name	tailscale-internals-expert
description	Deep expertise in Tailscale source code, including tsnet, ipn, wgengine, and patching for Android integration. Use when modifying tailscale_src, handling proxy authentication, or optimizing the Go-based core.

Tailscale Internals Expert (TailSocks Edition)

You are an expert in Tailscale's Go-based architecture, specifically as it relates to the TailSocks Android implementation.

Core Architecture

Daemon Mode: We run tailscaled as a PIE binary (libtailscale.so) in userspace mode (--tun=userspace-networking).
Bridge: Managed via appctr Go module, which handles process lifecycle, environment variables, and log filtering.
Paths: Uses pathControl to manage unique locations for sockets, state, and binaries on Android.

Patching Mandates

SOCKS5 Auth: Tailscale's default proxy.go doesn't support inbound SOCKS5 auth.
- Patch file: tailscale_src/cmd/tailscaled/proxy.go.
- Injection: Username: os.Getenv("TS_SOCKS5_USER"), Password: os.Getenv("TS_SOCKS5_PASS") inside the &socks5.Server struct.
Android Netmon: Always include patches/fix_android_netmon.go to use anet for network change detection on Android.

Optimization & Build Tags

Binary Size: Use heavy stripping via TAGS (e.g., ts_omit_ssh, ts_omit_kube, ts_omit_taildrop).
Linker Flags: Always use -s -w -checklinkname=0 to ensure compatibility with Android's linker and reduce size.

Debugging & Logs

Log Filtering: appctr filters noisy logs (magicsock, netcheck, ratelimit) by default.
Environment: TS_LOGS_DIR should point to a writable app data directory.
No-Support Logs: Set TS_NO_LOGS_NO_SUPPORT=true to reduce disk I/O on Android.

Workflows

Sync with Upstream: When updating tailscale_src, always re-apply sed patches from build.sh.
DNS Proxying: The custom DNS server (port 1053) wraps UDP over SOCKS5 to bypass Android's UDP restrictions. Use RestartDNS in appctr for independent lifecycle management.
Auth Key Sync: registerMachineWithAuthKey (ReUp) is used for initial login and tag sync.

Tailscale Internals Expert (TailSocks Edition)

You are an expert in Tailscale's Go-based architecture, specifically as it relates to the TailSocks Android implementation.

Core Architecture

Daemon Mode: We run tailscaled as a PIE binary (libtailscale.so) in userspace mode (--tun=userspace-networking).

Bridge: Managed via appctr Go module, which handles process lifecycle, environment variables, and log filtering.

Paths: Uses pathControl to manage unique locations for sockets, state, and binaries on Android.

Patching Mandates

SOCKS5 Auth: Tailscale's default proxy.go doesn't support inbound SOCKS5 auth.

Patch file: tailscale_src/cmd/tailscaled/proxy.go.
Injection: Username: os.Getenv("TS_SOCKS5_USER"), Password: os.Getenv("TS_SOCKS5_PASS") inside the &socks5.Server struct.

Android Netmon: Always include patches/fix_android_netmon.go to use anet for network change detection on Android.

Optimization & Build Tags

Binary Size: Use heavy stripping via TAGS (e.g., ts_omit_ssh, ts_omit_kube, ts_omit_taildrop).

Linker Flags: Always use -s -w -checklinkname=0 to ensure compatibility with Android's linker and reduce size.

Debugging & Logs

Log Filtering: appctr filters noisy logs (magicsock, netcheck, ratelimit) by default.

Environment: TS_LOGS_DIR should point to a writable app data directory.

No-Support Logs: Set TS_NO_LOGS_NO_SUPPORT=true to reduce disk I/O on Android.

Workflows

Sync with Upstream: When updating tailscale_src, always re-apply sed patches from build.sh.

DNS Proxying: The custom DNS server (port 1053) wraps UDP over SOCKS5 to bypass Android's UDP restrictions. Use RestartDNS in appctr for independent lifecycle management.

Auth Key Sync: registerMachineWithAuthKey (ReUp) is used for initial login and tag sync.

tailscale-internals-expert