blairdrummond / vault-plugin-tailscale

A HashiCorp Vault plugin for managing Tailscale authentication keys

vault-plugin-tailscale

A HashiCorp Vault plugin for generating device authentication keys for Tailscale. Generated keys are single use.

Installation

1. Download the binary for your architecture from the releases page
2. Generate the SHA256 sum of the plugin binary

$ sha256sum vault-plugin-tailscale | cut -d ' ' -f1
d6ffe79b13326eb472af0b670c694f21f779d524068ad705a672a00f6d433724

3. Add the plugin to your Vault plugin catalog

$ vault plugin register -sha256=d6ffe79b13326eb472af0b670c694f21f779d524068ad705a672a00f6d433724 secret vault-plugin-tailscale
Success! Registered plugin: vault-plugin-tailscale

4. Enable the plugin

$ vault secrets enable -path=tailscale vault-plugin-tailscale 
Success! Enabled the vault-plugin-tailscale secrets engine at: tailscale/

Usage

1. Obtain an API key from the Tailscale admin dashboard.
2. Create the Vault configuration for the Tailscale API

$ vault write tailscale/config tailnet=$TAILNET api_key=$API_KEY
Success! Data written to: tailscale/config

2. Generate keys using the Vault CLI.

$ vault read tailscale/key
Key          Value
---          -----
ephemeral    false
expires      2022-04-30T00:32:36Z
id           kMxzN47CNTRL
key          secret-key-data
reusable     false
tags         <nil>