Repository navigation
feat(bootstrap): open the Tailscale app at login on the gateway host - #357
evansenter wants to merge 2 commits into
Conversation
Adds a gateway-only LaunchAgent that opens the Standalone Tailscale app at login, so the gateway's tailnet services come back after a reboot. The app can't start before login (only the open-source tailscaled can, and the two don't coexist), and FileVault blocks pre-login daemons on this host anyway, so login-time is the earliest achievable start. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LU6XPUUvj1XfSh2dQBV7wP
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| # back after a reboot. The app can't run before login (only the open-source | ||
| # tailscaled can, and the two don't coexist); with FileVault on, nothing | ||
| # runs before the first unlock anyway. | ||
| if is_gateway_host && [[ -d /Applications/Tailscale.app ]]; then |
There was a problem hiding this comment.
[Suggestion] The Standalone Tailscale app has its own "Launch at login" setting (Settings → General), which registers a login item. If that setting is ever switched on, the app gets launched twice at login. That is harmless, because open on an app that is already running does nothing. Still, a one-line comment on why the repo uses its own agent instead of that toggle would help. My guess is that the agent is version-controlled and gets restored by ./bootstrap.sh, while the toggle lives in app preferences and can be lost on reinstall. Writing that down would stop someone from later removing the agent as redundant.
There was a problem hiding this comment.
Code Review — Round 1
Summary
Adds a gateway-only LaunchAgent that runs open -g -a /Applications/Tailscale.app at login, wired into install_launch_agents() the same way as the Jellyfin and Obsidian agents, and documents it in CLAUDE.md. The plist follows repo conventions (__HOME__ placeholder, logs in ~/.local/log/, no KeepAlive for a one-shot open). The gate (is_gateway_host plus an app-present check) matches the existing pattern, and the PR body shows it was installed on the mac-mini and exited with code 0.
(Round count: the --slurp form of the round-count command is not supported by this runner's gh. The --paginate form without --slurp returned 0 prior automated reviews.)
Verdict
APPROVE - No blocking findings. One non-blocking suggestion is inline.
Automated review by Claude Code
…ogin toggle Addresses review feedback on #357. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LU6XPUUvj1XfSh2dQBV7wP
Feedback AddressedImplemented
|
There was a problem hiding this comment.
Code Review — Round 2
Summary
This adds a gateway-only LaunchAgent that runs open -g -a /Applications/Tailscale.app at login. It is installed through the existing install_launch_agent() path, so it gets the __HOME__ substitution, the logs in ~/.local/log/, and the reload that only runs when the content changed. The gate (is_gateway_host plus a check that the app is present) matches the Jellyfin and Obsidian agents. RunAtLoad without KeepAlive is right for a one-shot open. The app comes from the tailscale-app cask in Brewfile.ai, and the CLAUDE.md entry matches what the code does.
(Round count: this runner's gh doesn't support --slurp. The --paginate form found 1 earlier automated review, and that matches the PR history.)
Previously Addressed (Filtered)
- [Suggestion]
bootstrap.sh— explain why the agent overlaps the app's own "Launch at login" toggle. Implemented: the new comment says the toggle is lost on reinstall, and opening an app that is already running does nothing.
Verdict
APPROVE - No blocking findings.
Automated review by Claude Code
Summary
LaunchAgents/com.evansenter.tailscale.plist, which runsopen -g -a /Applications/Tailscale.appat load.openexits as soon as the app is running, so the plist has noKeepAlive.install_launch_agents(), but only on the gateway host (is_gateway_host) and only whenTailscale.appis present.Why not start it at boot?
Only the open-source
tailscaledcan run before login (macOS variants, run unattended), and it can't run alongside the Standalone app, which we want to keep. The mac-mini also has FileVault on, so even a LaunchDaemon wouldn't start until someone unlocks the disk at login. Starting the app at login is the earliest point we can reach. Usesudo fdesetup authrestartfor planned reboots.Test plan
make checkpasses (67/67)launchctl printshowslast exit code = 0🤖 Generated with Claude Code
https://claude.ai/code/session_01LU6XPUUvj1XfSh2dQBV7wP