Tailscale Setup Guide

meshTerm uses a read-only Tailscale API token to browse your Tailnet when adding hosts. It allows meshTerm to list your devices by name rather than requiring you to type IP addresses manually. Tailscale SSH connections work without it — you can skip this part and still connect to hosts if you know their Tailscale IP or hostname.

1. 1
   Go to the Tailscale admin console

   Open your browser and go to tailscale.com, then sign in to your account.

2. 2
   Navigate to API Keys

   Go to Settings → Personal Settings → Keys. Scroll down to the API Access Tokens section.

   tailscale.com › Settings › Personal Settings › Keys › API Access Tokens
3. 3
   Click Generate token

   Give the token a label so you can identify it later.

   💡 Suggested label: meshTerm
4. 4
   Set an expiry

   90 days is a sensible default. You can regenerate the token at any time in the same location.

   ⏱ Recommended: 90 days
5. 5
   Leave permissions as read-only

   meshTerm only needs to list the devices in your Tailnet. No write access is required or requested.

6. 6
   Copy the token

   Copy the token immediately — Tailscale will only show it once. If you lose it, generate a new one.

7. 7
   Paste it into meshTerm

   Open meshTerm and navigate to the API token setting.

   meshTerm › Settings › Tailscale › API Token

Tailscale SSH enables passwordless, keyless authentication when connecting from meshTerm to a remote host. Instead of a password or SSH key, authentication is handled by Tailscale's identity layer — if your device is on the Tailnet and authorised, you're in.

Requirements

Tailscale SSH is supported on Linux servers running Tailscale v1.30 or later. The host must be running the Tailscale daemon and be a member of the same Tailnet as your iPhone.

Step 1 — Enable Tailscale SSH on the server

Run this command on each Linux server you want to connect to without a password:

# Enable Tailscale SSH on the remote host
sudo tailscale up --ssh

Or if Tailscale is already running and you want to add SSH without changing other settings:

# Add SSH to existing Tailscale configuration
sudo tailscale set --ssh

Verify it's enabled:

# Check Tailscale SSH status
tailscale status

# You should see something like:
# 100.x.x.x   your-server  yourname@  linux   active; offers SSH

Step 2 — Enable Tailscale SSH in your ACL policy (if required)

Depending on your Tailscale plan and ACL configuration, you may need to explicitly permit SSH in your network's access control policy. For personal Tailscale accounts the default policy permits this automatically — you can skip this step.

If you manage a Tailnet with custom ACLs, add the following to your tailscale.com/admin/acls policy:

// Add to your ACL policy at tailscale.com/admin/acls
"ssh": [
  {
    "action": "accept",
    "src":    ["autogroup:member"],
    "dst":    ["autogroup:self"],
    "users":  ["autogroup:nonroot", "root"]
  }
]

Step 3 — Connect from meshTerm

Once Tailscale SSH is enabled on your server, select Tailscale SSH as the authentication method when adding or connecting to a host in meshTerm.

1. 1
   Open meshTerm and go to Hosts

   Your Tailscale peers are listed automatically if you have set up your API token. If not, add the host manually using its Tailscale IP (e.g. 100.x.x.x) or MagicDNS name (e.g. my-server.tail1234.ts.net).

2. 2
   Set Authentication to Tailscale SSH

   When adding or editing a host, select Tailscale SSH as the authentication method. No password or SSH key is needed.

3. 3
   Tap to connect

   meshTerm connects using your Tailscale identity — no password or SSH key required.

Tailscale SSH connection fails

• Confirm tailscale up --ssh was run on the server
• Run tailscale status on the server and check it says offers SSH
• Make sure both devices are on the same Tailnet and showing as connected
• Confirm Tailscale SSH is selected as the authentication method in meshTerm

Connection refused or permission denied

• Check your Tailscale ACL policy permits SSH between your devices
• Verify the username you are connecting as exists on the remote host
• Check journalctl -u tailscaled on the server for connection logs

API token expired

Generate a new token at tailscale.com → Settings → Personal Settings → Keys and update it in meshTerm → Settings → Tailscale → API Token.

Enabling Tailscale SSH by Linux distribution

# Install Tailscale (if not already installed)
curl -fsSL https://tailscale.com/install.sh | sh

# Enable Tailscale SSH
sudo tailscale up --ssh

# Verify
tailscale status

# Install Tailscale
sudo pacman -S tailscale
sudo systemctl enable --now tailscaled

# Authenticate and enable SSH
sudo tailscale up --ssh

# Verify
tailscale status

# Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh
sudo systemctl enable --now tailscaled

# Enable Tailscale SSH
sudo tailscale up --ssh

# If using SELinux, you may need:
sudo setsebool -P tailscale_enabled 1

# Verify
tailscale status

# Install Tailscale
apk add tailscale
rc-update add tailscale
rc-service tailscale start

# Enable Tailscale SSH
tailscale up --ssh

# Verify
tailscale status