菜单
Manage the full lifecycle of nodes in a Headscale tailnet — generate pre-authenticated keys, register, approve, tag, list, and decommission nodes. Use when adding new devices, generating auth keys for automation, or managing node inventory.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/magnus919/agent-skills --skill headscale-node-lifecycle命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Implement and deliver an authorized change end to end — verify, open the PR, merge, and confirm post-merge state — using live-state gates, durable interruption handoffs, and live-state-first resumption. Use when a user grants end-to-end delivery authority for a specific change and the work may cross tool-call limits, context exhaustion, worker loss, or session interruptions before the delivery boundary is reached. Do not use for plain fixes with no delivery directive, for granting merge or post-merge authority the user did not grant, or for designing release pipelines (use release-engineering for that).
Operate Transistor.fm podcast hosting from the terminal: verify API access, browse shows and episodes with JSON:API-aware output, run the episode publish lifecycle (create draft, attach audio, publish or schedule via the dedicated publish endpoint), pull download analytics, and manage private podcast subscribers and webhooks. Use when the user mentions Transistor, Transistor.fm, podcast hosting, episode publishing, private podcast subscribers, or podcast download analytics. Do not use this skill for other podcast hosts (Buzzsprout, Libsyn, Megaphone, Spotify for Creators), for editing or producing audio, or for feed/RSS parsing — the bundled CLI manages a Transistor account through its v1 API and cannot create new shows (dashboard-only).
Query hyper-local weather from a WeatherFlow Tempest station over its REST API and the hub's local UDP broadcast: current conditions, forecast, historical observations, and real-time decoded datagrams (obs_st, rapid_wind, evt_precip, evt_strike, hub_status). Use when the user asks about weather, temperature, rain, wind, humidity, or forecast data from their own Tempest/WeatherFlow station, or wants to parse the hub's UDP port 50222 broadcast. Do not use this skill for generic or city forecasts without a Tempest station (public weather services serve those), for Shakespeare's play The Tempest or other literature questions, or for weather hardware from other vendors - the REST endpoints require a personal-use token and the UDP broadcast only exists on a Tempest hub's LAN.
| name | headscale-node-lifecycle |
| description | Manage the full lifecycle of nodes in a Headscale tailnet — generate pre-authenticated keys, register, approve, tag, list, and decommission nodes. Use when adding new devices, generating auth keys for automation, or managing node inventory. |
| metadata | {"category":"devops"} |
Headscale manages nodes in a tailnet with two identity models:
yourname@domain). The node key is tied to that user's identity.tagged-devices user (created automatically by Headscale). These nodes are identified by one or more tags (e.g. tag:webserver, tag:monitoring) and are typically used for infrastructure service nodes.Registration happens through:
headscale commands or REST API callsAuth keys streamline automated node registration. Key attributes:
| Parameter | Description |
|---|---|
| Expiration | Default: 1 hour. Use 0 for no expiry (not recommended). |
| Reusable | Single-use by default. Mark reusable for fleet provisioning. |
| Ephemeral | Ephemeral nodes are removed from the tailnet when they disconnect. Perfect for CI runners and ephemeral workloads. |
| Tags | Assign tags to create a tagged node automatically. |
tailscale up --auth-key=<key> on the device → approve in Headscale if registration is open.--tags → run tailscale up --auth-key=<key> → the node is auto-approved and tagged.List nodes filtered by user, tag, or online status. Output includes:
Tags can be added or replaced on existing nodes. Tags always carry the tag: prefix in Headscale. When adding tags, existing tags are preserved unless --replace is specified.
To decommission a node permanently:
headscale nodes delete -i <node-id>
Or via the REST API: DELETE /api/v1/node/<node-id>
Decommissioning is irreversible. For ephemeral nodes, disconnection alone is sufficient — the server removes them automatically.
| Variable | Description |
|---|---|
HEADSCALE_URL | Base URL of the Headscale server (e.g. https://headscale.example.com) |
HEADSCALE_API_KEY | API key from headscale apikeys create |
Both env vars are required for API-based operations when the headscale CLI is not available on PATH.
tagged-devices user. Do not try to assign them to a personal user.Connected: true) to test connectivity. Offline nodes do not respond to ping/ICMP within the tailnet.--ephemeral means the node is fully removed on disconnection — there is no record of it in the tailnet afterward.Create pre-authenticated keys via Headscale CLI or REST API.
hs-create-authkey.sh --user <user> --tags <tag> --expiration <duration> --reusable --ephemeral [--json] [--dry-run]
List all nodes in the tailnet with status and metadata.
hs-list-nodes.sh [--json] [--user <user>] [--tag <tag>] [--online-only]
Approve pending node registrations.
hs-approve-nodes.sh [--all] [--auth-id <id>] [--dry-run] [--json]
Update tags on an existing node.
hs-tag-node.sh --node <id/name> --tags <tag1,tag2> [--replace | --add] [--dry-run] [--json]
Do not use this skill for installing or configuring the Tailscale client (load tailscale-client instead) or for ACL/policy authoring (load tailnet-policy). It covers node registration, tagging, listing, and decommissioning only.