tailscale-opslisted

# tailscale-ops Judgment layer for Tailscale administration. Raw API access is easy — this skill exists to prevent the two disasters that matter: **locking yourself out of your own tailnet** and **applying a broken policy**. Read operations are free. Policy writes follow a strict workflow. No exceptions. ## Credentials All scripts source `~/.config/claude-homelab/credentials.env` if it exists, falling back to environment variables. Expected variables: ``` TAILSCALE_API_KEY=tskey-api-... TAILSCALE_TAILNET=- # "-" means the default tailnet of the key TAILSCALE_API_BASE= # optional — set for headscale (e.g. https://headscale.example.com) ``` **If credentials are missing or a request returns 401:** do not improvise. Show the current state, point the user to `/homelab`, and stop. **If the user pastes a token into the chat:** warn them immediately — the token is now in the conversation history. Tell them to revoke it in the admin console (Settings → Keys), then run `bash ~/.claude/skills/tailscale-ops/scripts/setup.sh` in their own terminal so the replacement never touches the chat. ## API basics Base URL: `https://api.tailscale.com/api/v2`. Auth: `Authorization: Bearer $TAILSCALE_API_KEY`. | Action | Endpoint | |---|---| | Read policy file | `GET /tailnet/-/acl` (Accept: application/hujson) | | Validate policy | `POST /tailnet/-/acl/validate` | | Apply policy | `POST /tailnet/-/acl` (If-Match: `"<etag>"`) | | List devices | `GET /tailnet/-/devices` | | Devic