How to change login?

[ukanuk]

Problem

I wanted to test changing my login, but had a lot of difficulty figure out how to do so. Eventually I got it to happen by deleting tag:homeassistant in the Home Assistant Tailscale Configuration. I'm not sure why that triggered login and whether I had to do other steps as well, but at least I got it eventually. Since tag:homeassistant is the default per https://github.com/hassio-addons/app-tailscale/blob/main/tailscale/DOCS.md#configuration and thus presumably recommended, I added it back into the config and restarted the app before actually logging into my new tailnet -- but then I got the error described in #642, so I disabled it again.

Taildrop is only supported between devices in the same tailnet, which is one reason why I do not want to simply share the existing device with a new tailnet. Another reason is I do not want to continue managing two different tailnets, so I want all devices migrated to the new tailnet.

Attempt to log out using key expiry

From the Tailscale login console, I attempted reactivating key expiry for the homeassistant device. However while it initially showed expiry in 30 minutes, after that amount of time it jumped to expiration in 4 months. https://tailscale.com/docs/features/tags#key-expiry says "the device's key expiry will not change unless you re-authenticate", so perhaps this was messing with it somehow. In any case, using key expiry is still not ideal since the minimum setting is 1 day in Tailscale device management.

Attempt to log out using Web UI

As noted in #314, the Home Assistant Tailscale Web UI is read-only due to being an iframe, and as of recent versions http://<device's TS IP>:5252/ is completely disabled. This means I cannot manage my login there. Here is the Synology web UI showing logging in for read-write access, then going to details page for logout button:

Attempt to log out by changing login server configuration

In the Home Assistant Tailscale config, I attempted changing the Login server setting to https://controlplane.tailscale.commmm to hopefully force reauth. However after restarting the app, this prevented Tailscale from booting with error can't change --login-server without --force-reauth.

-----------------------------------------------------------
 App: Tailscale
 Zero config VPN for building secure networks
-----------------------------------------------------------
 App version: 0.27.1
 You are running the latest version of this app.
 System: Home Assistant OS 17.1  (amd64 / qemux86-64)
 Home Assistant Core: 2026.3.1
 Home Assistant Supervisor: 2026.02.3
⁝
can't change --login-server without --force-reauth
[15:43:41] FATAL: Unable to start up Tailscale
s6-rc: warning: unable to start service post-tailscaled: command exited 1
/run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information.
/run/s6/basedir/scripts/rc.init: fatal: stopping the container.
⁝

Attempt to log out with --force-reauth

I tried figuring out how to send the --force-reauth flag via SSH or otherwise, and found #546 and #594 showing it requires additional experience tunneling into the Tailscale container versus just the regular Home Assistant container. So I gave up on this method after reading that ticket.

[lmagyar]

The config in the DOCS is only an example!!!

All the issues mentioned are Tailscale config issues, not caused by this add-on/app. Read TS docs about using tags.

Logout: you can remove the device from your tailnet, that will force a reauth on next start.

The only thing that can be fixed, is the --force-reauth, when login server change is detected. I will add it when I find time. Workaround: reinstall, edit config, start.

[ukanuk]

The config in the DOCS is only an example!!!

I see. I apologize for my confusion from trying to find a recommended default. When using this UI button, it clearly does NOT set app to defaults. E.g., the first few options says they should be enabled by default, but clicking "Reset to defaults" disables all of them.

Logout: you can remove the device from your tailnet, that will force a reauth on next start.

I did consider that. However I did not want to immediately lose its IP address until having a few days to confirm the new tailnet migration was working as expected.

The only thing that can be fixed, is the --force-reauth, when login server change is detected. I will add it when I find time. Workaround: reinstall, edit config, start.

Thank you! Adding --force-reauth for change of login server would be great.

For the proposed reinstall workaround, I am also concerned it would result in Tailscale assigning a new IP address. It is not very clear to me when Tailscale assigns new IPs, and it has unexpectedly assigned a new IP address on me at least once before. I think it's especially common with VMs, and HAOS is running in a VM on my NAS which is exactly the scenario of concern. Ideally MagicDNS fixes this dependence on IPs -- but on my experience with Tailscale on Android, enabling the Tailscale DNS occasionally breaks things. So I've given up on MagicDNS for now.

[lmagyar]

The config UI (this is provided by HA) is totally broken, known for years, nobody cares. Always use the yaml editor in the ... menu, never the UI. There is a PR to make everything mandatory, nothing optional, that will fix this UI bug, it is merged, not released.

I see, I never thought about the IP change. There is another PR that fixes MagicDNS for the add-on, also merged, not released.

Note: I'm only on my phone for a few weeks, that's why my answers are short.

[github-actions]

There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues.
Please make sure to update to the latest version and check if that solves the issue. Let us know if that works for you by leaving a comment 👍
This issue has now been marked as stale and will be closed if no further activity occurs. Thanks!

[lmagyar]

I've created a fix/pr for the login server changed issues. #673

cc @noseshimself from #546

[github-actions]

There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues.
Please make sure to update to the latest version and check if that solves the issue. Let us know if that works for you by leaving a comment 👍
This issue has now been marked as stale and will be closed if no further activity occurs. Thanks!