Join us in San Francisco for TailscaleUp!Grab your ticket ->

Deploy Tailscale on Linux using MDM

Last validated:

This page contains technical information useful to system administrators deploying Tailscale on Linux in a corporate environment.

Unlike other platforms, Linux does not have a single vendor-provided mobile device management (MDM) framework. Instead, administrators typically manage fleets of Linux devices using configuration management tools such as Ansible, Puppet, or Chef, or by baking configuration into a golden image used for provisioning. Tailscale supports this workflow on Linux with a JSON policy file that you can deploy using whichever configuration management tool you already use.

System policies on Linux require Tailscale v1.102.0 or later. The feature is not available on earlier versions.

Installing Tailscale on Linux

Refer to our Linux installation instructions for the recommended way to install Tailscale on your distribution.

Using Tailscale system policies on Linux

The tailscaled daemon reads system policies from a JSON file on disk. By default, this file is located at /etc/tailscale/syspolicy.json. You can deploy this file to your managed Linux devices using your preferred configuration management tool.

You can change the location of the policy file, or disable this feature entirely, using the --syspolicy-file flag when starting tailscaled. Passing an empty string disables the policy file loader.

Refer to our system policies page for the full list of configurable settings.

File format

The policy file uses JSON or HuJSON format. Each policy key expects a specific value type:

  • String settings take a JSON string, for example "ControlURL": "https://controlplane.example.com".
  • Boolean settings take a JSON boolean, for example "AlwaysOn": true.
  • Integer settings take a JSON number, for example "KeyExpirationNotice": 86400.
  • String array settings take a JSON array of strings, for example "AllowedSuggestedExitNodes": ["node-a", "node-b"].
  • Duration settings take a string in the format accepted by Go's time.ParseDuration, for example "ReconnectAfter": "24h".
  • Some settings only accept specific enumerated string values, such as always, never, or user-decides for preference settings, or show or hide for visibility settings.

Example

For example, the following policy file enforces an auth key, restricts the device to a specific tailnet, restricts suggested exit nodes, and requires the device to accept subnet routes and DNS settings from the tailnet:

{
  "AuthKey": "tskey-auth-xxx",
  "Tailnet": "example.com",
  "AllowedSuggestedExitNodes": ["node-a", "node-b"],
  "UseTailscaleSubnets": "always",
  "UseTailscaleDNSSettings": "always"
}