---
title: Charmhub | Deploy Tailscale Config using Charmhub - The Open Operator Collection
description: Deploy the latest version of Tailscale Config on any cloud. Central credential
  authority for a Tailscale or Headscale tailnet.
url: https://charmhub.io/tailscale-config
---

# Tailscale Config

[Leon](https://charmhub.io/publisher/sed-i "View all packages from Leon")

* [Leon](https://charmhub.io/publisher/sed-i "View all packages from Leon")

Platform:

24.04

1.x/candidate 5

```
juju deploy tailscale-config --channel 1.x/candidate
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

#### Relevant links

* [Homepage](https://charmhub.io/tailscale-config)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/service-mesh/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

---

[Add docs to a charm](https://juju.is/docs/sdk/add-docs-to-your-charmhub-page)

#### Central credential authority for a Tailscale or Headscale tailnet.

tailscale-config is a workloadless charm that acts as the central credential
authority for a charmed Tailscale/Headscale solution.

On relation to a downstream charm (tailscale-k8s or tailscale-beacon) it mints
a scoped, per-downstream credential using the control-plane API (a child OAuth
client for Tailscale, a pre-auth key for Headscale) and distributes it over a
relation. On relation removal it revokes that credential. It holds no cluster
or tailnet state beyond the root credential it needs to talk to the
control-plane API, so it can run anywhere reachable, on or off the cluster.

A single tailscale-config is multi-tenant: it can serve many downstream charms
across many models and clusters at once, minting an independent credential per
relation. It is optional — downstream charms are fully functional standalone
via manual config — but it is the recommended default at scale as it automates
credential minting and revocation.

This charm is useful for platform teams operating charmed workloads that need
to join a Tailscale or Headscale tailnet without managing per-workload
credentials by hand.