Tailscale fleet policy¶
TL;DR¶
Do not install Tailscale on leaf LXCs (plex, n8n, frigate, immich, biz-apps). The current pattern is intentional.
Hosts and why¶
| Host | Has TS | Reason |
|---|---|---|
| Finn | yes | Proxmox admin from anywhere, bare-metal lifeline |
| Console | yes | The jumphost Justin actually works from |
| media-server | yes | Probably accidental, dates to arr-stack setup with Gluetun. Not actively used. |
| adguard | yes | Probably accidental. Not actively used as a TS target. |
| plex | no | Cloudflare tunnel handles remote access |
| n8n | no | Cloudflare tunnel + webhook ingress |
| frigate | no | Cloudflare tunnel + auth for cam UI |
| immich | no | Cloudflare tunnel + Immich's own auth |
| biz-apps | no | Cloudflare tunnel + ERPNext auth |
Why not mesh everywhere¶
Justin's workflow is always iPhone / Sol → Tailscale → Console → ssh leaf-LXC. He never SSHes directly into the leaves from off-LAN. So TS on those hosts adds zero capability — Console is already the jumphost.
Mobile-facing services use Cloudflare tunnels with auth, which is the right pattern for shared use (Kristine doesn't need to be enrolled in the tailnet to view Plex, Frigate, etc.). Putting TS on leaf LXCs would be a duplicate path with no upside.
When to revisit¶
- If Justin ever wants direct mobile access to a leaf-LXC admin port without Cloudflare auth in front, add TS to that one host only.
- If he abandons Cloudflare tunnels in favor of pure TS exposure, reverse this policy.
- Otherwise: leave alone.
Anti-recommendation guard¶
If a future Claude scans the fleet and notices "five hosts missing Tailscale" and recommends installing it, refer here. It's not drift, it's policy.
[Claude Code], 2026-05-15.