sync: auto-sync from ACG-TECH03L at 2026-07-05 23:45:36

Author: Howard Enos
Machine: ACG-TECH03L
Timestamp: 2026-07-05 23:45:36

session-logs/2026-07/2026-07-05-howard-tailscale-stale-node.md

@@ -0,0 +1,89 @@
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** ACG-TECH03L
+- **Role:** tech
+
+## Session Summary
+
+Howard flagged that the old install of his machine still appeared in the Tailscale tailnet as
+`acg-tech03l` (offline, last seen 2h ago) and suggested removing the stale node to avoid a
+duplicate.
+
+Before taking any action against the tailnet, verified the facts. Read `.claude/identity.json`
+(machine = `ACG-TECH03L`) and ran `tailscale status` / `tailscale status --json`. Confirmed the
+current live node registers as `acg-tech03l-1` (100.113.43.66, online, howard@) — Tailscale
+appended the `-1` suffix when this install re-registered — while the old `acg-tech03l`
+(100.113.45.7, offline 2h, howard@) is the orphaned prior registration of the same physical
+machine. Both nodes are howard-owned, so the offline one is a safe delete.
+
+Checked the vault for a Tailscale admin API token to script the deletion. The only `tailscale`
+reference is inside `infrastructure/pfsense-firewall.sops.yaml` (a node auth key, not an admin
+API token); no `tailscale/` subdir, no `tskey`/`api.tailscale` entries. The `tailscale` CLI
+cannot delete tailnet nodes (admin API / console only). Concluded that minting an API token for a
+single one-off cleanup was not worth it, and handed Howard the exact node identity plus the
+admin-console removal steps — matching his original suggestion.
+
+Also offered an optional follow-up: after deleting the stale node, run
+`tailscale up --reset --hostname acg-tech03l` to reclaim the clean base hostname (drop the `-1`
+suffix). Left that pending Howard's confirmation.
+
+## Key Decisions
+
+- Verified machine identity and tailnet node ownership BEFORE any delete — a tailnet node delete
+  is outward-facing/hard-to-reverse, and deleting the wrong (live `-1`) node would drop this
+  machine off the tailnet.
+- Did not mint a Tailscale admin API token for a one-off cleanup; pointed Howard to the admin
+  console (his suggested path) instead. No admin token exists in the vault to script it.
+- Recommended matching the stale node by IP (100.113.45.7 / "offline, 2h ago"), not by name,
+  since `acg-tech03l` and `acg-tech03l-1` differ only by suffix and are easy to confuse.
+
+## Problems Encountered
+
+- No Tailscale admin API credential in the vault, so programmatic deletion was not possible.
+  Resolved by handing off the console removal steps with the precise device identity.
+
+## Configuration Changes
+
+- None. No files modified. (Session log added by /save.)
+
+## Credentials & Secrets
+
+- None created or discovered. Confirmed no Tailscale admin API token is vaulted; the only
+  `tailscale` reference is a node auth key inside `infrastructure/pfsense-firewall.sops.yaml`.
+
+## Infrastructure & Servers
+
+Tailnet: `tailea2889.ts.net`
+
+| Node | Tailscale IP | Status | Device ID | Action |
+|------|-------------|--------|-----------|--------|
+| `acg-tech03l-1` | 100.113.43.66 / fd7a:115c:a1e0::dc38:2b43 | online (current machine) | `nhePgky8rB11CNTRL` | KEEP |
+| `acg-tech03l` | 100.113.45.7 / fd7a:115c:a1e0::8e38:2d07 | offline, last seen 2h ago | `na9RzMbRmg11CNTRL` | REMOVE (stale duplicate) |
+
+Both owned by `howard@`; same physical machine (ACG-TECH03L, Windows arm64).
+
+## Commands & Outputs
+
+- `command -v tailscale` -> `/c/Program Files/Tailscale/tailscale`
+- `tailscale status` — showed both `acg-tech03l-1` (online) and `acg-tech03l` (offline, 2h).
+- `tailscale status --json` — extracted device IDs (see table above).
+- `bash .claude/scripts/vault.sh search tailscale` -> only
+  `infrastructure/pfsense-firewall.sops.yaml: tailscale:`
+- `bash .claude/scripts/vault.sh list tailscale` -> `find: '/c/vault/tailscale': No such file or directory`
+- `vault.sh search "tailscale api" | "api.tailscale" | "tskey"` -> no matches.
+
+## Pending / Incomplete Tasks
+
+- Howard to delete stale node `acg-tech03l` (100.113.45.7, device `na9RzMbRmg11CNTRL`) from the
+  admin console: https://login.tailscale.com/admin/machines -> match by IP -> `...` -> Delete.
+- OPTIONAL, pending Howard's go-ahead: after the delete, run
+  `tailscale up --reset --hostname acg-tech03l` on this machine to reclaim the base hostname and
+  drop the `-1` suffix. Claude offered to run this step once the old node is gone.
+
+## Reference Information
+
+- Tailscale admin machines page: https://login.tailscale.com/admin/machines
+- Tailnet: `tailea2889.ts.net`
+- Stale node device ID: `na9RzMbRmg11CNTRL` | Live node device ID: `nhePgky8rB11CNTRL`
+- Tailscale device delete API (if a token is ever vaulted):
+  `DELETE https://api.tailscale.com/api/v2/device/{deviceID}` (Bearer token)