Tailscale Terraform Provider

The tailscale_service resource allows you to publish internal resources (such as databases or web servers) as named resources within your tailnet. When you create a service, Tailscale provides a stable MagicDNS name and a Tailscale virtual IP address pair. These services can be served by multiple nodes and act as valid access control destinations in your ACLs.

resource "tailscale_service" "example" {
  name    = "svc:my-service"
  comment = "My service"
  ports   = ["tcp:443"]
  tags    = ["tag:web"]
}

If you are migrating a deployment that currently uses the original davidsbond/tailscale provider to the official tailscale/tailscale provider, run the following command to replace the provider in your Terraform state:

terraform state replace-provider registry.terraform.io/davidsbond/tailscale registry.terraform.io/tailscale/tailscale

The tailscale_device data source allows you to retrieve information about a specific device within a tailnet. You can look up a device using either its full name (e.g., hostname.domain.ts.net) or its short hostname.

If the device is not immediately available, you can use the wait_for argument to instruct the provider to retry the lookup every second until the specified duration is reached.

data "tailscale_device" "sample_device" {
  name     = "device1.example.ts.net"
  wait_for = "60s"
}

data "tailscale_device" "sample_device2" {
  hostname = "device2"
  wait_for = "60s"
}

You can import existing device subnet rules into your Terraform state. You can use either the preferred node_id or the legacy ID.

# Device subnet rules can be imported using the node ID (preferred), e.g.,
terraform import tailscale_device_subnet_routes.sample nodeidCNTRL

# Device subnet rules can be imported using the legacy ID, e.g.,
terraform import tailscale_device_subnet_routes.sample 123456789

You can import an existing Tailscale key into your Terraform state using its key ID.

# Import using the key id
terraform import tailscale_tailnet_key.sample_key 123456789

You can import existing Tailscale webhooks into your Terraform state using the endpoint ID via the terraform import command.

# Webhooks can be imported using the endpoint id, e.g.,
terraform import tailscale_webhook.sample_webhook 123456789

You can import an existing device key into your Terraform state using either the preferred node_id or the legacy ID.

Use the following syntax:

# Using the node ID (preferred)
terraform import tailscale_device_key.sample <node_id>

# Using the legacy ID
terraform import tailscale_device_key.sample <legacy_id>

# Device key can be imported using the node ID (preferred), e.g.,
terraform import tailscale_device_key.sample nodeidCNTRL
# Device key can be imported using the legacy ID, e.g.,
terraform import tailscale_device_key.sample 123456789

You can import existing device tag configurations into your Terraform state using the terraform import command. You can use either the preferred node_id or the legacy ID.

# Using the preferred node ID
terraform import tailscale_device_tags.sample nodeidCNTRL

# Using the legacy ID
terraform import tailscale_device_tags.sample 123456789

The tailscale_device_authorization resource is used to approve new devices before they can join your tailnet. This is useful for enforcing device authorization policies. You can link the authorization to a specific device using its node_id.

data "tailscale_device" "sample_device" {
  name = "device.example.com"
}

resource "tailscale_device_authorization" "sample_authorization" {
  # Prefer the new, stable `node_id` attribute; the legacy `.id` field still works.
  device_id  = data.tailscale_device.sample_device.node_id
  authorized = true
}

The tailscale_contacts resource allows you to manage the contact email addresses used for different types of communications within your Tailscale network (tailnet).

Important Note on Destruction: Destroying this resource via Terraform does not unset or modify the values in the Tailscale control plane; it only removes the resource from your Terraform state. To change or remove contact details in Tailscale, you must update the resource configuration or manage them via the Tailscale web console.

For more information on these contact preferences, see Tailscale Contact Preferences.

resource "tailscale_contacts" "sample_contacts" {
  account {
    email = "account@example.com"
  }

  support {
    email = "support@example.com"
  }

  security {
    email = "security@example.com"
  }
}