Session 1VvNwjvl4b9b

Let me check the current state to see what's broken now.

Found it. Two things drifted:

1. AdvertiseServices: null — the advertise pref got cleared again (the node is no longer advertising the service). This is the direct cause of the timeout.
2. opencode restarted (new pid 1298987) but is still correctly on 0.0.0.0:4096, and the serve config + service-host approval + tag are all still intact.

So this is just the advertise pref being dropped again. We have operator access, so I can fix it directly.

The operator setting got reset too — prefs write access denied again. This happens because tailscale up (and likely a tailscaled restart/reinstall) wipes both the operator pref AND the advertise pref. That's the recurring root cause of this breaking.

You need to run these two with sudo (my shell can't elevate):

sudo tailscale set --operator=$USER
sudo tailscale serve advertise svc:opencode

Run those, then I'll verify.

But to stop this from recurring, the real fix is to make the advertise persistent and run tailscaled with the operator baked in. Once you've run the two commands above and I confirm it works, I'll set up a small systemd unit (or restart hook) that re-advertises svc:opencode automatically whenever tailscaled starts — so a reboot or tailscale up never silently breaks it again.

Go ahead and run the two commands, then tell me.

Working again — both HTTPS and HTTP return 200.

Now let's make this permanent so you stop having to re-fix it. The problem: a tailscaled restart or tailscale up wipes the advertise pref. A systemd unit that re-advertises on every tailscaled start will fix it for good. Let me check your systemd setup first.

tailscaled runs as a standard systemd unit. The cleanest persistence approach is a systemd drop-in that runs tailscale serve advertise svc:opencode after tailscaled starts. But note: the advertise pref should persist across normal restarts — the reason it keeps getting wiped is specifically tailscale up re-auth. A drop-in ExecStartPost covers both cases.

This needs root to write to /etc/systemd/system/. Let me prepare the files in /tmp (which I can write), then give you the sudo commands to install them.

Drop-in is ready. There's one consideration: ExecStartPost runs as root, and serve advertise needs operator/root — running as root satisfies that, so the operator-reset issue won't matter for the auto-readvertise. Good.

Run these (sudo) to install the persistence hook:

sudo install -d /etc/systemd/system/tailscaled.service.d
sudo cp /tmp/ts-fix/override.conf /etc/systemd/system/tailscaled.service.d/advertise-opencode.conf
sudo systemctl daemon-reload
sudo systemctl restart tailscaled

This makes tailscaled re-advertise svc:opencode automatically ~5s after every start (covering reboots and tailscaled restarts).

Important caveat: This drop-in does not fire on tailscale up (that's a runtime re-auth, not a service start). So if you run tailscale up again, the advertise pref will still get wiped until the next tailscaled restart. Two options for that:

• Just remember to run sudo tailscale serve advertise svc:opencode after any tailscale up, or
• Avoid bare tailscale up; use tailscale set for pref changes instead.

Run the install commands above and restart tailscaled, then I'll verify the auto-advertise kicked in.

Good catch — my /tmp is sandboxed and not visible to your sudo shell. Let me write it to your home directory instead.

File is at ~/ts-advertise-opencode.conf. Run these (sudo) to install the persistence hook:

sudo install -d /etc/systemd/system/tailscaled.service.d
sudo cp ~/ts-advertise-opencode.conf /etc/systemd/system/tailscaled.service.d/advertise-opencode.conf
sudo systemctl daemon-reload
sudo systemctl restart tailscaled

This makes tailscaled auto-run tailscale serve advertise svc:opencode ~5s after every start, so reboots/restarts won't break it anymore.

Run those, then tell me and I'll verify the auto-advertise survived the restart (without me touching the pref manually).

Restarting tailscaled cleared the advertise pref — let me verify the ExecStartPost hook re-applied it automatically (giving it a moment after restart).

The persistence hook works. Confirmed:

• Drop-in installed ✓ (ExecStartPost present in the unit)
• Auto-advertise fired ✓ — after the tailscaled restart, AdvertiseServices: ["svc:opencode"] was set automatically by the hook, with no manual intervention from me
• Service serving ✓ — HTTPS and HTTP both return 200

You're set

The service now self-heals on every tailscaled start (reboots, restarts, crashes). Since the hook runs as root via systemd, it doesn't depend on the operator pref either, so that reset issue won't bite you anymore.

One remaining edge case: tailscale up (interactive re-auth) wipes the advertise pref at runtime and won't trigger the hook. If you ever run it, either:

• sudo systemctl restart tailscaled (hook re-advertises), or
• sudo tailscale serve advertise svc:opencode directly.

Cleanup: the staging file ~/ts-advertise-opencode.conf is no longer needed (the installed copy lives at /etc/systemd/system/tailscaled.service.d/advertise-opencode.conf). You can remove it with rm ~/ts-advertise-opencode.conf whenever you like.