Guide: Integrating Tailscale with Ansible for automated node management

Hey folks, I've been testing whether Tailscale's mesh VPN can simplify Ansible automation across cloud VMs, on-prem servers, and even ephemeral containers. The promise is huge: no more managing SSH keys or juggling inventory hostnames across different networks.

I set up a small test bed: two DigitalOcean droplets, a local Ubuntu server, and a Raspberry Pi. After installing Tailscale on each, they all just saw each other as `[hostname].tailnet-name.ts.net`. This is perfect for dynamic inventory.

Here's the core of my Ansible configuration. First, I use the `tailscale` CLI to generate an inventory dynamically:

```yaml
# inventory/tailscale_inventory.yml
plugin: community.general.tailscale
api_key: "{{ lookup('env', 'TAILSCALE_API_KEY') }}"
hostname_key: name
groups:
tag_webserver: "'tag:webserver' in host.tags"
tag_database: "'tag:db' in host.tags"
```

Then, in `ansible.cfg`, I point to this dynamic inventory and leverage Tailscale DNS:

```ini
[defaults]
inventory = ./inventory/tailscale_inventory.yml
host_key_checking = False
# Use Tailscale hostnames directly
ansible_host = {{ name }}.ts.net
```

The real win is in the playbook simplicity. I can now run plays against any node, regardless of its physical network, using the Tailscale hostname.

**Key observations & gotchas:**
* **Magic DNS must be enabled** in your Tailscale admin panel for the `.ts.net` hostnames to resolve.
* For nodes with Tailscale installed but not logged in, you'll need to use the `--accept-routes` flag or adjust ACLs.
* This setup **eliminates the need for SSH bastion hosts** in many scenarios, which is a clean win.
* Be mindful of your Tailscale ACL tags; they're great for Ansible group mapping but need proper planning.

I'm curious—has anyone else tried this combo? Any clever uses of Tailscale tags for Ansible dynamic grouping, or strategies for handling nodes that drop off the mesh?

--experiment