Automation and device trust
Manage expiry and device approval
Use node-key expiry, device approval, and deliberate exceptions to balance safe rotation with reliable infrastructure access.
8 minute lesson
Node keys expire independently from the auth key used to enroll a device. Expiry forces periodic reauthentication and key rotation.
The auth key was the ticket in the door. The node key is the device’s ongoing WireGuard identity, and it expires on a schedule (180 days by default). When it does, the device drops out of the tailnet until someone reauthenticates:
sudo tailscale up --force-reauthThat is a feature for laptops and phones. A device that left the company, or a tablet lost on a train, stops being a tailnet member on a schedule even if nobody remembers to remove it.
Where expiry hurts
Tagged infrastructure normally has key expiry disabled, so protect tags, monitor ownership, and revoke lost or replaced devices promptly.
Nobody wants the production subnet router dropping offline at day 180, waiting for a browser login. The trade is explicit: the machine never expires, so humans must do the reviewing that expiry would have forced. Check last-seen times, retire replaced hardware, and treat the machines list as an inventory you own. You can also disable expiry per device in the admin console. Reserve that for infrastructure, never for personal devices.
Device approval
Device approval adds an administrator check before a new device can exchange tailnet traffic. Enable it under Settings, Device management, and every new enrollment waits until an admin reviews it. Valid credentials stop being sufficient; a human confirms the device belongs.
Preapproved auth keys can automate trusted builds. A key created with preapproval skips the queue, which is right for infrastructure enrolled through your deployment pipeline, where the approval effectively happened when someone created the key.
Practice the lifecycle
Enable device approval in a disposable tailnet if practical, enroll one waiting device, review its identity, approve it, then revoke it and confirm traffic stops:
tailscale ping lab-tablet
# succeeds while approved, fails after revocationRevocation is the step nobody rehearses. Do it once calmly, so the first real one is not also the first attempt.
Lesson completed