os-tailscale: tailscale logged out from opnsense after reboot even though key expiry is disabled

[StarryFire]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• The title contains the plugin to which this issue belongs

Describe the bug
I am using os-tailscale plugin to connect my opnsense instance to tailscale. I use it to access my homelab remotely.
This had been working fine for the past 2 months or so but today I found out that I was unable to access my homelab.
When I managed to get access to my box physically, I found out that tailscale had been logged out from opnsense....

To Reproduce
Steps to reproduce the behavior:
This happened randomly today...

Expected behavior
Tailscale should never log out when key expiry is disabled.

Screenshots
N/A

Relevant log files
N/A

Additional context
N/A

Environment
OPNsense v25.1.5_5

[CardcaptorRLH85]

I have my OPNsense box set up to reboot itself weekly at 6 on Monday mornings. I installed os-tailscale last week and ran into this issue after my first scheduled reboot this morning. I was forced to create a new API key and reassociate my device with my Tailnet.

[detectiveenters]

I'm also seeing this issue. If I create a new key, Tailscale works great until I reboot. Then it won't work again until I create another key.

[GromitD90]

Just experienced a similar issue today except in my case it had been 90 days since my last reboot. This corresponds to the maximum time an auth key is valid for. Key expiry was disabled but it would appear that this is being ignored

[LowLogic2]

+1 Also experiencing this issue.

[ripnetuk]

+1 for me also. Tailscale was working fine until I recently upgraded and rebooted (sorry, not sure which version I went from and whic one broke it as I wasnt paying attention, and only notticed a while later when I tried to connect to my tailnet from outside).

My symptoms were that it didnt auto-connect, and if I re-started the service, it connected, but the router showed as offline in my other tailnet "tailscale status" listings, and the status on OPNSense itself didnt reflect reality - some machines were randomly marked as offline.

[fichtner]

I made a comment here: https://forum.opnsense.org/index.php?topic=47376.msg240322#msg240322

I can't really pin down where this issue suddenly comes from.

[steffbp]

I and also +1 this.
A new key solved it for me - until a reboot I guess.

[pjgoodall]

I believe this has been fixed. make sure you are on the latest release of OPNsense, and make sure you have the latest version og the Tailscale plugin installed. Check the authorities, but in may be worth a clean reinstall of the plugin. All working beautifully for me now. I authorized taislcale using the cli and the --qr parameter. so i suppose that is a work-around thats working. the auth-key may be fine. i beleive the prolem was that the auth state was held in a transient directory

[CardcaptorRLH85]

In version 25.1.9_2 of OPNsense, I can confirm that the problem appears to have been fixed.

[ripnetuk]

Im not seeing it fixed. Im on the latest (OPNsense 25.1.9_2-amd64) and the latest Tailscale plugin.

Yesterday I uninstalled the tailscale plugin, removed all the logs (from /var/run/tailscale and somewhere else).

Reinstalled the plugin, and manually started tailscaled from the shell (as someone said to do the login manually using the link).

In the console, did a tailscale login, and followed the link, and it was all working.

But on reboot, its still not starting, and im getting a bunch of errors about API key not existing.

It seems that OPNSense has retained the API key, and used that instead of the manual login, so I suspect after another 180 days ill be back where I started.

This is just a regular tailscale, advertising my local LAN routes.

For now, im just running tailscale inside my Kube control node, and using that as the gateway, as I did before I switched to Opnsense.

[GromitD90]

Is it possible that this is a bug in the tailscaled and not in the tailscale plugin? As I stated above I have not restarted my opnsense router since I initially installed the tailscale plugin in mid March. At that time the available version of tailscale was 1.80.3.
Without performing any opnsense updates my tailscale console shows the current running version of tailscale on my opnsesne router is 1.84.2.
This means that the tailscaled is updated in the background without any need for an opsense update.
Perhaps this bug was introduced in one of the tailscaled updates between version 1.80.3 and 1.84.2?

[andreapx]

No news about this problem?

[sopex]

No news about this problem?

Does this still occur with 100% repeatability? After each restart, you lose connection?

[sopex]

Cannot be replicated by me at 25.7.1_1.

Any chances the Ephemeral option is enabled on tailscale?