mirror of https://github.com/magnus919/agent-skills.git synced 2026-09-11 19:47:12 +03:00

Files

T

Magnus Hedemarkandfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> 0a7c6b9a1f fix(skills): rework moved-skill descriptions to pass quality gate

Rework the description frontmatter of 4 moved skills (tailscale, and
workflow-architect sub-skills bundle-builder, interviewer, observer) so each
starts with a recognized imperative verb, and add "## When not to use" body
sections to all 13 moved skills surfaced by the flatten move (research-and-vault,
tailscale + its 7 sub-skills, workflow-architect + its 3 sub-skills) so every
one defines a negative boundary. Trigger vocabulary is preserved and every
description stays under 1024 chars. Regenerate llms.txt and
.claude-plugin/marketplace.json, which embed the tailscale description.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

2026-08-14 16:13:32 -04:00

4.8 KiB

Raw Blame History

name, description, license, compatibility, metadata

name

description

license

compatibility

metadata

tailscale

Deploy and manage the self-hosted Tailscale/Headscale ecosystem: a Headscale control server, tailscale clients, ACL policies, node lifecycle, subnet routing, DERP relays, and backup/migration. Use when the user mentions Tailscale, Headscale, tailnet, mesh VPN, WireGuard mesh, or self-hosted VPN infrastructure.

MIT

Requires bash, Python 3.8+, jq, curl, and access to a Headscale server or the `headscale` CLI. Tailscale client (`tailscale`) must be installed on target machines.

tags	spec-version
tailscale, headscale, vpn, wireguard, mesh, networking, homelab	1.0

Tailscale + Headscale Skill Bundle

This umbrella skill covers the self-hosted Tailscale ecosystem using Headscale as the open-source control server. It provides 7 sub-skills that are auto-loaded by context.

Auto-Loading by Context

When the user's message matches a trigger keyword, the corresponding sub-skill's SKILL.md is loaded. Multiple sub-skills can load together when triggers overlap.

Trigger Keywords	Sub-Skill(s) Loaded
"deploy headscale", "install headscale", "setup headscale server", "headscale config"	`headscale-deploy`
"ACL", "policy file", "tailnet policy", "access control", "grant", "tag owners"	`tailnet-policy`
"install tailscale", "connect to headscale", "tailscale client", "tailscale up", "tailscale status", "diagnose tailscale", "connectivity"	`tailscale-client`
"auth key", "preauthkey", "register node", "approve node", "tag node", "node list", "decommission node"	`headscale-node-lifecycle`
"subnet router", "exit node", "advertise route", "approve route"	`headscale-routing`
"DERP", "relay", "peer relay", "STUN"	`headscale-derp`
"backup headscale", "restore headscale", "migrate headscale", "headscale backup"	`headscale-backup`
"Tailscale", "Headscale", "tailnet", "mesh VPN", "WireGuard mesh", "self-hosted VPN"	Loads this umbrella SKILL.md for navigation

Sub-Skill Ordering & Dependencies

headscale-deploy ─────┬──> tailnet-policy ───> headscale-routing
                       │
                       ├──> headscale-node-lifecycle
                       │
                       ├──> tailscale-client
                       │
                       ├──> headscale-derp
                       │
                       └──> headscale-backup (prerequisite: a running headscale instance)

headscale-deploy must be completed first — the others require a running Headscale server
tailnet-policy (configures ACLs) is recommended before opening the tailnet to other users
headscale-derp is optional but recommended for reliability across NATs
headscale-backup should be run regularly on any production deployment

Root Scripts (Shared Utilities)

These live in scripts/ at the bundle root and are available to all sub-skills:

scripts/headscale-health-check.sh — Probe Headscale server version, node count, DB integrity
scripts/headscale-backup.sh — Full backup (sqlite + config + policy + certs)
scripts/headscale-restore.sh — Restore from backup archive
scripts/tailscale-status-json.sh — Structured tailscale status --json wrapper
scripts/test-all.sh — Smoke test across all sub-skills

Templates

Templates live in templates/ and cover common deployment patterns:

templates/docker-compose-headscale.yaml — Headscale + embedded DERP + Traefik TLS
templates/headscale-config.yaml — Annotated full headscale configuration
templates/policy-allow-all.json — Minimal allow-all policy
templates/policy-deny-all.json — Locked-down deny-all policy
templates/policy-tagged-segmented.json — Tag-based access model
templates/derp-map.json — Custom DERP relay map

Environment Variables

Variable	Used By	Purpose
`HEADSCALE_URL`	All	Headscale server URL (e.g. `https://headscale.example.com`)
`HEADSCALE_API_KEY`	All	Headscale API key (created via `headscale apikeys create`)
`TAILSCALE_AUTHKEY`	tailscale-client	Pre-authenticated key for non-interactive client setup

Use the CLI tools

All scripts use --json, --dry-run, and have informative --help output. Scripts relative to bundle root: scripts/<tool> or skills/<sub-skill>/scripts/<tool>.

See the individual sub-skill SKILL.md for detailed usage.

When not to use

Do not load this umbrella when a task maps to a single sub-skill — load the matching sub-skill directly (e.g. headscale-deploy, tailnet-policy, tailscale-client). It assumes a self-hosted Headscale control server; for Tailscale's hosted SaaS control plane, or for non-Tailscale VPN tooling, use the appropriate network skill instead.

4.8 KiB Raw Blame History