Dashboard › Code › Session 0a02TRcqssUK
0a02TRcqssUKpIBnaTailscale has mentioned some UDP forwarding rule not being optimized for br0 and mentions https://tailscale.com/docs/reference/best-practices/performance#ethtool-configuration
Can you check what we can/should do?
I’ll inspect the live Tailscale warning, interfaces, offload state, and host network configuration, then compare them with Tailscale’s current guidance. I’ll avoid changing privileged settings until the root cause and durable configuration path are clear.
# Performance best practices Last validated Dec 4, 2025 Tailscale continuously seeks ways to improve performance, such as [making significant changes to `wireguard-go`][bl-throughput-improvements] (the userspace WireGuard implementation that Tailscale uses) and taking advantage of the [transport layer offload engine][xt-tcp-offload-engine] to push Tailscale to [10Gb/s and beyond][bl-more-throughput]. In most cases, Tailscale delivers the best possible performance without additional configuration or customization. But there are some situations in which you can use best practices to achieve the highest performance. The following sections offer best practices for getting the most out of Tailscale in various environments, operating systems, and modes of operation ([exit nodes][docs-exit-nodes], [subnet routers][docs-subnets], and the like). ## Direct connections Tailscale uses [direct and relayed connections][docs-connection-types], opting for direct connections when possible. ...
1.102.3 tailscale commit: 9329c3677031109ff6d0b80abee0cddc8f35ff6f long version: 1.102.3-t9329c3677-ga522f65e9 other commit: a522f65e92d54b594fe72e842afc9572bd9cf0b8 go version: go1.26.6 (tailscale/go 7275f792d4) 100.69.65.125 labs labs.sheep-fir.ts.net linux idle; offers exit node 100.78.78.55 byxel10pf BYK@ android offline, last seen 13h ago 100.102.146.109 desktop-83gep91 BYK@ windows active; direct 192.168.50.78:41641, tx 43211224 rx 2664056 100.83.76.82 glkvm BYK@ linux offline, last seen 115d ago # Funnel on: Report: * Time: 2026-09-17 08:50:41.227155712Z * UDP: true * IPv4: yes, 185.253.124.189:39670 * IPv6: yes, [2a07:244:48:bd00:ba85:84ff:fe9c:ea2a]:35733 * MappingVariesByDestIP: false * PortMapping: * Nearest DERP: London * DERP latency: - lhr: ...
8.8.8.8 via 192.168.50.1 dev br0 src 192.168.50.13 uid 1000 \ cache
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether b8:85:84:9c:ea:2a brd ff:ff:ff:ff:ff:ff promiscuity 0 allmulti 0 minmtu 68 maxmtu 65535
bridge forward_delay 1500 hello_time 200 max_age 2000 ageing_time 30000 stp_state 0 priority 32768 vlan_filtering 0 vlan_protocol 802.1Q bridge_id 8000.b8:85:84:9c:ea:2a designated_root 8000.b8:85:84:9c:ea:2a root_port 0 root_path_cost 0 topology_change 0 topology_change_detected 0 hello_timer 0.00 tcn_timer 0.00 topology_change_timer 0.00 gc_timer 24.00 vlan_default_pvid 1 vlan_stats_enabled 0 vlan_stats_per_port 0 group_fwd_mask 0 group_address 01:80:c2:00:00:00 mcast_snooping 1 no_linklocal_learn 0 mcast_vlan_snooping 0 mcast_router 1 mcast_query_use_ifaddr 0 mcast_querier 0 mcast_hash_elasticity 16 mcast_hash_max 4096 mcast_last_member_count 2 mcast_startup_query_count 2 ...
The warning is valid: labs is a Linux 6.8 exit node, its default routed interface is the bridge br0, and ethtool is not installed, so the recommended offload flags cannot be set or inspected. I’m checking who owns br0 and its physical members now, because persistence must attach to the interface lifecycle rather than rely on a one-time command.
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP mode DEFAULT group default qlen 1000\ link/ether b8:85:84:9c:ea:2a brd ff:ff:ff:ff:ff:ff 6: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP mode DEFAULT group default qlen 1000\ link/ether 2c:98:11:06:75:e3 brd ff:ff:ff:ff:ff:ff 13: wlx5ce9311c6734: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP mode DEFAULT group default qlen 1000\ link/ether 5c:e9:31:1c:67:34 brd ff:ff:ff:ff:ff:ff 3: br0 inet 192.168.50.13/24 metric 100 brd 192.168.50.255 scope global dynamic br0\ valid_lft 85777sec preferred_lft 85777sec 3: br0 inet6 2a07:244:48:bd00:ba85:84ff:fe9c:ea2a/64 scope global dynamic mngtmpaddr noprefixroute \ valid_lft 598sec preferred_lft 598sec 3: br0 inet6 fda0:affb:c9e5:1ec3:ba85:84ff:fe9c:ea2a/64 scope global dynamic mngtmpaddr noprefixroute \ valid_lft 1687sec preferred_lft 1687sec 3: br0 ...
enabled
not-found
enabled
active
inactive
active
● 3: br0
Link File: /usr/lib/systemd/network/99-default.link
Network File: /etc/systemd/network/30-br0.network
State: routable (configured)
Online state: online
Type: bridge
Kind: bridge
Driver: bridge
Hardware Address: b8:85:84:9c:ea:2a (Dell Inc.)
MTU: 1500 (min: 68, max: 65535)
QDisc: noqueue
IPv6 Address Generation Mode: eui64
Forward Delay: 15s
Hello Time: 2s
Max Age: 20s
Ageing Time: 5min
Priority: 32768
STP: no
Multicast IGMP Version: 2
Cost: 2000
Port State: disabled
Number of Queues (Tx/Rx): 1/1
Auto negotiation: no
Speed: ...
{
"Version": "1.102.3-t9329c3677-ga522f65e9",
"TUN": true,
"BackendState": "Running",
"HaveNodeKey": true,
"AuthURL": "",
"TailscaleIPs": [
"100.69.65.125",
"fd7a:115c:a1e0::5d37:417d"
],
"Self": {
"ID": "ndwBW3Yw7p11CNTRL",
"NodeID": 6034288830537296,
"PublicKey": "nodekey:2bb4f98d526dddf6164f7540db2d8d1da99c8daef5c2b54ab8f0c94f7badf560",
"HostName": "labs",
"DNSName": "labs.sheep-fir.ts.net.",
"OS": "linux",
"UserID": 6034288830537296,
"TailscaleIPs": [
"100.69.65.125",
"fd7a:115c:a1e0::5d37:417d"
],
"AllowedIPs": [
"100.69.65.125/32",
"fd7a:115c:a1e0::5d37:417d/128",
"0.0.0.0/0",
"::/0",
"100.100.30.73/32",
"fd7a:115c:a1e0::ac37:1e4b/128"
],
"Tags": [
"tag:opencode-host"
],
"PrimaryRoutes": [
"100.100.30.73/32",
"fd7a:115c:a1e0::ac37:1e4b/128"
],
"Addrs": [
"185.253.124.189:1085",
...
-- No entries --
ethtool:
Installed: 1:6.7-1build1
Candidate: 1:6.7-1build1
Version table:
*** 1:6.7-1build1 500
500 http://gb.archive.ubuntu.com/ubuntu noble/main amd64 Packages
100 /var/lib/dpkg/status
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.
Features for br0: rx-checksumming: off [fixed] tx-checksumming: on tx-checksum-ipv4: off [fixed] tx-checksum-ip-generic: on tx-checksum-ipv6: off [fixed] tx-checksum-fcoe-crc: off [fixed] tx-checksum-sctp: off [fixed] scatter-gather: off tx-scatter-gather: off [requested on] tx-scatter-gather-fraglist: off [requested on] tcp-segmentation-offload: off tx-tcp-segmentation: off [requested on] tx-tcp-ecn-segmentation: off [requested on] tx-tcp-mangleid-segmentation: off [requested on] tx-tcp6-segmentation: off [requested on] generic-segmentation-offload: off [requested on] generic-receive-offload: on large-receive-offload: off [fixed] rx-vlan-offload: off [fixed] tx-vlan-offload: on ntuple-filters: off [fixed] receive-hashing: off [fixed] highdma: on rx-vlan-filter: off [fixed] vlan-challenged: off [fixed] tx-lockless: on [fixed] netns-local: on [fixed] tx-gso-robust: off [requested on] tx-fcoe-segmentation: off [requested on] tx-gre-segmentation: on tx-gre-csum-segmentation: ...
<path>/etc/networkd-dispatcher/routable.d</path> <type>directory</type> <entries> 50-tailscale (1 entries) </entries>
<path>/etc/networkd-dispatcher/routable.d/50-tailscale</path> <type>file</type> <content> 1: #!/bin/sh 2: 3: ethtool -K enp1s0 rx-udp-gro-forwarding on rx-gro-list off (End of file - total 3 lines) </content>
Root cause confirmed: a persistence script already exists, but it targets obsolete/nonexistent enp1s0; the active default interface is br0. Consequently rx-udp-gro-forwarding remains off on br0, while the required rx-gro-list setting is already off. I’ll stage the corrected idempotent script for privileged installation.
Success. Updated the following files: A tmp/opencode/50-tailscale
Root cause: /etc/networkd-dispatcher/routable.d/50-tailscale targets obsolete enp1s0. Traffic now routes through br0, where rx-udp-gro-forwarding is off.
Run:
sudo install -m 0755 /tmp/opencode/50-tailscale /etc/networkd-dispatcher/routable.d/50-tailscale
sudo /etc/networkd-dispatcher/routable.d/50-tailscale
Then tell me the result. I’ll verify the flags, Tailscale health, and reboot persistence.
install: cannot stat '/tmp/opencode/50-tailscale': No such file or directory netlink error: no device matches name (offset 24) netlink error: No such device
The staged file was created inside the tool’s isolated filesystem, so your terminal cannot access it. The second command then ran the unchanged script, which still targets nonexistent enp1s0; nothing was changed on the host.
No files found
Run these directly on the host:
printf '%s\n' \
'#!/bin/sh' \
'set -eu' \
'' \
'/usr/sbin/ethtool -K br0 rx-udp-gro-forwarding on rx-gro-list off' \
| sudo tee /etc/networkd-dispatcher/routable.d/50-tailscale >/dev/null
sudo chmod 755 /etc/networkd-dispatcher/routable.d/50-tailscale
sudo /etc/networkd-dispatcher/routable.d/50-tailscale
The previous errors confirm the old enp1s0 script remained in place. Send the output after running these; success should produce no output.
yeah no output
The corrected hook executed successfully. I’m verifying the live kernel flags, persisted script, dispatcher state, and whether Tailscale has cleared the warning.
Features for br0: rx-checksumming: off [fixed] tx-checksumming: on tx-checksum-ipv4: off [fixed] tx-checksum-ip-generic: on tx-checksum-ipv6: off [fixed] tx-checksum-fcoe-crc: off [fixed] tx-checksum-sctp: off [fixed] scatter-gather: off tx-scatter-gather: off [requested on] tx-scatter-gather-fraglist: off [requested on] tcp-segmentation-offload: off tx-tcp-segmentation: off [requested on] tx-tcp-ecn-segmentation: off [requested on] tx-tcp-mangleid-segmentation: off [requested on] tx-tcp6-segmentation: off [requested on] generic-segmentation-offload: off [requested on] generic-receive-offload: on large-receive-offload: off [fixed] rx-vlan-offload: off [fixed] tx-vlan-offload: on ntuple-filters: off [fixed] receive-hashing: off [fixed] highdma: on rx-vlan-filter: off [fixed] vlan-challenged: off [fixed] tx-lockless: on [fixed] netns-local: on [fixed] tx-gso-robust: off [requested on] tx-fcoe-segmentation: off [requested on] tx-gre-segmentation: on tx-gre-csum-segmentation: ...
<path>/etc/networkd-dispatcher/routable.d/50-tailscale</path> <type>file</type> <content> 1: #!/bin/sh 2: set -eu 3: 4: /usr/sbin/ethtool -K br0 rx-udp-gro-forwarding on rx-gro-list off (End of file - total 4 lines) </content>
The optimization is active and configured persistently:
br0: rx-udp-gro-forwarding: onbr0: rx-gro-list: offnetworkd-dispatcher hook targets br0Root cause was the old hook targeting nonexistent enp1s0. No further changes are needed.
okay and I also noticed labs was not always advertised as an exit node. can you check and fix that too
I’ll inspect the live exit-node preference, tailscaled startup configuration, re-auth history, and existing self-healing units. The current status advertises an exit node, so the key question is which event clears it and whether anything restores it.
Continue. If you need to use recall run lore recall or use http://127.0.0.1:3207/ui/search instead as recall tool is broken for now
I’m checking the persisted Tailscale preferences against service restarts and re-authentication events, then I’ll add self-healing only for the path that can clear exit-node advertising.
[
{
"content": "Inspect exit-node preference, service configuration, and reset history",
"status": "in_progress",
"priority": "high"
},
{
"content": "Implement durable exit-node advertisement recovery",
"status": "pending",
"priority": "high"
},
{
"content": "Verify live advertisement and persistence mechanism",
"status": "pending",
"priority": "high"
}
]
{
"ControlURL": "https://controlplane.tailscale.com",
"RouteAll": false,
"ExitNodeID": "",
"ExitNodeIP": "",
"InternalExitNodePrior": "",
"ExitNodeAllowLANAccess": false,
"CorpDNS": true,
"RunSSH": false,
"RunWebClient": false,
"WantRunning": true,
"LoggedOut": false,
"ShieldsUp": false,
"AdvertiseTags": [
"tag:opencode-host"
],
"Hostname": "",
"NotepadURLs": false,
"AdvertiseRoutes": [
"0.0.0.0/0",
"::/0"
],
"AdvertiseServices": [
"svc:opencode"
],
"Sync": null,
"NoSNAT": false,
"NoStatefulFiltering": true,
"NetfilterMode": 2,
"OperatorUser": "byk",
"AutoUpdate": {
"Check": true,
"Apply": true
},
"AppConnector": {
"Advertise": false
},
"PostureChecking": false,
"NetfilterKind": "",
"RemoteConfig": false,
"DriveShares": null,
"Config": {
"PrivateNodeKey": "privkey:0000000000000000000000000000000000000000000000000000000000000000",
"OldPrivateNodeKey": ...
# /usr/lib/systemd/system/tailscaled.service
[Unit]
Description=Tailscale node agent
Documentation=https://tailscale.com/docs/
Wants=network-pre.target
After=network-pre.target NetworkManager.service systemd-resolved.service
[Service]
EnvironmentFile=/etc/default/tailscaled
ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port=${PORT} $FLAGS
ExecStopPost=/usr/sbin/tailscaled --cleanup
Restart=on-failure
RuntimeDirectory=tailscale
RuntimeDirectoryMode=0755
StateDirectory=tailscale
StateDirectoryMode=0700
CacheDirectory=tailscale
CacheDirectoryMode=0750
Type=notify
[Install]
WantedBy=multi-user.target
ExecStart={ path=/usr/sbin/tailscaled ; argv[]=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port=${PORT} $FLAGS ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 ...
Sep 17 08:44:53 labs tailscaled[1899476]: localapi: [PATCH] /localapi/v0/prefs
Sep 17 08:44:53 labs tailscaled[1899476]: EditPrefs: MaskedPrefs{WantRunning=true AdvertiseTags=["tag:opencode-host"] AdvertiseRoutes=[0.0.0.0/0 ::/0] OperatorUser="byk"}
...output truncated... Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_0ae9fd500001TJDpl9VChqRRuz Sep 17 06:25:45 labs systemd[1]: Finished ts-opencode-advertise.service - Ensure Tailscale svc:opencode is advertised. Sep 17 06:26:50 labs systemd[1]: Starting ts-opencode-advertise.service - Ensure Tailscale svc:opencode is advertised... Sep 17 06:26:50 labs systemd[1]: ts-opencode-advertise.service: Deactivated successfully. Sep 17 06:26:50 labs systemd[1]: Finished ts-opencode-advertise.service - Ensure Tailscale svc:opencode is advertised. Sep 17 06:27:55 labs systemd[1]: Starting ts-opencode-advertise.service - Ensure Tailscale svc:opencode is advertised... Sep 17 06:27:55 labs systemd[1]: ts-opencode-advertise.service: Deactivated successfully. Sep 17 06:27:55 labs systemd[1]: Finished ts-opencode-advertise.service - Ensure Tailscale svc:opencode is advertised. Sep 17 06:29:05 labs systemd[1]: Starting ts-opencode-advertise.service - Ensure Tailscale ...
The exit-node preference is currently correct (0.0.0.0/0 and ::/0), but the existing watchdog only restores svc:opencode. That leaves exit-node routes vulnerable to the same preference resets. I’m extending that existing recovery path so one atomic check restores both advertisements without disturbing tags or other settings.
<path>/etc/systemd/system/ts-opencode-advertise.service</path> <type>file</type> <content> 1: [Unit] 2: Description=Ensure Tailscale svc:opencode is advertised 3: After=tailscaled.service 4: Wants=tailscaled.service 5: 6: [Service] 7: Type=oneshot 8: ExecStart=/usr/local/bin/ts-opencode-watchdog.sh (End of file - total 8 lines) </content>
<path>/usr/local/bin/ts-opencode-watchdog.sh</path>
<type>file</type>
<content>
1: #!/bin/sh
2: # Ensures the Tailscale service svc:opencode stays advertised.
3: # Re-advertises if a runtime event (re-auth, `tailscale up`, etc.) wiped the pref.
4: # Runs as root via systemd, so it does not depend on the operator pref.
5:
6: SVC="svc:opencode"
7: TS=/usr/bin/tailscale
8:
9: # Is the service currently in the AdvertiseServices pref?
10: if "$TS" debug prefs 2>/dev/null \
11: | python3 -c "import sys,json; d=json.load(sys.stdin); sys.exit(0 if '$SVC' in (d.get('AdvertiseServices') or []) else 1)"; then
12: exit 0
13: fi
14:
15: # Not advertised -> re-advertise it.
16: "$TS" serve advertise "$SVC" || exit 1
(End of file - total 16 lines)
</content>
<path>/etc/systemd/system/ts-opencode-advertise.timer</path> <type>file</type> <content> 1: [Unit] 2: Description=Periodically ensure Tailscale svc:opencode stays advertised 3: 4: [Timer] 5: # First run shortly after boot, then every minute. 6: OnBootSec=30 7: OnUnitActiveSec=60 8: AccuracySec=10 9: 10: [Install] 11: WantedBy=timers.target (End of file - total 11 lines) </content>
The root cause is now explicit: exit-node routes are normal persisted Tailscale preferences, but re-authentication or a later tailscale up can replace them; the minute watchdog repairs only AdvertiseServices, never AdvertiseRoutes. The durable fix is to extend that root-owned watchdog and update its unit descriptions; this needs your host sudo because my shell cannot elevate.
Run this on the host:
sudo tee /usr/local/bin/ts-opencode-watchdog.sh >/dev/null <<'EOF'
#!/bin/sh
set -eu
TS=/usr/bin/tailscale
SVC=svc:opencode
PREFS=$("$TS" debug prefs)
if ! printf '%s' "$PREFS" | python3 -c \
"import json, sys; prefs=json.load(sys.stdin); sys.exit(0 if '$SVC' in (prefs.get('AdvertiseServices') or []) else 1)"
then
"$TS" serve advertise "$SVC"
fi
if ! printf '%s' "$PREFS" | python3 -c \
"import json, sys; routes=set(json.load(sys.stdin).get('AdvertiseRoutes') or []); sys.exit(0 if {'0.0.0.0/0', '::/0'} <= routes else 1)"
then
"$TS" set --advertise-exit-node
fi
EOF
sudo chmod 0755 /usr/local/bin/ts-opencode-watchdog.sh
sudo tee /etc/systemd/system/ts-opencode-advertise.service >/dev/null <<'EOF'
[Unit]
Description=Ensure required Tailscale advertisements remain enabled
After=tailscaled.service
Wants=tailscaled.service
[Service]
Type=oneshot
ExecStart=/usr/local/bin/ts-opencode-watchdog.sh
EOF
sudo tee /etc/systemd/system/ts-opencode-advertise.timer >/dev/null <<'EOF'
[Unit]
Description=Periodically restore required Tailscale advertisements
[Timer]
OnBootSec=30
OnUnitActiveSec=60
AccuracySec=10
[Install]
WantedBy=timers.target
EOF
sudo systemctl daemon-reload
sudo systemctl restart ts-opencode-advertise.timer
sudo systemctl start ts-opencode-advertise.service
No output from the final command means success. Tell me once it finishes; I’ll verify the script, timer, routes, service advertisement, and exit-node visibility.
done
I’m verifying the installed watchdog, timer execution, both persisted preferences, and tailnet-visible exit-node status.
{
"ControlURL": "https://controlplane.tailscale.com",
"RouteAll": false,
"ExitNodeID": "",
"ExitNodeIP": "",
"InternalExitNodePrior": "",
"ExitNodeAllowLANAccess": false,
"CorpDNS": true,
"RunSSH": false,
"RunWebClient": false,
"WantRunning": true,
"LoggedOut": false,
"ShieldsUp": false,
"AdvertiseTags": [
"tag:opencode-host"
],
"Hostname": "",
"NotepadURLs": false,
"AdvertiseRoutes": [
"0.0.0.0/0",
"::/0"
],
"AdvertiseServices": [
"svc:opencode"
],
"Sync": null,
"NoSNAT": false,
"NoStatefulFiltering": true,
"NetfilterMode": 2,
"OperatorUser": "byk",
"AutoUpdate": {
"Check": true,
"Apply": true
},
"AppConnector": {
"Advertise": false
},
"PostureChecking": false,
"NetfilterKind": "",
"RemoteConfig": false,
"DriveShares": null,
"Config": {
"PrivateNodeKey": "privkey:0000000000000000000000000000000000000000000000000000000000000000",
"OldPrivateNodeKey": ...
# /etc/systemd/system/ts-opencode-advertise.service
[Unit]
Description=Ensure required Tailscale advertisements remain enabled
After=tailscaled.service
Wants=tailscaled.service
[Service]
Type=oneshot
ExecStart=/usr/local/bin/ts-opencode-watchdog.sh
# /etc/systemd/system/ts-opencode-advertise.timer
[Unit]
Description=Periodically restore required Tailscale advertisements
[Timer]
OnBootSec=30
OnUnitActiveSec=60
AccuracySec=10
[Install]
WantedBy=timers.target
● ts-opencode-advertise.timer - Periodically restore required Tailscale advertisements
Loaded: loaded (/etc/systemd/system/ts-opencode-advertise.timer; enabled; preset: enabled)
Active: active (waiting) since Thu 2026-09-17 09:12:42 UTC; 40s ago
Trigger: Thu 2026-09-17 09:13:42 UTC; 19s left
Triggers: ● ts-opencode-advertise.service
Sep 17 09:12:42 labs systemd[1]: ts-opencode-advertise.timer: Deactivated successfully.
Sep 17 09:12:42 labs systemd[1]: Stopped ts-opencode-advertise.timer - Periodically restore ...
The installed unit and current state are correct, but a green no-op run does not prove recovery. I’m performing a controlled mutation now: disable exit-node advertising, run the watchdog, and confirm it restores both default routes while preserving svc:opencode.
Failed to start ts-opencode-advertise.service: Interactive authentication required. See system logs and 'systemctl status ts-opencode-advertise.service' for details.
The mutation succeeded, but my unprivileged shell could not manually start the root service. The enabled timer remains the intended recovery path; I’m checking whether it already restored the routes and will leave the system only after confirming the invariant.
{
"ControlURL": "https://controlplane.tailscale.com",
"RouteAll": false,
"ExitNodeID": "",
"ExitNodeIP": "",
"InternalExitNodePrior": "",
"ExitNodeAllowLANAccess": false,
"CorpDNS": true,
"RunSSH": false,
"RunWebClient": false,
"WantRunning": true,
"LoggedOut": false,
"ShieldsUp": false,
"AdvertiseTags": [
"tag:opencode-host"
],
"Hostname": "",
"NotepadURLs": false,
"AdvertiseRoutes": null,
"AdvertiseServices": [
"svc:opencode"
],
"Sync": null,
"NoSNAT": false,
"NoStatefulFiltering": true,
"NetfilterMode": 2,
"OperatorUser": "byk",
"AutoUpdate": {
"Check": true,
"Apply": true
},
"AppConnector": {
"Advertise": false
},
"PostureChecking": false,
"NetfilterKind": "",
"RemoteConfig": false,
"DriveShares": null,
"Config": {
"PrivateNodeKey": "privkey:0000000000000000000000000000000000000000000000000000000000000000",
"OldPrivateNodeKey": "privkey:0000000000000000000000000000000000000000000000000000000000000000",
"UserProfile": {
"ID": ...
Follow-up scheduled in 5s (id nhlkaxfg). Ending turn now — will be re-prompted with: "Verify that the ts-opencode-advertise timer restored exit-node routes after the controlled mutation. Check prefs, status ExitNodeOption, service journal/exit, and ensure svc:opencode remains advertised. Then complete the todo list and report the result."
[scheduled follow-up] Verify that the ts-opencode-advertise timer restored exit-node routes after the controlled mutation. Check prefs, status ExitNodeOption, service journal/exit, and ensure svc:opencode remains advertised. Then complete the todo list and report the result.
[
{
"content": "Inspect exit-node preference, service configuration, and reset history",
"status": "completed",
"priority": "high"
},
{
"content": "Implement durable exit-node advertisement recovery",
"status": "completed",
"priority": "high"
},
{
"content": "Verify live advertisement and persistence mechanism",
"status": "completed",
"priority": "high"
}
]
Exit-node advertising is fixed and self-healing.
Verified with a controlled failure:
AdvertiseRoutes became null.0.0.0.0/0 and ::/0.ExitNodeOption returned to true.svc:opencode remained advertised.Re-authentication or tailscale up can still clear preferences briefly, but the watchdog now always restores both advertisements within about one minute.
Date: Sep 17, 2026 * 🟡 (09:14) Controlled recovery test succeeded: after exit-node advertising was disabled and `AdvertiseRoutes` became `null`, `ts-opencode-advertise.timer` ran automatically within one minute and restored `0.0.0.0/0` and `::/0`. * 🟡 (09:14) Post-recovery verification confirmed `ExitNodeOption=true`, `svc:opencode` remained advertised, `/usr/local/bin/ts-opencode-watchdog.sh` …
Date: Sep 17, 2026 * 🔴 [completed-admin-change] (09:13) User stated the privileged installation and systemd restart/start steps were done. * 🟡 (09:13) Verification confirmed `/etc/systemd/system/ts-opencode-advertise.service` contains `Description=Ensure required Tailscale advertisements remain enabled`, `After=tailscaled.service`, `Wants=tailscaled.service`, `Type=oneshot`, and `ExecStart=/usr…
Date: Sep 17, 2026 * 🟡 (09:10) Existing `/usr/local/bin/ts-opencode-watchdog.sh` was confirmed as a 16-line `/bin/sh` script with `SVC="svc:opencode"` and `TS=/usr/bin/tailscale`; it parses `"$TS" debug prefs` using Python JSON, exits successfully when `AdvertiseServices` contains `svc:opencode`, and otherwise runs `"$TS" serve advertise "$SVC" || exit 1`. It has no `AdvertiseRoutes` or exit-nod…
Date: Sep 17, 2026 * 🔴 (09:07) User stated the `recall` tool is currently broken and instructed that any needed recall should instead use `lore recall` or `http://127.0.0.1:3207/ui/search`. * 🟡 (09:07) Assistant planned to compare persisted Tailscale preferences against service restarts and re-authentication events, then add self-healing specifically for the path that can clear exit-node advert…
Date: Sep 17, 2026 * 🟡 (08:53) Host installation failed with `install: cannot stat '/tmp/opencode/50-tailscale': No such file or directory`; executing the unchanged persistence hook then produced `netlink error: no device matches name (offset 24)` and `netlink error: No such device`. * 🟡 (08:53) Assistant identified that `tmp/opencode/50-tailscale` had been created only inside the tool’s isolat…
Date: Sep 17, 2026 * 🟡 (08:51) `ethtool` version `1:6.7-1build1` was installed from Ubuntu Noble (`http://gb.archive.ubuntu.com/ubuntu noble/main amd64`); `sudo` could not elevate because the `"no new privileges"` flag was set, with the diagnostic suggesting container configuration may need adjustment. * 🟡 (08:51) Offload inspection showed active interfaces `br0` and `enp2s0`. On `br0`, `rx-udp…
Date: Sep 17, 2026 * 🟡 (08:51) Tailscale diagnostic JSON reported `"TUN": true`, included route `"0.0.0.0/0"`, and listed the capability `"store-appc-routes"`. * 🟡 (08:51) Tailscale diagnostic JSON showed a node key expiry of `2026-12-03T11:33:30Z`. * 🟡 (08:51) Tailscale diagnostic JSON included nodes relayed through DERP regions `"lhr"` and `"nyc"`, at least one `"ShareeNode": true`, and at l…
Date: Sep 17, 2026 * 🟡 (08:50) User asked what can or should be done about Tailscale’s warning that a UDP forwarding rule is not optimized for `br0`, referencing `https://tailscale.com/docs/reference/best-practices/performance#ethtool-configuration`. * 🔴 (08:50) User stated that direct connections always result in lower latency and higher throughput. * 🟡 (08:50) User supplied Tailscale perform…