The Problem: Tailscale's GUI App Was Never Built for Servers

If you've set up an unattended Mac mini as a home server — running Tailscale for remote access, ERPNext, or any always-on service — you've probably hit a frustrating gap: after a reboot, the machine sits at the login screen, locked, and completely unreachable over Tailscale until someone physically logs in.

This isn't a bug. It's a structural limitation of how the standard Tailscale macOS app works.

Why the GUI variant breaks headless setups

The Tailscale GUI app (Tailscale.app, downloaded from tailscale.com or the App Store) bundles three things into a single binary:

• The GUI (menu bar icon, settings windows)
• The daemon (the actual VPN/networking logic)
• The CLI (the same binary, running in a different mode)

Critically, this bundle is registered as a user login item, not a system-level daemon. That means:

• It only starts after a user logs in — never before.
• On a machine with automatic login disabled (as any security-conscious setup should have), there's a window — sometimes indefinite — where the machine is powered on, sitting at the lock screen, and has zero Tailscale connectivity.
• If the power cuts and the Mac restarts while no one's around to log in, you lose remote access entirely. You'd need physical access to get back in — defeating the entire purpose of remote administration.
• Tailscale SSH (tailscale ssh) is explicitly unsupported on this variant: "tailscale ssh is not available on sandboxed macOS builds — use the regular ssh client instead."
• The daemon runs as a macOS System Extension, which is powerful but also sticky — removing it requires a GUI step (System Settings → Login Items & Extensions) plus a reboot; it can't be cleanly removed from the terminal alone.

None of this is a flaw in Tailscale's product — the GUI variant is designed for laptops and desktops where a human is present. It's simply the wrong tool for a headless server.

The Fix: brew install tailscale

Homebrew's tailscale formula installs the open-source, non-GUI tailscaled daemon — the same one used on Linux servers. This variant:

• Runs as a proper system service (brew services), started by launchd at boot, completely independent of any login session.
• Is online and reachable the moment the machine powers on — before anyone touches the keyboard.
• Fully supports tailscale ssh.
• Requires no GUI interaction to install, configure, update, or remove — everything is scriptable, which matters if you're managing multiple machines or want this baked into a provisioning script.
• Has no Sparkle auto-updater, no menu bar overhead, no notification permission prompts — it's a clean daemon doing one job.

The trade-off: no menu bar icon, no GUI settings window. For a headless server this isn't a loss — it's the point.

This split mirrors exactly what you want from a security posture: the screen stays locked, requiring your macOS password for physical access, while the network layer stays fully operational underneath, independent of that lock. FileVault and automatic login become irrelevant to your remote access — you get server-grade uptime without giving up local security.

Full Command Reference

1. Remove the GUI variant completely

# Quit Tailscale from the menu bar first, then:
sudo rm -rf /Applications/Tailscale.app

# Check what system extension is registered
systemextensionsctl list

The system extension cannot be removed from the terminal. Go to: System Settings → General → Login Items & Extensions → Network Extensions → remove "Tailscale Network Extension" (requires admin password)

Confirm and finish the removal:

systemextensionsctl list
# should show: [terminated waiting to uninstall on reboot]

sudo reboot

# after reboot:
systemextensionsctl list
# should show: 0 extension(s)

2. Install Homebrew (if not already present)

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# add to PATH (Apple Silicon)
echo >> ~/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv zsh)"' >> ~/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv zsh)"

3. Install and start Tailscale as a system service

brew install tailscale
sudo brew services start tailscale

4. Connect to your Headscale server

sudo tailscale up --login-server=https://vpn.codify.tech

Follow the printed registration URL, then verify:

sudo launchctl list | grep tailscale   # confirm homebrew.mxcl.tailscale is running
tailscale status
tailscale ip -4

5. Enable Tailscale SSH

sudo tailscale set --ssh

Managing Nodes on the Headscale Server

Over time, re-registering a machine (GUI → Homebrew, or after a factory reset) leaves stale duplicate entries. Clean these up from the Headscale server itself.

List all nodes

headscale nodes list

Rename a node's display name on Headscale

headscale nodes rename -i <ID> <new-name>

Example — disambiguating a duplicate re-registration:

headscale nodes rename -i 22 mac-mini-m2-p2

Delete a stale/offline node

headscale nodes delete -i <ID>

Example — clearing out old offline duplicates:

headscale nodes delete -i 6    # invalid-7kwqbv6h, offline since March
headscale nodes delete -i 8    # invalid-jfqbfniu, offline
headscale nodes delete -i 18   # invalid-kfbprz3i, offline

Always run headscale nodes list immediately before deleting anything — IDs can shift meaning as entries are added or removed, and a wrong ID deletes the wrong machine.

Renaming the local machine hostname (macOS side)

The Headscale display name and the macOS system hostname are independent. To rename the Mac itself (which Tailscale/Headscale will pick up on next tailscale up):

sudo scutil --set HostName new-hostname
sudo scutil --set LocalHostName new-hostname
sudo scutil --set ComputerName "New Hostname"

Then re-advertise the new name to Headscale:

sudo tailscale up --login-server=https://vpn.codify.tech --hostname=new-hostname

Summary

For any Mac acting as a server — reachable, scriptable, and resilient to power cycles without sacrificing screen-lock security — the Homebrew daemon is the correct choice.