A named Tailscale Service gives trails a stable private URL even if you later move canonical state to another hub:
https://trails.your-tailnet.ts.net/This is an advanced administrator path. Ordinary one-Mac installations should stay local. Most multi-Mac installations should use hub --tailscale. Configure svc:trails only when a stable service identity is worth the additional tailnet policy and approval work.
Before changing the hub’s identity
Read Tailscale’s documentation for tagged device identity, grants, and Tailscale SSH before proceeding.
You need Owner, Admin, or Network admin access to the tailnet.
Configure svc:trails
Define the service
In the Tailscale admin console, define a Service named trails. Configure its endpoint as tcp:443. The resulting service identifier is svc:trails.
Define a host tag
Add a host tag such as tag:trails to the tailnet policy’s tagOwners section. Choose the people or groups allowed to assign that tag.
Review network and SSH access
Check the tailnet’s grants, legacy ACLs if any remain, and SSH rules. Confirm that the users and spokes that need trails can reach the tagged hub on TCP 443 and that any required administration path remains available.
Assign the tag to the hub
Apply tag:trails to the hub only after the policy review. Confirm in the Machines page that the Mac now has the intended tag-based identity.
Advertise trails from the hub
Run the service-mode installer command below. Trails keeps listening on 127.0.0.1:7412 and asks Tailscale Serve to advertise svc:trails on HTTPS.
curl -fsSL https://releases.manzanita.dev/trails/install.sh | sh -s -- \
hub --service svc:trails --name "Home Mac"Approve the advertised host
Open the trails Service in the Tailscale admin console. Approve the pending hub under Service hosts unless your policy already auto-approved it.
Verify the stable URL
Open https://trails.your-tailnet.ts.net/ from an authorized tailnet device. If setup timed out while waiting for approval, rerun the same hub --service svc:trails command after approval; it is safe to rerun.
Move spokes only after the URL is healthy
Do not change a spoke’s collector URL until the stable address opens successfully. Then rerun join setup on each spoke with the stable URL.
curl -fsSL https://releases.manzanita.dev/trails/install.sh | sh -s -- \
join https://trails.your-tailnet.ts.net/ --name "Laptop"Updating a service-mode hub
Preserve --service svc:trails every time you update the hub. Omitting it changes the setup mode and reports the local loopback URL instead of verifying the named Service.
If a policy or approval change makes the stable URL unhealthy, leave existing spokes on their current working URL until the Service is healthy again.