$ whoami

• Principal/Technologist at a top-5 software company — ex-SRE & SRE manager. Enterprise infra by day.
• Homelab addict by night — Proxmox, way too many containers.
• Tailscale Insider + LA Tailscale meetup organizer.
• Builder of chat-tails, tailscale-tui, an unofficial Obsidian plugin, and a tailnet Prometheus exporter.
• Currently building a Personal AI Infrastructure — and it all rides the tailnet.

My tailnet, by the numbers

This talk is the story of how it got this way — on purpose.

Every service
is a node

The homelab pattern that changed everything: stop thinking "servers with ports" — start thinking "services with identities."

The homelab, tailnet edition

$ tailscale status | head -6
100.x.x.x   forgejo        linux  -
100.x.x.x   immich         linux  -
100.x.x.x   jellyfin       linux  -
100.x.x.x   homeassistant  linux  exit node
100.x.x.x   nas            linux  -
100.x.x.x   copyparty      linux  -

The zombie sidecar incident

• Tailscale sidecars on my IoT station silently held a stale network namespace after a Docker restart
• Nodes looked healthy in the admin console… but routed nothing
• Lesson 1: monitor from inside the tailnet, not just the console
• Lesson 2: sidecar containers need lifecycle coupling to the thing they front
• Lesson 3: when in doubt — tailscale status --json is the source of truth
• Where I landed: migrating to DockTail — label-driven, one watcher exposes containers as Tailscale Services. No sidecar per service, no namespace to go stale.

chat-tails github.com/bscott/chat-tails

A chat server your friends join with netcat. No accounts. No client. No TLS certs to babysit. The tailnet is the auth layer.

tsnet: your Go binary is now a tailnet citizen

// ~40 lines to join the network
srv := &tsnet.Server{
    Hostname: "mychat",
}
ln, _ := srv.Listen("tcp", ":2323")

// who's connecting? tailscale knows
who, _ := srv.WhoIs(ctx, addr)
name := who.UserProfile.DisplayName

# everyone on the tailnet:
$ nc mychat.tailnet.ts.net 2323

Welcome to Chat Room!
[brian] anyone seen my iPad?
[ayanna] which one 💀

When the network handles identity, encryption, and reachability… your app is just the fun part.

— why every side project I write now embeds tsnet

My AI agents live
on the tailnet

The plot twist: the heaviest users of my tailnet aren't humans anymore.

Personal AI Infrastructure, tailnet-native

• Agents manage services, read dashboards, push code — over Tailscale, never the public internet
• Agent web UIs bound to the tailnet IP: usable from my phone, invisible to everyone else
• ACL tags = blast-radius control for autonomous software

Why Tailscale is the perfect agent substrate

The "personal AI" everyone is building needs a private nervous system. This is it.

Four layers. The tailnet is the load-bearing one.

Swap the model, swap the framework — the tailnet layer survives every rewrite. The model is rented; the network is ours.

Watching the watchers

$ curl -s :9250/metrics | grep tailscale
tailscale_device_online{name="forgejo"} 1
tailscale_conn_type{type="direct"} 41
tailscale_conn_type{type="derp"} 6
tailscale_key_expiry_days{name="dockerhost"} 12

My agent leaked my tailnet to nine people

• An autonomous agent drafted an outbound email… and helpfully enumerated real hostnames and internal topology
• CC'd to a 9-person group. Email is unretractable. 🔥
• The tailnet was never breached — the agent's mouth was the leak
• Fix: a hard opsec rule + an outbound hook that regex-blocks any mail containing tailnet names or IPs
• Lesson: agents on your tailnet add a new surface — egress of knowledge, not just packets. ACLs can't firewall a sentence.

If you remember three things

• 1. Make services nodes, not port-forwards — MagicDNS becomes your home's API
• 2. Embed tsnet — identity + encryption for free, your app stays tiny
• 3. Put your AI agents on the tailnet — full reach, zero public surface… and guard what they say, not just what they reach

Take it home

The network is no longer how I reach my computers.

The network is the computer.

Brian Scott · brianlscott.com · github.com/bscott
Come say hi — or nc into my chat room. 🐕