Skip to main content

Tailscale and SSH

Tailscale​

Tailscale is the private network ("tailnet") that gates access to the development servers. Without it the dev database and the dev Django VM are unreachable: neither has a public endpoint for those services.

Getting on​

  1. Ask Troy or Matt for an invite to the tailnet (see Onboarding checklist).
  2. Install Tailscale (Workstation setup) and sign in.
  3. Check:
tailscale status

You should see the dev VMs listed. DB_HOST in the backend .env is the database VM's Tailscale IP.

What it gives you​

TargetOver Tailscale
development-database-vm PostgreSQL (behind pgbouncer)Yes. This is the only route from a laptop.
development-django-vm SSHYes (plus your SSH key)
Production VM or databaseNot yet. Production still uses an IP whitelist for SSH and Portainer; the database is vnet-only. Migrating prod to Tailscale is planned.

Docker and Tailscale on Windows​

Containers reach Tailscale addresses through the host. If the host can reach the database but the containers cannot, restart Docker Desktop after Tailscale is connected.

SSH​

  • Key-based only; password authentication is off on every VM.
  • Troy or Matt create your user and install your public key. Generate a key if you do not have one:
ssh-keygen -t ed25519 -C "<you>@everymanawarrior.com"
Get-Content ~\.ssh\id_ed25519.pub   # send this one
  • Dev VM: must be on the tailnet.
  • Prod DockerApp VM: your public IP must be allow-listed (Matt Birne), and you still need a key.

Typical dev session​

ssh <you>@<development-django-vm>
cd /opt/emaw/emaw-django-app
docker compose ps

The full take-over / hand-back procedure is in Backend local development.

warning

Do not change files under /opt/emaw/emaw-django-app on the VM except by git pull origin develop. The .env there is the shared dev configuration.

Connecting a SQL client to the dev database​

Use the DB_HOST, DB_PORT, DB_NAME and DB_USER from your .env in DBeaver, psql or similar, with Tailscale connected. The role cannot create databases (which is why tests use a local container). Remember the data is real: read, do not experiment.