Skip to main content
Use Tailscale webhooks to send the tailnet events an administrator has to act on to Flashduty On-call: a node key about to expire or already expired, a device or user waiting for approval, a device waiting for a signature under Tailnet Lock, and a subnet router or exit node without IP forwarding enabled. When a device is approved, signed, or deleted, Flashduty recovers the matching alert. According to the Tailscale documentation, webhooks are available on all plans, including the free Personal plan.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, go to Channels and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Tailscale and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Tailscale and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

Configure Tailscale

1

Add a webhook endpoint in Tailscale

Where: Tailscale admin console › Settings › Webhooks › Add endpointYou need the Owner, Admin, Network admin, or IT admin role in the tailnet.
2

Select events and save

Where: Tailscale admin console › Settings › Webhooks › Add endpointSelect the following events. The two IP forwarding events make up the Device misconfiguration category, so you can select that category instead; the others are in the Tailnet management category:Rejecting a pending device in Tailscale deletes it, so no nodeApproved follows. Subscribe to nodeDeleted to recover such approval alerts when the device is deleted. Tailscale also sends nodeDeleted every time an ephemeral node is removed automatically; when no matching alert is open, Flashduty ignores the recovery.You can also select the whole Tailnet management category. Its other events (such as nodeCreated, policyUpdate, and userRoleUpdated) are informational: Flashduty returns success and creates no alert.Click Add endpoint again. Tailscale shows the webhook secret; Flashduty does not use it, so you can close the dialog.
3

Turn on the auto-resolve timeout

Where: Flashduty console › Channels › Configuration › Settings › Advanced SettingsNode key expiry and IP forwarding misconfiguration have no recovery event: after you renew the key or enable IP forwarding, Tailscale sends nothing more. Closing the incident also closes its alerts. See auto-resolve timeout.
4

Send a test event and verify

Where: Tailscale admin console › Settings › WebhooksIn the Webhooks list, find the endpoint, open the menu on its right, and choose Test endpoint → Send test event. Tailscale sends an event whose type is test. Flashduty returns success and creates no alert, so the test button only proves the push URL is reachable.To see an alert you need a real event: for example, with device approval enabled in the tailnet, add a new device. Tailscale sends nodeNeedsApproval and a Warning alert appears in Flashduty; approve the device (nodeApproved) and the alert recovers.After a few seconds, go back to Flashduty. If the integration shows a Latest event time, the setup works.

Payload

Each Tailscale delivery is a JSON array that can carry several events. Flashduty handles every event that creates an alert separately: Every alert also has the label source=tailscale and a check label (key_expiry, approval, signature, user_approval, exit_node_ip_forwarding, or subnet_ip_forwarding). When message is empty, the title is Tailscale <event type>: <device or user>.

Alert key

Flashduty builds the Alert Key from the object (the device’s nodeID or the user’s user) and the check (check):
  • nodeNeedsApproval and nodeApproved for one device land on the same alert, which recovers when the device is approved
  • nodeKeyExpiringInOneDay and nodeKeyExpired for one device share an Alert Key. When the key expires, Flashduty opens a new Critical alert and keeps the earlier Warning alert open; nodeDeleted closes both
  • Different checks on one device (for example key expiry and pending approval) create separate alerts
  • Tailscale retries a failed delivery hourly for up to 24 hours; retried events merge into the original alert instead of creating duplicates
Renaming a device or the tailnet does not change the Alert Key.

Status and severity

If a device event that creates an alert has no data.nodeID, or a user event has no data.user, the whole request is rejected.

FAQ

Tailscale has no “key renewed” event. Turn on the channel’s auto-resolve timeout, or close the alert in Flashduty by hand. For servers that should not expire, you can also disable key expiry in Tailscale.
No. Flashduty identifies the integration by the integration_key in the push URL and does not verify the Tailscale-Webhook-Signature header. Keep the push URL as secret as a key.

Troubleshooting

  • Flashduty returns a parameter error: make sure Destination is None and the push URL is complete (it includes integration_key)
  • The test event succeeds but no alert appears: the test event creates no alert; make sure the endpoint subscribes to the events in the table above
  • The alert does not recover after the device is approved: make sure the endpoint subscribes to nodeApproved