Skip to content

Remove mosh (incompatible with Tailscale SSH) #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oz6un merged 1 commit into from
Jul 14, 2026
Merged

Remove mosh (incompatible with Tailscale SSH) #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,8 @@ Optional: enable **Tailscale Serve** on your tailnet for HTTPS preview URLs —
- **`ssh devbox`** lands you in fish inside a persistent tmux session. Detach with `Ctrl-b d`,
split with `Ctrl-b |` / `Ctrl-b -`, new window with `Ctrl-b c`. Mouse works and selections
copy to your local clipboard. Sessions survive network drops and the nightly reboot — layouts
restore, and `claude --continue` resumes a conversation. Use `mosh devbox` on flaky networks.
restore, and `claude --continue` resumes a conversation. tmux is what makes reconnecting
seamless; if your client drops, reconnect and you're back exactly where you were.
- **`http://devbox:<port>`** opens any dev server from any tailnet device — no flags, no tunnels —
including localhost-only binds and Docker publishes. For HTTPS (secure cookies, service workers),
run `tailscale serve --bg <port>` for `https://<name>.<tailnet>.ts.net`, and `tailscale serve off` when done.
Expand Down
1 change: 1 addition & 0 deletions cloud-init.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ packages:
- python3
- docker.io
- docker-compose-v2
# (mosh intentionally absent — it can't bootstrap through Tailscale SSH; see FOOTGUNS)

users:
- name: ${DEV_USER}
Expand Down
10 changes: 10 additions & 0 deletions docs/FOOTGUNS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,16 @@ broke something in practice; don't re-learn them.
- **ntfy mirror in claude-notify**: nothing subscribed to the topic after
Pushover won; it was a second HTTP call per event to nobody. Single-channel
now; ntfy is ~15 lines to re-add if a free/desktop channel is ever wanted.
- **mosh**: can't bootstrap through **Tailscale SSH** — `tailscaled` swallows all
TCP :22 packets after WireGuard decryption and never hands them to the kernel's
sshd, and mosh needs a *real* OpenSSH server to launch `mosh-server`. Verified
end-to-end (SSH auth + `mosh-server` + bidirectional UDP all work, yet the mosh
handshake fails on both a Mac and a phone) — see Tailscale issue #4919. Not a
firewall or locale problem; the design is fundamentally incompatible. tmux
already covers session survival (and survives reboots, which mosh can't). To
actually get mosh, run classic OpenSSH on a non-22 port (tailscaled owns 22) +
a device key, and point the client's mosh at that port — an opt-in worth adding
only if someone genuinely wants the instant-echo feel.

## Hetzner

Expand Down
Loading