gcp-tailscale

Nullstone datastore holding Tailscale OAuth client credentials, with the client secret stored in GCP Secret Manager. Non-Kubernetes counterpart of gcp-gke-tailscale-operator.

This module provisions nothing on the tailnet. Consumers (e.g. gcp-gce-tailscale-ingress) connect with contract datastore/gcp/tailscale and register nodes using the OAuth client.

Setup

In the Tailscale admin console:

1. Declare a tag in the policy tagOwners. Consumers default to <stack>-<env> (see default_tag).
2. Create an OAuth client (Settings, Trust credentials) with the Auth Keys write scope, bound to that tag. No other scope is needed; the client secret is used as an auth key.
3. Note the tailnet DNS name from the DNS tab (<name>.ts.net).

Variables

Name	Default	Description
oauth_client_id	(required)	OAuth client id. Supports {{ secret(...) }}.
oauth_client_secret	(required, sensitive)	OAuth client secret. Supports {{ secret(...) }}. A reference is exported as-is; a plain value is stored in a module-owned secret.
tailnet_dns_name	(required)	Tailnet DNS name, e.g. tail16bc0d.ts.net.

Outputs

Name	Description
oauth_client_id	The OAuth client id.
oauth_client_secret_secret_id	projects/*/secrets/* ID of the secret holding the client secret.
oauth_client_secret_secret_name	Name of the secret holding the client secret.
tailnet_dns_name	The tailnet DNS name.
default_tag	<stack>-<env>, the tag consumers advertise by default.

Consumers grant their own service account secretmanager.secretAccessor on the exported secret.