# Tailscale & Device Identity

## When did MintFlow add Tailscale support?

Experimental Tailscale support shipped in MintFlow 2.0.0, including login and live exit-node selection. MintFlow 2.1.0 adds the `exit-node-ip` profile field to save a preferred exit node. Tailscale requires an active Pro entitlement, including an eligible active subscription trial. You can log in through a browser or an auth key and choose which IPv4 traffic enters the tailnet. See [Tailscale setup and login](../howtos/tailscale.md) for a complete profile and the initial integration's limitations.

## Why am I still logged into Tailscale after deleting and reinstalling MintFlow?

Tailscale machine state is stored in device-local **Keychain**, not ordinary app sandbox files. On the same device, restoring the same profile through enabled iCloud profile sync can therefore reuse the existing login. The state is keyed by the profile UUID and login server; a newly created profile with similar text is not necessarily the same identity.

iCloud restores the profile, not the Tailscale machine state. That state is device-only, so another device needs its own login. Reinstalling is not a reliable logout or a guaranteed identity backup. Explicit logout, device erasure, missing Keychain state, or tailnet revocation may require you to authenticate again.

Use **Tools → Tailscale → Identity → Log Out** when you want to log out. **Clear Bootstrap Auth Key** only removes the saved enrollment key. **Forget Local Identity** is for recovery and does not remove the old node from the Tailscale admin console.

## What happens to Tailscale when my Pro trial expires?

Without another active Pro entitlement, the feature locks. When compiling the profile, MintFlow excludes the Tailscale interface and turns routes that target it into **REJECT**, preventing an unintended fallback to Direct. Check compilation diagnostics and deliberately choose another output if needed. Expiry itself does not erase the Keychain identity; a renewed entitlement may reuse it if it remains valid.


## What happens when the same profile reaches another device?

iCloud sync preserves the profile identity and configuration, but does not clone the Tailscale machine identity. Each device enrolls as its own tailnet node. You can use the same Tailscale account or a permitted auth key; browser login is often easiest because a previously used one-time key may be rejected on the second device.

| Item | Shared with the profile? |
|---|---|
| Login-server URL, route rules, `drive-dns`, preferred `exit-node-ip` | Yes |
| An `auth-key` saved in profile text | Yes; treat it as a synced secret |
| Machine keys and authenticated device identity | No; device-only Keychain |
| Accept Routes and device preferences | No |
| Live exit-node override | No |

If a saved key is expired, revoked, or already used, choose **Log In in Browser** or submit a new suitable key. Browser login does not reuse the rejected key, and does not automatically remove it from the synced profile. Clearing the saved bootstrap key edits the profile and can sync; logging out acts on this device's identity.

## What carries traffic while a synced profile is logging in?

For fresh enrollment, active login, or pending device approval, traffic assigned to an unenrolled Tailscale interface can temporarily use **Direct**. This is visible in Tailscale status and ends when the provider is ready. It is not yet traffic through your tailnet or exit node. Private tailnet DNS/services still need working Tailscale connectivity.

Cancelling login blocks the Tailscale-selected path. An enrolled identity that later expires stays blocked until explicit login; ordinary outages or an unavailable exit node do not silently authorize Direct. Successful live logout opens the current session for re-login and can enable temporary Direct; a later restart does not silently reuse the saved key after logout.

## Does exit-node selection sync?

In 2.1.0, `exit-node-ip` stores a preferred IPv4 exit node in the profile. Each device still needs its own login and permission to use that node. The default is reapplied on VPN restart and explicit login.

A live selection overrides the profile default for the current session without editing or syncing it. **Use Profile Default** restores the saved choice. If the field is absent, each device's persisted exit-node preference applies; omission does not mean “disable exit nodes.” Removing a saved default does not immediately clear the current node.

[Setup and login](../howtos/tailscale.md) · [Tailscale profile fields](../profile/vpns.md)