From c289ba33705e2389c4a4af5533e08d232270c32f Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Sun, 5 Jul 2026 23:46:12 -0700 Subject: [PATCH] sync: auto-sync from ACG-TECH03L at 2026-07-05 23:45:36 Author: Howard Enos Machine: ACG-TECH03L Timestamp: 2026-07-05 23:45:36 --- errorlog.md | 2 + .../2026-07-05-howard-tailscale-stale-node.md | 89 +++++++++++++++++++ 2 files changed, 91 insertions(+) create mode 100644 session-logs/2026-07/2026-07-05-howard-tailscale-stale-node.md diff --git a/errorlog.md b/errorlog.md index d382b7f0..20878653 100644 --- a/errorlog.md +++ b/errorlog.md @@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure · +2026-07-06 | ACG-TECH03L | self-check/migrate-identity | [friction] migrate-identity.sh detected architecture=amd64 on a Windows-on-ARM (arm64) machine; had to patch identity.json manually. arch probe likely uses emulated uname [ctx: host=ACG-TECH03L arch=arm64] + 2026-07-06 | ACG-Tech03L | vault | vault_path not set in identity.json; vault read failed [ctx: path=/c/claudetools/.claude/identity.json] 2026-07-06 | ACG-Tech03L | vault | identity.json not found; vault read cannot resolve vault_path [ctx: path=/c/claudetools/.claude/identity.json] (x3) diff --git a/session-logs/2026-07/2026-07-05-howard-tailscale-stale-node.md b/session-logs/2026-07/2026-07-05-howard-tailscale-stale-node.md new file mode 100644 index 00000000..be6d563d --- /dev/null +++ b/session-logs/2026-07/2026-07-05-howard-tailscale-stale-node.md @@ -0,0 +1,89 @@ +## User +- **User:** Howard Enos (howard) +- **Machine:** ACG-TECH03L +- **Role:** tech + +## Session Summary + +Howard flagged that the old install of his machine still appeared in the Tailscale tailnet as +`acg-tech03l` (offline, last seen 2h ago) and suggested removing the stale node to avoid a +duplicate. + +Before taking any action against the tailnet, verified the facts. Read `.claude/identity.json` +(machine = `ACG-TECH03L`) and ran `tailscale status` / `tailscale status --json`. Confirmed the +current live node registers as `acg-tech03l-1` (100.113.43.66, online, howard@) — Tailscale +appended the `-1` suffix when this install re-registered — while the old `acg-tech03l` +(100.113.45.7, offline 2h, howard@) is the orphaned prior registration of the same physical +machine. Both nodes are howard-owned, so the offline one is a safe delete. + +Checked the vault for a Tailscale admin API token to script the deletion. The only `tailscale` +reference is inside `infrastructure/pfsense-firewall.sops.yaml` (a node auth key, not an admin +API token); no `tailscale/` subdir, no `tskey`/`api.tailscale` entries. The `tailscale` CLI +cannot delete tailnet nodes (admin API / console only). Concluded that minting an API token for a +single one-off cleanup was not worth it, and handed Howard the exact node identity plus the +admin-console removal steps — matching his original suggestion. + +Also offered an optional follow-up: after deleting the stale node, run +`tailscale up --reset --hostname acg-tech03l` to reclaim the clean base hostname (drop the `-1` +suffix). Left that pending Howard's confirmation. + +## Key Decisions + +- Verified machine identity and tailnet node ownership BEFORE any delete — a tailnet node delete + is outward-facing/hard-to-reverse, and deleting the wrong (live `-1`) node would drop this + machine off the tailnet. +- Did not mint a Tailscale admin API token for a one-off cleanup; pointed Howard to the admin + console (his suggested path) instead. No admin token exists in the vault to script it. +- Recommended matching the stale node by IP (100.113.45.7 / "offline, 2h ago"), not by name, + since `acg-tech03l` and `acg-tech03l-1` differ only by suffix and are easy to confuse. + +## Problems Encountered + +- No Tailscale admin API credential in the vault, so programmatic deletion was not possible. + Resolved by handing off the console removal steps with the precise device identity. + +## Configuration Changes + +- None. No files modified. (Session log added by /save.) + +## Credentials & Secrets + +- None created or discovered. Confirmed no Tailscale admin API token is vaulted; the only + `tailscale` reference is a node auth key inside `infrastructure/pfsense-firewall.sops.yaml`. + +## Infrastructure & Servers + +Tailnet: `tailea2889.ts.net` + +| Node | Tailscale IP | Status | Device ID | Action | +|------|-------------|--------|-----------|--------| +| `acg-tech03l-1` | 100.113.43.66 / fd7a:115c:a1e0::dc38:2b43 | online (current machine) | `nhePgky8rB11CNTRL` | KEEP | +| `acg-tech03l` | 100.113.45.7 / fd7a:115c:a1e0::8e38:2d07 | offline, last seen 2h ago | `na9RzMbRmg11CNTRL` | REMOVE (stale duplicate) | + +Both owned by `howard@`; same physical machine (ACG-TECH03L, Windows arm64). + +## Commands & Outputs + +- `command -v tailscale` -> `/c/Program Files/Tailscale/tailscale` +- `tailscale status` — showed both `acg-tech03l-1` (online) and `acg-tech03l` (offline, 2h). +- `tailscale status --json` — extracted device IDs (see table above). +- `bash .claude/scripts/vault.sh search tailscale` -> only + `infrastructure/pfsense-firewall.sops.yaml: tailscale:` +- `bash .claude/scripts/vault.sh list tailscale` -> `find: '/c/vault/tailscale': No such file or directory` +- `vault.sh search "tailscale api" | "api.tailscale" | "tskey"` -> no matches. + +## Pending / Incomplete Tasks + +- Howard to delete stale node `acg-tech03l` (100.113.45.7, device `na9RzMbRmg11CNTRL`) from the + admin console: https://login.tailscale.com/admin/machines -> match by IP -> `...` -> Delete. +- OPTIONAL, pending Howard's go-ahead: after the delete, run + `tailscale up --reset --hostname acg-tech03l` on this machine to reclaim the base hostname and + drop the `-1` suffix. Claude offered to run this step once the old node is gone. + +## Reference Information + +- Tailscale admin machines page: https://login.tailscale.com/admin/machines +- Tailnet: `tailea2889.ts.net` +- Stale node device ID: `na9RzMbRmg11CNTRL` | Live node device ID: `nhePgky8rB11CNTRL` +- Tailscale device delete API (if a token is ever vaulted): + `DELETE https://api.tailscale.com/api/v2/device/{deviceID}` (Bearer token)