Tailscale Integration

​

Use Cases

• Multi-device sync: Two profClaw instances sync their state over Tailscale without exposing ports to the internet
• Private webhook delivery: Receive GitHub/Jira webhooks to a home server via a Tailscale Funnel or a cloudflared alternative
• Agent-to-agent calls: Sub-agents spawned on different machines communicate over the tailnet
• Remote CLI access: Run profclaw CLI commands against a remote server over ssh

​

Setup

​

1. Install Tailscale

# macOS
brew install tailscale

# Linux
curl -fsSL https://tailscale.com/install.sh | sh

# Docker
docker pull tailscale/tailscale

​

2. Configure environment variables

TAILSCALE_AUTH_KEY=tskey-auth-...
TAILSCALE_TAILNET=your-tailnet-name.ts.net
TAILSCALE_HOSTNAME=profclaw-server   # optional, defaults to hostname

​

3. Start Tailscale

tailscale up --authkey="${TAILSCALE_AUTH_KEY}" --hostname=profclaw-server

​

4. Verify connectivity

tailscale status
tailscale ping profclaw-server

​

profClaw Tailscale Module

• Querying device status and assigned IP addresses
• Checking peer connectivity before sync operations
• Registering the current node on startup

​

Tunnel Configuration

# Expose profClaw port 3000 via Tailscale Funnel
tailscale funnel 3000

​

Security Model

• All traffic between tailnet nodes is encrypted with WireGuard
• Device authentication uses the Tailscale identity provider (Google, GitHub, OIDC, or SAML)
• ACLs on the Tailscale admin panel control which nodes can reach the profClaw API port
• The profClaw device identity system (src/auth/device-identity.ts) uses Ed25519 key pairs that complement Tailscale’s node identity

​

Multi-Device Sync over Tailscale

# config/settings.yml
sync:
  peers:
    - name: profclaw-home
      url: http://100.64.0.2:3000  # Tailscale IP
      authToken: "${PEER_AUTH_TOKEN}"