claudetools/session-logs/2026-07/2026-07-05-howard-tailscale-stale-node.md

User

• User: Howard Enos (howard)
• Machine: ACG-TECH03L
• Role: tech

Session Summary

Howard flagged that the old install of his machine still appeared in the Tailscale tailnet as acg-tech03l (offline, last seen 2h ago) and suggested removing the stale node to avoid a duplicate.

Before taking any action against the tailnet, verified the facts. Read .claude/identity.json (machine = ACG-TECH03L) and ran tailscale status / tailscale status --json. Confirmed the current live node registers as acg-tech03l-1 (100.113.43.66, online, howard@) — Tailscale appended the -1 suffix when this install re-registered — while the old acg-tech03l (100.113.45.7, offline 2h, howard@) is the orphaned prior registration of the same physical machine. Both nodes are howard-owned, so the offline one is a safe delete.

Checked the vault for a Tailscale admin API token to script the deletion. The only tailscale reference is inside infrastructure/pfsense-firewall.sops.yaml (a node auth key, not an admin API token); no tailscale/ subdir, no tskey/api.tailscale entries. The tailscale CLI cannot delete tailnet nodes (admin API / console only). Concluded that minting an API token for a single one-off cleanup was not worth it, and handed Howard the exact node identity plus the admin-console removal steps — matching his original suggestion.

Also offered an optional follow-up: after deleting the stale node, run tailscale up --reset --hostname acg-tech03l to reclaim the clean base hostname (drop the -1 suffix). Left that pending Howard's confirmation.

Key Decisions

• Verified machine identity and tailnet node ownership BEFORE any delete — a tailnet node delete is outward-facing/hard-to-reverse, and deleting the wrong (live -1) node would drop this machine off the tailnet.
• Did not mint a Tailscale admin API token for a one-off cleanup; pointed Howard to the admin console (his suggested path) instead. No admin token exists in the vault to script it.
• Recommended matching the stale node by IP (100.113.45.7 / "offline, 2h ago"), not by name, since acg-tech03l and acg-tech03l-1 differ only by suffix and are easy to confuse.

Problems Encountered

• No Tailscale admin API credential in the vault, so programmatic deletion was not possible. Resolved by handing off the console removal steps with the precise device identity.

Configuration Changes

• None. No files modified. (Session log added by /save.)

Credentials & Secrets

• None created or discovered. Confirmed no Tailscale admin API token is vaulted; the only tailscale reference is a node auth key inside infrastructure/pfsense-firewall.sops.yaml.

Infrastructure & Servers

Tailnet: tailea2889.ts.net

Node	Tailscale IP	Status	Device ID	Action
acg-tech03l-1	100.113.43.66 / fd7a:115c:a1e0::dc38:2b43	online (current machine)	nhePgky8rB11CNTRL	KEEP
acg-tech03l	100.113.45.7 / fd7a:115c:a1e0::8e38:2d07	offline, last seen 2h ago	na9RzMbRmg11CNTRL	REMOVE (stale duplicate)

Both owned by howard@; same physical machine (ACG-TECH03L, Windows arm64).

Commands & Outputs

• command -v tailscale -> /c/Program Files/Tailscale/tailscale
• tailscale status — showed both acg-tech03l-1 (online) and acg-tech03l (offline, 2h).
• tailscale status --json — extracted device IDs (see table above).
• bash .claude/scripts/vault.sh search tailscale -> only infrastructure/pfsense-firewall.sops.yaml: tailscale:
• bash .claude/scripts/vault.sh list tailscale -> find: '/c/vault/tailscale': No such file or directory
• vault.sh search "tailscale api" | "api.tailscale" | "tskey" -> no matches.

Pending / Incomplete Tasks

• Howard to delete stale node acg-tech03l (100.113.45.7, device na9RzMbRmg11CNTRL) from the admin console: https://login.tailscale.com/admin/machines -> match by IP -> ... -> Delete.
• OPTIONAL, pending Howard's go-ahead: after the delete, run tailscale up --reset --hostname acg-tech03l on this machine to reclaim the base hostname and drop the -1 suffix. Claude offered to run this step once the old node is gone.

Reference Information

• Tailscale admin machines page: https://login.tailscale.com/admin/machines
• Tailnet: tailea2889.ts.net
• Stale node device ID: na9RzMbRmg11CNTRL | Live node device ID: nhePgky8rB11CNTRL
• Tailscale device delete API (if a token is ever vaulted): DELETE https://api.tailscale.com/api/v2/device/{deviceID} (Bearer token)