A quick follow-up to today’s poor man’s QubeOS.

I am using the same approach to also make a Tailscale Lock signing node available from a backup encrypted using a YubiKey. Tailscale Lock requires new Tailscale nodes to be signed by an existing authorized signing node.

To be able to recover access to my tailnet without any usual trusted device, I:

  1. set up an empty NixOS VM in Baguette,
  2. configured tailscale,
  3. authorized it through an existing Tailscale signing device,
  4. promoted it to be itself a signing device,
  5. then backed up its state, encrypted the backup through a YubiKey, and uploaded it to a cloud drive.

From Tailscale’s console, I then disabled key expiration for the new device. Lastly, I destroyed the VM.

The device now sits disconnected in my Tailscale dashboard as tailnet-recovery, as a reminder of the recovery setup.