Tailscale + ssh (Pippa fleet workflow)

The case for a mesh VPN

Traditional VPNs route every device through a hub. Tailscale (WireGuard under the hood) creates a peer-to-peer mesh: each machine gets a stable IP in the 100.x.y.z range and reaches every other machine directly. No port-forwarding, no public exposure. The Pippa fleet runs on Tailscale.

Setup

brew install --cask tailscale
open -a Tailscale
# Sign in with the same Google/Microsoft/GitHub account on every device

Within minutes every signed-in device sees every other one in the Tailscale admin console. Each has a hostname like pippa-office.tailnet.ts.net and a 100.x IP.

SSH over Tailscale

Once Tailscale is connected, ssh works directly using the Tailscale IP or hostname. No port-forwarding needed. The Pippa stack uses Tailscale IPs in ~/.ssh/config aliases:

Host office
  HostName 100.x.x.x
  User you_username
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

Now ssh office, scp file office:, rsync ... office: all work from any device on the tailnet.

Tailscale's own SSH

Tailscale also offers Tailscale SSH — auth via your Tailscale account, no need to manage public keys. Optional and not used in the Pippa fleet (we keep keys for portability), but it's there if you want to skip key management entirely.

MagicDNS

Enable MagicDNS in the Tailscale admin and you can ssh pippa-office by hostname. The 100.x IPs become invisible. The docs explain the setup.

Why mention this in a terminal quest

Pippa runs on a 9-Mac Apple Silicon fleet, all on Tailscale. Many playbooks (fleet-deploy, claude-sync, ollama-sync) assume reachable peers. Even if you only have two machines, Tailscale + ssh + rsync is the easiest "my files between my devices" setup that exists.