Headscale & Tailscale – Synology NAS Installation

This is the specific procedure for installing Tailscale with Headscale on a Synology NAS. This post is also available in French too.
First, install the Tailscale application using the Synology package manager.

Do not try to initialize using the user interface, as this will only work with the Tailscale commercial service, not Headscale.

Then log in to the NAS using SSH via your administrator account and execute this command:

sudo tailscale up --reset --login-server https://hs.xxxx.xxx

Retrieve the value of mkey, then open a terminal on the Headscale machine and execute this command:

docker exec headscale headscale nodes register --user USERNAME --key mkey:xxxxxxxxxxxxxxxxxxxxxxxx 

To do this via the Headplane interface, on the “Machines” page, click on “Add Device”, add the mkey:xxx character string, choose the user and click “Register”.

Setup Tailscale Outbound Connections On Synology NAS

On a Synology NAS, some additional operations are required. I found this information about this video and this documentation on the Tailscale website.

• Make sure you’re running Tailscale 1.22.2 or later, either from the Synology Package Center or a manually installed *.spk from the Tailscale Packages server.
• In Synology, go to Control Panel > Task Scheduler, click Create, and select Triggered Task.
• Select User-defined script.
• When the Create task window appears, click General.
• In General Settings, enter a task name, select root as the user that the task will run for, and select Boot-up as the event that triggers the task. Ensure the task is enabled.
• Click Task Settings and enter the following for User-defined script.

/var/packages/Tailscale/target/bin/tailscale configure-host; 
synosystemctl restart pkgctl-Tailscale.service

• Click OK to save the settings.
• Reboot your Synology. (Alternatively, to avoid a reboot, run the above user-defined script as root on the device to restart the Tailscale package.)

On my remote Synology, I found that after a while, it would no longer accept incoming connections. So I created a new scheduled task for every day at 11:30 with the same command above to make sure that everything works for my backup that runs at midnight. I haven’t seen any worries since that addition.
I invite you to read or return to the Headscale and Tailscale ticket.