Step 5: Prepare Tailscale

Tailscale creates a private, encrypted network (a "tailnet") between your devices. Your computer and your agent's VPS will both be on it. After setup, the VPS only accepts connections from your tailnet, so it is invisible to the rest of the internet.

Step 1: Create a Tailscale account

Sign up at login.tailscale.com. The free Personal plan is enough.

Step 2: Install Tailscale on your computer and connect

1. Download Tailscale from tailscale.com/download and install it.
2. Open it and sign in with the account from Step 1.
3. Make sure it shows Connected.

To check from a terminal:

tailscale status

If Tailscale isn't installed when you run officeclaws onboard, the CLI tries to install it for you (with Homebrew on macOS, or the official script on Linux). Installing it yourself first is more reliable. On Windows you must install it yourself: automatic installation isn't supported there.

Step 3: Create an auth key

The auth key lets your new VPS join your tailnet without anyone having to sign in on it.

1. Open the Keys page in the Tailscale admin console.
2. Click Generate auth key…
3. Set the options:
   • Reusable: on. You can then use the same key for more agents later.
   • Ephemeral: off. This is important. An ephemeral server is removed from your tailnet when it goes offline, and you would lose your agent.
   • Expiration: up to 90 days. The key only needs to be valid while an agent is being set up. Agents that are already running keep working after the key expires.
4. Click Generate key and copy the key. It starts with tskey-auth-.

The CLI will ask for this key in the next step:

Tailscale auth key: tskey-auth-...

It is saved in your keychain, so you won't be asked again until you replace it.

Important: your computer and the VPS must be in the same tailnet. Create the key in the same Tailscale account you're signed in to on your computer.

Step 4 (after setup): Turn off key expiry for the agent

By default, Tailscale asks every device to sign in again after about 180 days. A server can't do that by itself, so your agent would drop off the tailnet at that point. After your agent is created (Step 6):

1. Open Machines in the Tailscale admin console.
2. Find the agent's server. It has the agent's name, for example mona.
3. Click ⋯ → Disable key expiry.

Next step

Step 6: Create your agent →