# Tailscale

:::tip
**tl;dr**


1. We use Headscale – an alternative Login Server for Tailscale.
2. You’ll need your BKSP ID account to connect.
3. Our Login Server URL is `https://tail.bksp.in`
4. Follow [the official guide](https://tailscale.com/docs/how-to/set-up-custom-control-server) on how to use a custom Login Server.

:::

## Connect a Personal Device (PD)


1. Download a Tailscale client for your platform.
2. Make sure you have access to your BKSP ID account.
3. Follow [the official guide](https://tailscale.com/docs/how-to/set-up-custom-control-server), using https://tail.bksp.in as Login Server URL.

### ACL

Personal devices can connect to any other nodes unless explicitly defined in ACL policy.

### Exit nodes

You’re welcome to use available exit nodes for your personal needs but please ensure you don’t abuse or violate local laws. If you’re unsure about your specific use-case, ask an Infra WG.

### Subnet Routers

You can access B4CK network remotely while connected via Tailscale. This should work right out of the box, but if not – check [this article](https://tailscale.com/docs/features/subnet-routers?tab=macos#use-your-subnet-routes-from-other-devices) on how to manually enable it on your device.

### Caveats

* Personal sessions are limited to 8 hours. You’ll need to re-authenticate after that.

## Connect a B4CKSP4CE Device (M2M)


:::info
**We discontinued using Konstantin’s Service Account as of May 2026.**  
Tag-only key is now a preferred method.

:::

We connect B4CKSP4CE-owned nodes using tag-owned keys. Unlike personal devices, these weren’t linked to a specific BKSP ID account but rather a special service account within Headscale.

This prevents them from being affected by the default 8-hour session timeout and ensures they remain functional even after the Resident has left.

### Tags

| **Tag** | **Description** | ACL Excerpt |
|-----|-------------|-------------|
| **public** | Public devices available to guests, thus are not trustworthy. | Incoming: allow from anywhere. |
| **infra** | Infrastructure nodes. | Incoming: allow from anywhere but **public**-tagged nodes |

### Creating a pre-auth key


1. Open [Headplane](https://tail.bksp.in/admin) and log-in using your BKSP ID account.

   
   1. **If it’s your first login into Headplane** – reach to Infra WG and ask somebody to elevate your permissions.
2. Navigate to **Settings** → [**Manage Auth Keys**](https://tail.bksp.in/admin/settings/auth-keys)**.**
3. Click on **Create pre-auth key**.
4. Fill the modal form as on the screenshot below:

   
   1. Select **Tag-only key** (1).
   2. Fill the **ACL Tags** for this machine (2).
   3. Avoid enabling **Reusable** or **Ephemeral** unless you’re fully aware of their functions and certain you actually need them.
5. Click on **Confirm**.
6. Pre-auth key will appear alongside with a proper `tailscale up` snippet to use.

  
 ![](https://storage.yandexcloud.net/bksp-wiki-assets/uploads/298a2e26-87de-4753-a045-717271c8b2f5/079d06e2-22ba-4222-a285-d83acf90f170/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=YCAJEMO2-DwUmfLoAY9UdwOXD%2F20260911%2Fru-central1-a%2Fs3%2Faws4_request&X-Amz-Date=20260911T124500Z&X-Amz-Expires=86400&X-Amz-Signature=da23cd9f7df9ad56b9d161a3668d7aabadf574c6825817f164b89e87781b20ff&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject " =1188x875")

---

**Documents**

- [BKSP 101](https://wiki.bksp.in/s/public/doc/bksp-101-HvrtlzB32F)
- [Проекты](https://wiki.bksp.in/s/public/doc/proekty-yjWZscgTvo)
- [Infrastructure](https://wiki.bksp.in/s/public/doc/infrastructure-VPKsJwVSVh)
- [Пространство](https://wiki.bksp.in/s/public/doc/prostranstvo-UF1eSbQDi5)
- [Equipment](https://wiki.bksp.in/s/public/doc/equipment-t5MYAVJ8l0)
- [Other](https://wiki.bksp.in/s/public/doc/other-uPW1YJQaRt)