heinzel-tailscale¶
Share the authenticated web app privately through Tailscale Serve: a Heinzelmännchen plugin.
| Kind | capability |
| Version | 0.9.0 (first-party, released with Heinzelmännchen) |
| Source | https://github.com/helmut-hoffer-von-ankershoffen/heinzel/tree/main/plugins/heinzel-tailscale |
| Licence | MIT |
| Install | hz system plugin add tailscale --confirm |
| Modules | tailscale |
- Capability: adds operations of its own, commands people and agents run.
See it¶
tailscale in the terminal¶
Not recorded yet: make docs-record renders this scene (derived from the operations; a docs/scenes.toml replaces it).
What it shows
hz tailscale --help
hz tailscale status
hz tailscale status --json
Operations¶
Each column follows the kernel's actual exposure rules. MCP over stdio runs as its caller; HTTP MCP and public REST exclude private operations. Private API and web endpoints require their scoped bearer or paired session. Authentication does not grant human approval. Every CLI command takes --json.
| Operation | CLI | MCP stdio | MCP HTTP | REST | Private API | Web | Changes state | Audience |
|---|---|---|---|---|---|---|---|---|
| Show private sharing readiness without changing Tailscale or configuration. | hz tailscale status |
tailscale_status |
— | — | GET /tailscale/status |
GET /api/tailscale/status |
expert | |
| Share hz privately over Tailscale, preserving existing services and requiring authenticated readiness. | hz tailscale enable |
tailscale_enable |
— | — | POST /tailscale/enable |
POST /api/tailscale/enable |
yes | expert |
| Stop only hz's private Serve mapping and remove only the origin permission this plugin added. | hz tailscale disable |
tailscale_disable |
— | — | POST /tailscale/disable |
POST /api/tailscale/disable |
yes | expert |
hz tailscale status¶
Show private sharing readiness without changing Tailscale or configuration.
hz tailscale status
MCP tool tailscale_status: input schema
{
"properties": {},
"title": "tailscale_status",
"type": "object"
}
hz tailscale enable¶
Share hz privately over Tailscale, preserving existing services and requiring authenticated readiness.
hz tailscale enable
MCP tool tailscale_enable: input schema
{
"properties": {},
"title": "tailscale_enable",
"type": "object"
}
hz tailscale disable¶
Stop only hz's private Serve mapping and remove only the origin permission this plugin added.
hz tailscale disable
MCP tool tailscale_disable: input schema
{
"properties": {},
"title": "tailscale_disable",
"type": "object"
}
Settings¶
In your configuration file (hz system config set <key> <value>), or as environment variables.
[tailscale]¶
| Key | Type | Default | Environment variable | Description |
|---|---|---|---|---|
https_port |
integer | 443 |
HZ_TAILSCALE__HTTPS_PORT |
The private Tailscale HTTPS port. Existing services on it are preserved. (user scope only) |
intent |
SharingIntent or null | null |
HZ_TAILSCALE__INTENT |
The last explicit sharing request and its owned mapping; status reads never execute it. (user scope only) |
Also declares¶
NavLetmainintailscaleStatusLetsharingintailscale