Remove mosh (incompatible with Tailscale SSH) - #9
Merged
Merged
Conversation
mosh can't bootstrap through Tailscale SSH: tailscaled swallows TCP :22 after WireGuard decryption and never feeds it to a real OpenSSH server, which mosh-server needs. Verified end-to-end (auth + mosh-server + bidirectional UDP all work, yet the handshake fails on both a Mac and a phone; Tailscale #4919). The repo installed mosh AND the README told users to 'mosh devbox' — a package that does nothing and a doc that can't deliver. Removed both; tmux already provides the session survival mosh was there for (and survives reboots too). FOOTGUNS records why + the OpenSSH-on-a-separate-port workaround for anyone who wants it. Live box brought to parity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
mosh can't bootstrap through Tailscale SSH —
tailscaledtakes over TCP :22 before the kernel's sshd sees it, and mosh needs a real OpenSSH server to launchmosh-server(Tailscale #4919). The repo installedmoshand the README recommendedmosh devbox, so it shipped a no-op package and a doc that can't deliver on a tailnet-only box.What
Removed
moshfrom the cloud-init packages and the README's daily-use line (tmux already provides the resilience — and survives reboots, which mosh can't). Recorded the why and the OpenSSH-on-a-non-22-port workaround in FOOTGUNS' 'deliberately removed' list, next to fail2ban and ntfy. Live box brought to parity (apt purge mosh).Verified
Root cause reproduced end-to-end before removal: SSH auth,
mosh-serverstartup+survival, and bidirectional UDP over the tailnet ALL succeed, yet the mosh handshake fails identically on a Mac and a phone — confirming it's the Tailscale-SSH bootstrap, not firewall/locale.make checkgreen.🤖 Generated with Claude Code