# A permanent address with Tailscale

At the end, the runner has an address like `https://loopgate-runner.your-tailnet.ts.net` that only your team's own laptops can open. Tailscale builds a private network between your devices, called a tailnet, and nothing outside it reaches the runner.

## At a glance

**Time:** 15 minutes, plus a few minutes on each teammate's laptop.

**You need:**

- The runner from [Any Linux box](any-box.md)
- A Tailscale account (check Tailscale's pricing for the size of your team)
- Tailscale on the laptop of each person who opens the runner

## Steps

1. **On the box, install Tailscale with its own script.**

   ```sh
   curl -fsSL https://tailscale.com/install.sh | sh
   ```

   You should see: `Installation complete!` and a hint to run `tailscale up`.

2. **Join the box to your tailnet.**

   ```sh
   sudo tailscale up
   ```

   You should see: `To authenticate, visit:` and a web address. Open it on your laptop, sign in to Tailscale and approve the box. The command on the box then finishes.

3. **On your laptop, open the admin console at `https://login.tailscale.com/admin/dns`** and check that **MagicDNS** is enabled. It gives each device a name, and it is on for most new tailnets.

4. **Scroll to HTTPS Certificates, press Enable HTTPS and confirm.** It stays off until an admin turns it on.

   You should see: HTTPS Certificates marked as enabled.

5. **On the box, send the tailnet's HTTPS traffic to the runner.**

   ```sh
   sudo tailscale serve --bg 4311
   ```

   You should see: `Available within your tailnet:` followed by an address ending `.ts.net/`. That is the runner's address. Copy it.

6. **Give the runner that address**, with no slash at the end.

   ```sh
   cd ~/loopgate && echo "LOOPGATE_RUNNER_URL=https://loopgate-runner.your-tailnet.ts.net" >> runner.env
   ```

7. **Restart the runner.**

   ```sh
   docker compose up -d runner
   ```

   You should see: the portal's Devices row shows the new address, no longer marked `temporary`.

8. **Check the runner's own line.**

   ```sh
   docker compose logs runner
   ```

   You should see: `Runner ready at https://…ts.net`.

9. **In the admin console, open Users and invite each teammate.**

10. **Each teammate installs Tailscale from `https://tailscale.com/download`** and signs in to your tailnet.

    You should see: the box `loopgate-runner` in their Tailscale device list.

11. **Each teammate opens the Loopgate portal, opens Devices and presses Open** on the runner's row.

    You should see: the workbench. The very first visit may take a few seconds while Tailscale makes the certificate.

## Good to know

- A browser stays signed in for thirty days from its last use, while Tailscale is on.
- Settings → General names the address `permanent` once the runner has it.
- Links Slack posts from now on survive a restart.
- [By hand](by-hand.md) has every line of `runner.env`.

## If something is off

- **The address does not open.** Check that Tailscale is on and signed in to your tailnet on that laptop.
- **`tailscale serve` says HTTPS is not enabled.** Turn on HTTPS Certificates (step 4), then run step 5 again.
- **"This link expired. Open the runner from the portal again."** Press **Open** in **Devices** again.

## Next

- [Connect Slack](slack-connect.md)
- [Updates and backups](care.md)