tailscale-network

name	tailscale-network
description	Map of the Tailscale network (tailnet) and how to reach, operate, and deploy to remote machines over it via SSH. Use for any cross-machine task — remote install, deploy, restart, log-check, or file transfer.
metadata	{"openclaw":"{\"emoji\":\"🕸️\",\"os\":[\"darwin\",\"linux\"],\"requires\":{\"bins\":[\"ssh\"]}}"}

Tailscale Network Skill

When to use this skill

• Use when a task involves another machine on the tailnet (deploy, install, restart, fetch logs, copy files).
• Use when the user names a machine (Mac Mini M4/M2/M1, Raspberry Pi, VPS/OVH) or says "remote", "over tailscale", or "on the other Mac".

When not to use this skill

• Do not use for work that runs entirely on the local machine.
• Do not use for Tailscale account/ACL administration (that happens in the Tailscale admin console, not here).

Network map (verified 2026-07-05)

MagicDNS hostnames resolve on any tailnet member; prefer hostnames over IPs.

Hostname	Tailscale IP	OS / Arch	SSH user	Role / notes
scrims-macbook-air-m4	100.98.195.126	macOS arm64	(local)	Primary dev machine; nano-core dev checkout at ~/nano-core
scrims-mac-mini-m4	100.125.217.4	macOS 26.x arm64, 16 GB / 10 cores	scrimwiggins ✅ key auth	Deployment/test target for nano-core at ~/nano-core. No Homebrew/Docker; Node lives in ~/opt/node (see below)
scrims-mac-mini-m2	100.72.41.118	macOS arm64	scrimwiggins ✅ key auth	Secondary Mac; hostname reports scrim-M2.local
scrims-mac-mini-m1	100.72.126.90	macOS	❌ no key auth yet	Reachable (ping) but SSH key not installed
raspberrypi	100.70.70.121	Linux (Pi)	❌ no key auth yet	Reachable; tried pi/ubuntu/root/debian without key auth
vps-29b48fe5	100.107.107.56	Linux	❌ no key auth yet	OVH VPS; second OVH box not currently joined/online
wendys-mac-mini-intel	100.69.76.58	macOS x86_64	—	Offline (months)
iPhones/iPads/Android	various	iOS/Android	—	Not SSH targets

Key auth uses ~/.ssh/id_ed25519 from the MacBook Air. To grant access to a ❌ machine: ssh-copy-id <user>@<host> (needs one-time password), then update this table.

How to work with remote machines

Always use non-interactive, timeout-guarded SSH so a dead host can't hang a run:

ssh -o BatchMode=yes -o ConnectTimeout=5 scrimwiggins@scrims-mac-mini-m4 '<command>'

• Check liveness first when a host may be asleep: tailscale ping -c 2 <hostname> (CLI at /opt/homebrew/bin/tailscale on the MacBook; on machines with only Tailscale.app use /Applications/Tailscale.app/Contents/MacOS/Tailscale).
• Copy files with rsync over ssh: rsync -az --exclude node_modules --exclude .git --exclude data <src>/ scrimwiggins@scrims-mac-mini-m4:<dst>/
• Non-login shells don't load PATH extras. On the M4, Node is at ~/opt/node/bin; prefix remote commands: export PATH=$HOME/opt/node/bin:$PATH; ...
• Long-running remote processes: nohup ... > log 2>&1 & or a launchd plist; a plain ssh command dies with the connection.
• If a MagicDNS name fails to resolve, fall back to the Tailscale IP from the table.
• Refresh the map anytime with tailscale status.

nano-core deployment on scrims-mac-mini-m4 (live since 2026-07-05)

• Checkout: ~/nano-core; secrets in ~/nano-core/.env (never committed). Telegram bot: @fft_intel2_bot; WhatsApp disabled (WHATSAPP_ENABLED=0).
• Node: ~/opt/node (arm64 tarball, no sudo/Homebrew); PATH added in ~/.zprofile, but non-login SSH commands still need export PATH=$HOME/opt/node/bin:$PATH.
• Runtime mode: host runtime (no Docker on the box) — CONTAINER_RUNTIME=host + NANO_CORE_ALLOW_HOST_RUNTIME=1 in .env.
• The host runs as a launchd LaunchAgent (com.nano-core, installed 2026-07-06 via ./scripts/service.sh install; auto-restart + run-at-boot). Manage it with:

  ssh scrimwiggins@scrims-mac-mini-m4 'cd nano-core && ./scripts/service.sh restart|status|logs'
  

  Logs: ~/nano-core/logs/nano-core.log (+ .error.log). Telegram /gateway status|restart|doctor works against this service.
• The M4 has TWO node installs (~/opt/node and Homebrew's). The host and its subprocesses must use ~/opt/node — host code pins spawned npm/pi to its own node (fix 2026-07-06); keep that in mind for any new spawn sites.
• TUI (:29989) and Control Center web UI (:29990) bind localhost only on the M4. Reach them from any tailnet machine via SSH tunnel:

  ssh -N -L 29990:localhost:29990 -L 29989:localhost:29989 scrimwiggins@scrims-mac-mini-m4
  # then open http://localhost:29990
  

• Redeploy flow (since 2026-07-06 the M4 checkout is a real git clone of https://github.com/0-CYBERDYNE-SYSTEMS-0/nano-core.git, branch feat/agent-e2e-hardening, HTTPS remote — no GitHub SSH key on the M4):
  1. Commit + push from the dev MacBook, then on the M4: git pull --ff-only
  2. remote: npm install && npm run build && npm --prefix container/agent-runner install && npm --prefix container/agent-runner run build && npm run web:install && npm run web:build
  3. npm run doctor and npm test, then ./scripts/service.sh restart
  • Live state (.env, store/, data/, groups/, SOUL.md/HEARTBEAT.md/MEMORY.md, memory/, knowledge/) is gitignored or untracked and survives pulls — but groups/global/MEMORY.md + SOUL.md ARE tracked templates: never git checkout -f/reset --hard over them without backing up the live copies first. Pre-git safety snapshot: ~/nano-core-pregit-backup-20260706-0116.tar.gz on the M4.
  • Legacy rsync flow (only if git is unusable): rsync with --exclude for .env store node_modules .git data groups logs dist SOUL.md HEARTBEAT.md MEMORY.md memory knowledge '*.log' — .env holds the M4's own tokens and store/ is the live SQLite DB (syncing over it wipes chats/tasks; broke TUI runs 2026-07-06).
• Single-instance rule: only ONE host process per Telegram bot token across the whole tailnet, or Telegram getUpdates conflicts. Stop the other instance (or use a separate test bot token) before starting a second.
• Per-group agent logs: ~/nano-core/groups/<group>/logs/ on the machine running the host.

LLM providers on the M4 (verified 2026-07-05)

Keys live in the M4 .env; switch via Telegram /setup (writes PI_API/PI_MODEL).

Preset (PI_API)	Key env var	Status	Models (pi 0.73.1 registry)
minimax (default)	MINIMAX_API_KEY	✅ inference verified (MiniMax-M2.7, default since 2026-07-06; M2.1 removed from registry)	MiniMax-M2.7, M2.7-highspeed
openrouter	OPENROUTER_API_KEY	✅ inference verified	many, incl. free nvidia/nemotron-3-super-120b-a12b:free
google	GEMINI_API_KEY	✅ inference verified	gemini families
opencode	OPENCODE_API_KEY	✅ inference verified (free: big-pickle, deepseek-v4-flash-free)	claude/gpt/gemini/glm/minimax/kimi families
openai → StepFun	OPENAI_API_KEY + OPENAI_BASE_URL=https://api.stepfun.ai/v1	❌ quota exceeded; commented in .env until topped up	step-3.7-flash, step-3.5-flash
kimi-coding	KIMI_API_KEY	❌ HTTP 402 — membership expired; key installed for when renewed	k2p5, kimi-k2-thinking
zai	ZAI_API_KEY	❌ HTTP 429 — balance empty; key installed for when recharged	glm-4.5…glm-4.7

• pi upgraded to 0.73.1 on 2026-07-06 (glm-5.x, current opencode ids now addressable; model search is case-insensitive). Upstream is renaming the package to @earendil-works/pi-coding-agent — switch names on the next bump. pi-ai now uses typebox v1 (typebox pkg); never mix it with @sinclair/typebox schemas in one Type.Object.
• Provider keys must be in the passthrough allowlist in src/container-runner.ts (KIMI/MINIMAX/OPENCODE added 2026-07-05) or the agent never sees them.