TailscaleActions

Configure a GitHub Actions runner as a Tailscale exit node. The workflow creates a temporary machine in your tailnet, advertises the runner as an exit node and keeps it active during the job.

Quick Start & Information

Caution

Running this action on a GitHub-hosted runner may violate GitHub's Acceptable Use Policies or other service terms. The workflow uses GitHub infrastructure as a VPN or proxy, forwards traffic for other devices and keeps the hosted runner active for several hours. GitHub may stop the job, restrict the repository or suspend the account. Review the current GitHub Actions Terms and Acceptable Use Policies before using it.

Note

tailscale/github-action@v4 still accepts authkey, but Tailscale recommends OAuth clients (oauth-client-id, oauth-secret and tags) for new setups.

1. Create an Auth Key with permissions for tag:exitnode

1. Open the Tailscale admin console.
2. Click Generate auth key.
3. Configure these options:
   • Enable Reusable so the key can be reused on every run.
   • Enable Ephemeral so the device disappears after use.
   • Add tag:exitnode under Tags.
4. Copy the Auth Key and save it as a GitHub secret:
   • Open the repository on GitHub.
   • Go to Settings → Secrets and variables → Actions.
   • Click New repository secret.
   • Use TAILSCALE_AUTHKEY as the name.
   • Paste the Auth Key as the value.

2. Configure Tailscale ACLs to auto-approve the exit node

1. Open the Tailscale admin console.
2. Click Edit policy.
3. Add these entries to the ACL policy. Keep the rest of your tailnet rules:

{
  "tagOwners": {
    "tag:exitnode": ["autogroup:admin"]
  },

  "autoApprovers": {
    "exitNode": ["tag:exitnode"]
  }
}

The tagOwners entry lets administrators assign tag:exitnode. The autoApprovers entry automatically approves tagged devices as exit nodes.

3. Start the exit node

1. Open the repository's Actions tab.
2. Select Tailscale exit node and run the workflow.
3. Select the exit node in Tailscale from the device that should route traffic through it.

The workflow keeps the runner active for approximately six hours. The ephemeral runner becomes unavailable when the job ends.

---