Hi,

 

I have to reauthenticate Tailscale in Unraid 7 and every docker app that uses Tailscale after a reboot.

I use the latest Tailscale plugin (not the docker one)

Is there a solution?

 

Many thanks for help

 

Which version Unraid? 

7.0.0

51 minutes ago, SL99999999 said:

I have to reauthenticate Tailscale in Unraid 7 and every docker app that uses Tailscale after a reboot.

Are you using the Integration in the Docker Templates, so to speak:

 

or do you use the Sidcear method, TSDProxy or the Tailscale Plugin exclusively?

I use the integration as in the picture

3 hours ago, SL99999999 said:

I use the integration as in the picture

Okay, what container gives you issues? It might be possible that the wrong state directory is selected.

You can set the state directory manually by opening the Docker template, enabled "Tailscale Show Advanced Settings" and at "Tailscale State Directory" enter a persistent storage path from inside the container (not the path on the host):

 

In this case the path in the container would be "/firefox" and if you need or want to set it manually you would need to enter this directory followed by a directory where you want to store the files for Tailscale (I would recommend to use a "." at the beginning because then the directory is hidden) so to speak the path would be: "/firefox/.tailscale_state"

I can't login anymore to Tailscale (no more login link presented in the log) after changing the path,  even when i change it back.

1 hour ago, SL99999999 said:

I can't login anymore to Tailscale (no more login link presented in the log) after changing the path,  even when i change it back.

Please check the whole log, sometimes the autheticatuon link is displayed at the very top in the logs.

 

You also can generate a token and then add add the token into the extra parameters as described in the Tailscale documentation:

https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key

 

This should then look something like that:

(after the container is again in your Tailnet it is safe to remove the auth key)

3 minutes ago, SL99999999 said:

Do you need the troubleshooting packages?

 

See my post above I edited it.

 

I would also maybe recommend to:

1. Stop the container
2. Go into the container directory and delete the .tailscale_state directory
3. Start the container again

I assume you possibly tried many things and now the state directory is possibky messed up.

 

However it is really interesting to me that the Unraid Tailscale Docker integration is not picking up the directory since the container is using /conf.

 

What path mappings are in your template? Do you use /mnt/user/… or do you use /mnt/cache/… or similar?

If you are using /mnt/cache/… you have to ensure that for example the share directory stays on the cache and is not moved to the Array by the mover.

*deleting .tailscale_state = no difference

*troubleshooting packages = no difference

*i don't use cache

*adding Auth key = no difference, not showing up in tailnet, same output in log

Edited January 19, 20251 yr by SL99999999

16 minutes ago, SL99999999 said:

*deleting .tailscale_state = no difference

*troubleshooting packages = no difference

*i don't use cache

*adding Auth key = no difference, not showing up in tailnet, same output in log

What container are you using (Repository)?

Can you please provide a bit more information since it is really hard to troubleshoot.

Do you maybe have screenshots or anything?

I have it with all containers.

 

I need to go to work now

to be continued...

34 minutes ago, SL99999999 said:

I have it with all containers.

 

I need to go to work now

to be continued...

Can you please post at least one container that you are having issues with?

I even don‘t know one container so that I could try it myselfe?

What container is the one with the /conf directory?

 

May I ask where you are located in the world?

FreshRSS, Duplicati, Dailynotes

10 minutes ago, SL99999999 said:

Duplicati

 

It picked up the state dir automatically:

 

16 minutes ago, SL99999999 said:

Dailynotes

 

Here you can see that it doesn't picked up the state directory:

 

but after setting it manually:

 

 

everything is working as it should

 

22 minutes ago, SL99999999 said:

FreshRSS

 

After the start authentication works:

 

However if you are using Serve like me you have to disable https in the nginx configuration from FreshRSS, you can simply do that by going to the directory from FreshRSS and edit the nginx default site config: .../freshrss/nginx/site-confs/default.conf and comment these two lines:

 

since Serve uses by default port 443 and nginx can't simply start if a application already uses 443, after that restart the container and freshrss is started.

 

 

I can now see all three container in my Tailnet:

 

And I can connect to them via the Tailnet:

 

 

 

 

Where are you located in the world? I've seen already a few reports from China that Tailscale is not working there sometimes.

First, many thanks for all the help

I live in Belgium, all my other homelab stuff works with Tailscale, i only have problems with Unraid.

I don't use serve.

My log never show 'To autenticate, visit:"

Edited January 19, 20251 yr by SL99999999

1 minute ago, SL99999999 said:

I live in Belgium, all my other homelab stuff works with Tailscale, i only have problems with Unraid.

Please note that I don't use the Tailscale Plugin on my server, if you are using it please try to disable Tailscale DNS, maybe that's the root cause of the issue but I don't think so.

 

Can you also rule out a browser issue try to refresh the browser window after it says Starting Tailscale.

 

Please maybe also try to use a key:

Go to your Tailscale Dashboard -> Settings -> Keys: https://login.tailscale.com/admin/settings/keys

Then click Generate auth key...:

In the following prompt klick Generate Key:

 

Copy the auth key from the following windows to your clipboard:

 

In the template copy the auth key to Tailscale Extra Parameters (don't forget to add --auth-key= in front of the key) :

 

After that you should see that you don't get a prompt to authenticate:

 

and in your Tailscale Dashboard you should see that the key is now invalidated since if it is used once it will be invalidated (as long as you don't set it to be Reusable) :

 

 

Are you also sure that you don't block anything for your Unraid server or you have special rules in place because it's not working?

SOLUTION:

*add Auth key: no difference (= same log file)

*disable 'override local DNS' in Tailscale: no difference (I use Control D DNS)

*deleting Tailscale plugin from Unraid: no difference

*refresh browser CTRL+F5: NOW I CAN AUTHENICATE AGAIN

 

Wow, what a journey BUT... i have to restart the container to show up in Tailnet after a reboot.

1. reboot Unraid OK

2. array auto start OK

3. docker auto start OK

4. containers auto start OK

5. containers not showing up in Tailnet, i have to manual restart containers

 

 

 

Edited January 20, 20251 yr by SL99999999

1 hour ago, SL99999999 said:

*refresh browser CTRL+F5: NOW I CAN AUTHENICATE AGAIN

Oh okay, this then seems to be a browser issue.

 

1 hour ago, SL99999999 said:

Wow, what a journey BUT... i have to restart the container to show up in Tailnet after a reboot.

This is definitely not how it should work...

Are you also sure if you really need to restart the container since often times if you ping the container from another machine with: `tailscale ping <NAME>` it should respond.

I only can think of a network issue, over here everything is working even after a reboot from the whole server.

Back to zero:

The login link is again not avaiable even with browser refresh.

I alos tried on a freshly installed Unraid with same result. ...

 

2 hours ago, SL99999999 said:

Back to zero:

The login link is again not avaiable even with browser refresh.

I alos tried on a freshly installed Unraid with same result. ...

 

And what about the auth key?

When this method also doesn't work I assume something is wrong when the container tries to connect with Tailscale.

Do you have any AdBlocking or Unifi network gear on your network, at least from my game servers support thread Unifi network gear can be quiet tricky because it's very picky when it comes to IDS and IPS.

REAL SOLUTION

There are some real clever people on this world   ❗(ich777)❗

 

It was indeed IDS & IPS threat managment. 

My router was flooded with  "ET USER_AGENTS Go HTTP Client User-Agent" intrusions in the log with all the IP addresses used by Tailnet.

I suppresesed the intrusions and my Tailnet came alive. 

Even the reboot problem is solved. No need to re-authenticate again.

 

Many many thanks to ich777 for your patience and excellent guides.