From 0f7d1e536bed9f01dd7161f7637af19bb0908335 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Tue, 13 Oct 2026 12:11:29 +0000 Subject: [PATCH] docs: warn about audit-log attributes with logtail disabled Updates #3522 (cherry picked from commit cced8a0ab, docs only) (cherry picked from commit 7d8cfe13f) --- docs/about/faq.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/about/faq.md b/docs/about/faq.md index 09792653d..1c3afd8cb 100644 --- a/docs/about/faq.md +++ b/docs/about/faq.md @@ -206,6 +206,11 @@ Headscale, by default, instructs clients to disable log submission to the centra applied by a client once it successfully connected with Headscale. See the configuration option `logtail.enabled` in the [configuration file](../ref/configuration.md) for details. +Do not grant the `https://tailscale.com/cap/data-plane-audit-logs` node attribute while `logtail.enabled` is `false`. A +client with log submission disabled treats this attribute as "the tailnet requires logging" and turns itself off, as +`tailscale down` would. It stays off until the attribute is removed and `tailscale up` is run. A client started with +`TS_NO_LOGS_NO_SUPPORT=true` or `--no-logs-no-support` reacts the same way, whatever `logtail.enabled` says. + Alternatively, logging can also be disabled on the client side. This is independent of Headscale and opting out of client logging disables log submission early during client startup. The configuration is operating system specific and is usually achieved by setting the environment variable `TS_NO_LOGS_NO_SUPPORT=true` or by passing the flag