Sign up
View stargazersSign up

docs(user): Tailscale HTTPS lists what the tailnet needs#23759

open1
main
GitHub fork: docs/tailscale-https-prerequisites
opened19d agobyWWesleySmits
1 files changed
View on GitHubTwo-way sync enabledPR last imported 1d ago

Problem

The Tailscale HTTPS section in docs/user/remote-access.md says how to turn the route on, but not what the tailnet needs for it to work. Without MagicDNS and HTTPS certificates, or on Linux without permission to manage Tailscale, T3 Code still starts but no HTTPS route appears. Nothing in the guide points users to the cause (see #16238).

Change

Six lines in ### Tailscale HTTPS, before the CLI examples:

markdown
1Your tailnet needs MagicDNS and HTTPS certificates enabled; see
2[Tailscale's HTTPS setup](https://tailscale.com/docs/how-to/set-up-https-certificates).
3On Linux, T3 Code also needs permission to manage Tailscale; see
4[operator permission](https://tailscale.com/docs/reference/troubleshooting/linux/linux-operator-permission)
5for non-root users. If any of these is missing, T3 Code still starts but can't
6add the HTTPS route.

Both links go to Tailscale's own docs, so the setup steps and the public-ledger note stay there.

Scope and approval

Docs only, one problem: the existing workflow is hard to get working because its prerequisites aren't documented (CONTRIBUTING, existing workflow hard to find or understand). It doesn't change runtime behavior.

Refs #16238. Related: #23605 makes the server retry Serve after a failed start. That PR touches no docs, and these prerequisites still apply after it lands, since a retry can't succeed while one of them is missing. For the same reason this text gives no recovery or retry advice.

Verification

  • Claims checked against Tailscale's docs: the HTTPS page ("Enable MagicDNS…", "Under HTTPS Certificates, select Enable HTTPS") and the Linux operator page ("To allow a different user to manage Tailscale, set the user as the operator"). Both URLs return 200 with no redirect.
  • Claims checked against the source: t3 pair --tailscale fails explicitly when there is no MagicDNS name or Serve/HTTPS is not enabled (apps/server/src/cli/pair.ts), and the server logs a warning and keeps running when tailscale serve fails (apps/server/src/server.ts). The maintainer repro in #16238 shows the non-operator case: permission-denied, server ready, serve status {}.
  • vp run check:changed: format pass; knip skipped (no code changed). git diff --check is clean.
  • Not checked: I did not reproduce this on a real tailnet. There is no live run with MagicDNS, HTTPS certificates or operator permission missing, and no root or rootless-daemon run. No UI change, so no screenshots.

🤖 Written by Claude Opus 5.5 via Claude Code in T3 Code.

Checks

7 successful · 1 skipped
All checks passed
1e03b48

Added 1 commit

  • docs(user): Tailscale HTTPS lists what the tailnet needs1e03b48
Cchatgpt-codex-connectorBot19d ago
Synced from GitHub

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

ReviewStatusCommitReview trigger
📝 Code Review⚠️ Failed 2026-10-22T18:21:39.828830Z
We couldn’t complete this review. Comment @codex review to try again.		1e03b48PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

MmacroscopeappBot19d ago
Synced from GitHub

Approvability

Verdict: Approved at 1e03b48

Macroscope's review found this PR approvable — This PR only adds prerequisite guidance and links to the existing Tailscale HTTPS documentation. It changes no executable code, product defaults, schemas, or deployment behavior.

You can add or adjust custom eligibility rules. Learn more.

CcoderabbitaiBot19d ago
Synced from GitHub

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
📥 Commits

Reviewing files that changed from the base of the PR and between 4eae8ae011e2e56ca20159c13f3fb8a2ac49a991 and 1e03b48a95a6215200f2e11f07459bd278e4d318.

📒 Files selected for processing: 1
  • docs/user/remote-access.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The Tailscale HTTPS documentation now lists required settings and Linux permissions. It states that missing prerequisites prevent adding the HTTPS route but do not prevent T3 Code from starting.

Changes: Tailscale HTTPS documentation

Layer / File(s)Summary
Document HTTPS prerequisites and behavior
docs/user/remote-access.md		The guidance lists MagicDNS, HTTPS certificates, and Linux operator permissions as requirements. It states that T3 Code starts without adding the HTTPS route when any requirement is missing.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related issues

  • pingdotgg/t3code#17362: The documentation describes a related Tailscale HTTPS setup failure when prerequisites are missing, but does not add retry behavior.

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to 1e03b

The PR only clarifies Tailscale HTTPS prerequisites and does not alter runtime behavior.

Pre-merge checks: Passed 4
Check nameStatusExplanation
Title checkPassedThe title is concise, specific, and accurately describes the documentation change to the Tailscale HTTPS prerequisites.
Description checkPassedThe description covers the problem, documentation change, scope, issue reference, verification steps, observed results, and limitations. It clearly states that the change is documentation-only and ide…
Linked Issues checkPassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes checkPassedCheck skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description covers the problem, documentation change, scope, issue reference, verification steps, observed results, and limitations. It clearly states that the change is documentation-only and identifies the checks that were not performed.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

Mmaria12d ago

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

verified the documentation change at 1e03b48a95a6215200f2e11f07459bd278e4d318, with limited runtime coverage. this is a seven-line docs-only change, not a runtime fix. no source changes or pushes were needed.

  • installed dependencies and ran github/main (fa4e4677c0) in a separate worktree first, then the exact pr head. ran one background dev server at a time with isolated empty state and T3CODE_TAILSCALE_SERVE=true.
  • used repo playwright and /usr/bin/google-chrome to pair locally, add the real repository through the app, create a thread, select codex gpt-6.1-sol, and submit a real read-only turn. no mocks, fixtures, demo data or replay provider.
  • main's completed turn confirmed the section omitted all three prerequisites. the pr's completed turn read the updated file and displayed magicdns, https certificates, linux permissions, and both working links. the screenshots show documentation content through the real client/provider path; they do not prove tailnet configuration.
  • both servers logged Failed to configure Tailscale Serve with TailscaleCommandSpawnError because tailscale is not installed. local pairing and real codex turns still worked afterward. pair --tailscale explicitly failed with TailscaleUnavailableError. unauthenticated access to the protected shell endpoint returned 401.
  • both linked tailscale pages returned 200. their current text requires magicdns and enabling https certificates, and explains linux operator permission.
  • vp run check:changed passed on blacksmith: format passed for the one changed docs file; knip skipped because no code changed. the worker's initial missing merge base was repaired by fetching the fork head history and restoring the exact pr base ref before rerunning.

short runtime transcript

main: real codex turn confirms the prerequisite guidance is absent

pr: real codex turn reads the added prerequisites and links

pr: expanding the completed real codex turn to inspect its file-reading command

Not verified

this vm has neither a tailscale installation nor an authenticated tailnet. i could not reproduce missing magicdns, disabled https certificates, or missing linux operator permission individually, nor successful https publication, prerequisite recovery, or cross-device access. the missing-executable case above is separate and does not prove those three cases. those claims remain supported by the linked upstream docs and source inspection, not a live tailnet run.

native desktop, ios/android, macos/windows behavior was not exercised. no product ui changed. this pass verifies the documentation and local fallback/provider path, not end-to-end tailscale https.