whether MagicDNS is enabled for this node.
MagicDNS suffix of the tailnet.
Upstream resolvers Tailscale forwards to.
Search domains pushed by the tailnet.
Split-DNS routes: domain suffix to resolvers.
Domain suffix routed to the resolvers.
Resolvers used for that suffix.
List the directories this node shares with the tailnet through Taildrive. The macOS GUI app manages Taildrive in its own settings and rejects the CLI.
The CLI's own output.
Taildrive shares as `name path` lines from the CLI.
Share name.
Directory shared.
Share a directory with the tailnet through Taildrive under a name (`tailscale drive share`).
Share name.
Absolute directory to share.
The CLI's own output.
Taildrive shares as `name path` lines from the CLI.
Share name.
Directory shared.
Stop sharing a Taildrive directory by name (`tailscale drive unshare`).
Share name.
The CLI's own output.
Taildrive shares as `name path` lines from the CLI.
Share name.
Directory shared.
List the peers that offer to be an exit node for internet traffic, and which one this node uses.
MagicDNS name of the exit node in use, if any.
Peers offering to be an exit node.
Whether this node currently exchanges traffic with the peer.
MagicDNS name without the trailing dot.
Whether this node routes internet traffic through the peer.
Whether the peer offers to be an exit node.
Machine name.
Stable node id.
True for Tailscale's Funnel ingress relay nodes, which are infrastructure rather than devices.
When the peer was last seen, RFC 3339.
Whether the peer is online.
Operating system reported by the peer.
DERP relay the connection currently uses, empty when direct.
Bytes received from the peer.
ACL tags on the peer.
Whether the peer accepts Taildrop files from this node.
Tailscale IPv4 and IPv6 addresses.
Bytes sent to the peer.
Route this node's internet traffic through an exit node (by name or IP, or `auto:any`), or clear it with an empty value.
Allow direct access to the local LAN while the exit node is in use.
Exit node by MagicDNS name, hostname, Tailscale IP, or `auto:any`; empty or omitted clears the exit node.
Accept DNS configuration from the tailnet.
Accept subnet routes advertised by other nodes.
Whether this node advertises itself as an exit node.
Subnet routes this node advertises.
ACL tags requested by this node.
Advertised as an app connector.
Automatic updates applied.
Automatic update checks enabled.
Control server URL.
LAN access allowed while using an exit node.
Exit node in use, by id.
Exit node in use, by IP.
Hostname override, empty when the OS name is used.
Whether the node is logged out.
Device posture reporting enabled.
Incoming connections blocked.
Tailscale SSH server enabled on this node.
Whether the node wants to be connected.
Web client exposed on port 5252.
Ask Tailscale for the best available exit node for this node.
The CLI's own wording.
Suggested exit node name, or null when Tailscale has none to offer.
Move files that arrived in this node's Taildrop inbox into a directory (`tailscale file get`).
What to do when a same-named file exists; defaults to `skip`.
Absolute directory that receives the inbox files.
Wait for at least one file to arrive before returning.
True when the CLI exited successfully.
The CLI's own output.
Send files to a tailnet device with Taildrop (`tailscale file cp`). Paths must be absolute and exist on this host.
Alternate file name to use when sending a single file.
Absolute paths of the files to send.
Receiving device by machine name or Tailscale IP.
True when the CLI exited successfully.
The CLI's own output.
List the tailnet devices that accept Taildrop files from this node.
Devices that accept Taildrop files from this node.
Tailscale IP of the device.
Machine name of the device.
Tailscale IP addresses of this node, or of a peer by hostname or IP.
Peer hostname or Tailscale IP; omitted means this node.
Tailscale IPv4 and IPv6 addresses.
Peer the addresses belong to, or `self`.
Report whether tailnet lock is enabled and this node's tailnet-lock public key.
Whether tailnet lock is enabled for the tailnet.
This node's tailnet-lock public key (`tlpub:…`), safe to share with admins.
Whether this node is signed under tailnet lock, when enabled.
The CLI's own output.
Start a Tailscale sign-in for this node (`tailscale login`) and return the browser URL a person completes it at; call connect afterwards.
Tailscale sign-in page when the node still needs a login; open it, then call connect again.
Backend state reported by the client after the call.
True when the node is connected to the tailnet after the call.
Log this node out (`tailscale logout`): disconnects and expires the node key, so the next connect needs a fresh sign-in.
Backend state reported by the client after the call, normally `Stopped` or `NeedsLogin`.
False once the node has left the tailnet.
Return the client's user-facing metrics in Prometheus text format.
The CLI's own output.
Analyse the local network for Tailscale: UDP reachability, IPv4/IPv6, NAT mapping, port-mapping protocols, the preferred DERP relay and relay latencies.
Captive portal detected on the network.
Public IPv4 address seen by the relays.
Public IPv6 address seen by the relays.
Whether IPv4 is usable.
Whether IPv6 is usable.
True when the NAT maps to different ports per destination (hard NAT).
DERP relay region the client prefers.
Round-trip latency to each DERP region in milliseconds.
Round-trip latency in milliseconds.
DERP region id.
Whether UDP traffic reaches the internet.
Port-mapping protocols the router offers.
Internal: reload Tailscale settings after a configuration update.
List the devices on the tailnet as this node sees them: names, Tailscale IPs, OS, online state, tags, exit-node offers, and traffic counters. Keys are omitted.
Include Tailscale's Funnel ingress relay nodes (`funnel-ingress-node`, tag `tag:ingress`), which are infrastructure rather than devices.
Only peers that are online right now.
Funnel ingress relay nodes left out because `include_ingress` was false.
Peers in name order.
Whether this node currently exchanges traffic with the peer.
MagicDNS name without the trailing dot.
Whether this node routes internet traffic through the peer.
Whether the peer offers to be an exit node.
Machine name.
Stable node id.
True for Tailscale's Funnel ingress relay nodes, which are infrastructure rather than devices.
When the peer was last seen, RFC 3339.
Whether the peer is online.
Operating system reported by the peer.
DERP relay the connection currently uses, empty when direct.
Bytes received from the peer.
ACL tags on the peer.
Whether the peer accepts Taildrop files from this node.
Tailscale IPv4 and IPv6 addresses.
Bytes sent to the peer.
Ping a peer at the Tailscale layer and report whether each reply came over a DERP relay or a direct path.
Number of pings to send; defaults to 5.
Peer hostname or Tailscale IP.
Per-ping timeout in milliseconds; defaults to 5000.
True when at least one reply arrived over a direct path.
Raw CLI output.
One entry per reply, in order.
Round-trip time in milliseconds.
The CLI line for this reply.
`direct` or `derp`.
Target as given.
Read this node's Tailscale preferences: routes, DNS, exit node, SSH, shields-up, hostname, auto-update. Keys and login secrets are omitted.
Accept DNS configuration from the tailnet.
Accept subnet routes advertised by other nodes.
Whether this node advertises itself as an exit node.
Subnet routes this node advertises.
ACL tags requested by this node.
Advertised as an app connector.
Automatic updates applied.
Automatic update checks enabled.
Control server URL.
LAN access allowed while using an exit node.
Exit node in use, by id.
Exit node in use, by IP.
Hostname override, empty when the OS name is used.
Whether the node is logged out.
Device posture reporting enabled.
Incoming connections blocked.
Tailscale SSH server enabled on this node.
Whether the node wants to be connected.
Web client exposed on port 5252.
Change only the given Tailscale preferences (`tailscale set`): accept routes or DNS, advertise routes or exit node, hostname, shields-up, SSH server, auto-update, LAN access with an exit node.
Accept DNS configuration from the tailnet.
Accept subnet routes advertised by other nodes.
Offer this node as an app connector.
Offer this node as an exit node.
Subnet routes to advertise, CIDR notation; an empty list stops advertising.
Apply updates automatically.
Allow direct LAN access while using an exit node.
Hostname to use instead of the OS name; empty restores the OS name.
Report device posture to the management plane.
Block incoming connections.
Run the Tailscale SSH server.
Notify about available updates.
Expose the web client on port 5252.
Accept DNS configuration from the tailnet.
Accept subnet routes advertised by other nodes.
Whether this node advertises itself as an exit node.
Subnet routes this node advertises.
ACL tags requested by this node.
Advertised as an app connector.
Automatic updates applied.
Automatic update checks enabled.
Control server URL.
LAN access allowed while using an exit node.
Exit node in use, by id.
Exit node in use, by IP.
Hostname override, empty when the OS name is used.
Whether the node is logged out.
Device posture reporting enabled.
Incoming connections blocked.
Tailscale SSH server enabled on this node.
Whether the node wants to be connected.
Web client exposed on port 5252.
Publish any local service, port, or directory on this node over Tailscale Serve (tailnet only) or Funnel (public; needs allow_funnel and confirm_public).
Required `true` for Funnel: acknowledges that the target becomes reachable by anyone with the link.
HTTPS port for the listener; defaults to the configured port. Funnel accepts 443, 8443, and 10000.
`serve` (tailnet only, default) or `funnel` (public internet).
URL path prefix to publish under; defaults to `/`.
Local port (`3000`), loopback URL (`http://127.0.0.1:3000`, `https+insecure://localhost:8443`), or absolute file/directory path to publish.
Tailscale page that enables Funnel for this node, present only when authorization is required.
HTTPS port of the listener.
Mode that was requested.
URL path prefix the route serves.
True when the route is reachable from the public internet.
QR code for `url` as inline SVG markup.
`ready` when the route is live; `authorization_required` when Funnel must first be enabled for this node.
Local target the route proxies to.
URL to open: the published route, or the Tailscale authorization page when `stage` is `authorization_required`.
List every Serve and Funnel route on this node with its URL, target, and visibility.
Active Serve and Funnel routes on this node.
MagicDNS host name the route answers on.
`serve` for a tailnet-only route, `funnel` when the same listener is also published to the internet.
URL path prefix the route serves.
HTTPS port of the listener.
Local target the route proxies to, or the file path it serves.
Full HTTPS URL a device opens to reach the route.
Remove one route by mode, HTTPS port, and path. mode=funnel removes public access and keeps the tailnet-only route with its original target; mode=serve removes the route entirely.
HTTPS port of the route to stop.
Mode of the route to stop.
URL path prefix of the route to stop; defaults to `/`.
HTTPS port of the route.
Mode that was stopped.
URL path prefix of the route.
Route that remains on that listener and path after the call, if any.
MagicDNS host name the route answers on.
`serve` for a tailnet-only route, `funnel` when the same listener is also published to the internet.
URL path prefix the route serves.
HTTPS port of the listener.
Local target the route proxies to, or the file path it serves.
Full HTTPS URL a device opens to reach the route.
True when the route was changed.
Remove every Serve and Funnel route on this node (`serve reset` and `funnel reset`). Requires confirm=true.
Must be `true`: every Serve and Funnel route on this node is removed.
Active Serve and Funnel routes on this node.
MagicDNS host name the route answers on.
`serve` for a tailnet-only route, `funnel` when the same listener is also published to the internet.
URL path prefix the route serves.
HTTPS port of the listener.
Local target the route proxies to, or the file path it serves.
Full HTTPS URL a device opens to reach the route.
Share the local iii Console. Serve is tailnet-only and the default; Funnel is public and requires allow_funnel in the configuration plus confirm_public in the request.
Required `true` for Funnel: acknowledges that the Console becomes reachable by anyone with the link.
HTTPS port for the listener; defaults to the configured port. Funnel accepts 443, 8443, and 10000.
`serve` (tailnet only, default) or `funnel` (public internet).
URL path prefix to serve the Console under; defaults to `/`.
Tailscale page that enables Funnel for this node, present only when authorization is required.
HTTPS port of the listener.
Mode that was requested.
URL path prefix the route serves.
True when the route is reachable from the public internet.
QR code for `url` as inline SVG markup.
`ready` when the route is live; `authorization_required` when Funnel must first be enabled for this node.
Local target the route proxies to.
URL to open: the published route, or the Tailscale authorization page when `stage` is `authorization_required`.
Stop one Console share by mode, HTTPS port, and path. mode=funnel removes public access and keeps the tailnet-only route; mode=serve removes the route entirely. Other routes are never reset.
HTTPS port of the route to stop.
Mode of the route to stop.
URL path prefix of the route to stop; defaults to `/`.
HTTPS port of the route.
Mode that was stopped.
URL path prefix of the route.
Route that remains on that listener and path after the call, if any.
MagicDNS host name the route answers on.
`serve` for a tailnet-only route, `funnel` when the same listener is also published to the internet.
URL path prefix the route serves.
HTTPS port of the listener.
Local target the route proxies to, or the file path it serves.
Full HTTPS URL a device opens to reach the route.
True when the route was changed.
Inspect local Tailscale connectivity, node identity, health notices, and the active Serve and Funnel routes. Keys, users, and capability maps are omitted.
Backend state reported by the client, `Running` when connected.
MagicDNS name of this node without the trailing dot.
Error text when the client could not be queried.
Exit node this node currently routes through, if any.
Whether the tailnet policy allows this node to use Funnel.
Health notices reported by the client.
Machine name of this node.
Tailscale Funnel ingress relay nodes in the peer list; infrastructure, excluded from the peer counts.
Whether the Tailscale CLI could be started.
MagicDNS suffix of the tailnet.
True when the client is running and this node is online.
Number of peers currently online.
Number of peers visible on the tailnet.
Active Serve and Funnel routes on this node.
MagicDNS host name the route answers on.
`serve` for a tailnet-only route, `funnel` when the same listener is also published to the internet.
URL path prefix the route serves.
HTTPS port of the listener.
Local target the route proxies to, or the file path it serves.
Full HTTPS URL a device opens to reach the route.
Name of the tailnet this node belongs to.
Tailscale IPv4 and IPv6 addresses of this node.
Tailscale client version.
Serve the tailscale worker's injected console UI assets (content function for its console:script / console:style triggers).
The asset path from the trigger config (e.g. `state/page.js`).
The asset source, verbatim.
MIME type the console should serve the asset with.
Update the Tailscale client to the latest release, or with dry_run=true only report what would change.
Report what an update would do without applying it.
The CLI's own output.
Tailscale client version, and optionally the latest upstream release for the current track.
Also fetch the latest upstream release for the current track.
Full version string with commit hashes.
Client variant, e.g. `macsys`.
Latest upstream release when `check_upstream` was set.
Installed client version, e.g. `1.98.8`.
Identify the machine and user behind a Tailscale IP. Keys and endpoints are omitted.
Tailscale IPv4 or IPv6 address, optionally with `:port`.
Tailscale addresses of the node.
Stable node id.
MagicDNS name of the node.
Operating system reported by the node.
ACL tags on the node.
Display name of the user who owns the node.
Login name of the user who owns the node.
