From 502c090097edda4a8bc817ab79a0de33d197a328 Mon Sep 17 00:00:00 2001
From: Seth Etter <mail@sethetter.com>
Date: Sat, 12 Sep 2026 07:08:13 -0500
Subject: [PATCH] debian: install tailscale from its apt repo

---
 debian/README.md         |  5 ++++-
 debian/ansible/setup.yml | 10 +++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/debian/README.md b/debian/README.md
index 15152d8..1ff277d 100644
--- a/debian/README.md
+++ b/debian/README.md
@@ -29,7 +29,8 @@ ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
 ## What setup.yml does
 
 - apt packages: thunderbird, zsh, git, curl, gnupg, jq, xdg-utils
-- apt repos + install: Helium (`helium-bin`), 1Password (+ `op` CLI)
+- apt repos + install: Helium (`helium-bin`), 1Password (+ `op` CLI),
+  Tailscale
 - ghostty and obsidian: latest GitHub-release .debs
   ([mkasberg/ghostty-ubuntu](https://github.com/mkasberg/ghostty-ubuntu),
   [obsidianmd/obsidian-releases](https://github.com/obsidianmd/obsidian-releases))
@@ -53,6 +54,8 @@ ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
   Umans login (it prints a note); re-run setup afterwards.
 - The `op` key fetch triggers a 1Password approval prompt — approve it while
   setup runs.
+- Authenticate tailscale: `sudo tailscale up` (opens a browser login).
+  The service itself is enabled by the package.
 - If the Helium extensions don't auto-install, that's the upstream
   force-install bug — install them manually from the Chrome Web Store.
 
diff --git a/debian/ansible/setup.yml b/debian/ansible/setup.yml
index c821b28..19a2673 100644
--- a/debian/ansible/setup.yml
+++ b/debian/ansible/setup.yml
@@ -24,6 +24,13 @@
         components: main
         signed_by: /usr/share/keyrings/1password.gpg
         architectures: "{{ arch }}"
+      - name: tailscale
+        key: https://pkgs.tailscale.com/stable/debian/trixie.asc
+        types: deb
+        uris: https://pkgs.tailscale.com/stable/debian
+        suites: trixie
+        components: main
+        signed_by: /usr/share/keyrings/tailscale.gpg
     # Packages with no apt repo: pulled from recent GitHub releases. `latest`
     # is not reliable (some releases are mobile-only), so scan the last 10.
     github_debs:
@@ -85,12 +92,13 @@
       loop: "{{ apt_repos }}"
       become: true
 
-    - name: Install Helium and 1Password
+    - name: Install apps from apt repositories
       ansible.builtin.apt:
         name:
           - 1password
           - 1password-cli
           - helium-bin
+          - tailscale
         state: present
         update_cache: true
       become: true
-- 
2.51.2