Connect your device to the Skyfillers network

Downloads

• Root certificate (skyfillers-root.crt)
• Tailscale settings (skyfillers-tailscale.reg): our server, and no link to Tailscale's admin console
• Tailscale 1.104.5 for Windows (x64), SHA-256 3C41318C83C5D95D0B017B1BAA08BA7C99FD5334166122BBB1931E55AF99839C
• Tailscale 1.104.5 for Windows on Arm, SHA-256 609982DE4DFE70B67A02E2A93C9C5C1DFA20ADDCEB33A7D3B144F1D34D98F5FC

Set up

1. Open Start, type PowerShell and choose Run as administrator.
2. Paste these lines and press Enter. They check and install the root certificate, our Tailscale settings and Tailscale itself, and turn off Tailscale's telemetry.

   $ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue'
   [Net.ServicePointManager]::SecurityProtocol = 'Tls12'
   $d = $env:TEMP
   $arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'amd64' }
   $sha  = @{ amd64 = '3C41318C83C5D95D0B017B1BAA08BA7C99FD5334166122BBB1931E55AF99839C'; arm64 = '609982DE4DFE70B67A02E2A93C9C5C1DFA20ADDCEB33A7D3B144F1D34D98F5FC' }
   Invoke-WebRequest https://connect.skyfillers.com/skyfillers-root.crt -OutFile "$d\skyfillers-root.crt"
   if ((Get-PfxCertificate "$d\skyfillers-root.crt").Thumbprint -ne '9E082BA256594B1BC728D174D1DEAF04030E8961') { throw 'Wrong root certificate: stop and ask IT' }
   certutil -addstore -f Root "$d\skyfillers-root.crt"
   Invoke-WebRequest https://connect.skyfillers.com/skyfillers-tailscale.reg -OutFile "$d\skyfillers-tailscale.reg"
   reg import "$d\skyfillers-tailscale.reg"
   Invoke-WebRequest "https://pkgs.tailscale.com/stable/tailscale-setup-1.104.5-$arch.msi" -OutFile "$d\tailscale.msi"
   if ((Get-FileHash "$d\tailscale.msi").Hash -ne $sha[$arch]) { throw 'Wrong Tailscale installer: stop and ask IT' }
   Start-Process msiexec.exe -ArgumentList '/i', "`"$d\tailscale.msi`"", '/quiet' -Wait
   Set-Content "$env:ProgramData\Tailscale\tailscaled-env.txt" 'TS_NO_LOGS_NO_SUPPORT=true'
   Restart-Service Tailscale

3. Start Tailscale from the Start menu if its icon is not in the taskbar (look under ^). Click the icon and choose Log in. Your browser opens the Skyfillers sign-in.

Downloads

• Skyfillers profile for the Mac (skyfillers-mac.mobileconfig): the root certificate and our Tailscale settings
• Tailscale 1.104.5 for macOS (Standalone, .pkg), SHA-256 F1A2AFB589DC16487CFF9F23C59D0021A1A4DCF8476D2637AB493C628422B810, or Tailscale in the Mac App Store

Set up

1. Download the profile, then open System Settings → General → Device Management (macOS 12: System Preferences → Profiles). Double-click Skyfillers: root certificate and Tailscale, choose Install and enter your Mac password. It must show Verified and connect.skyfillers.com.
2. Install Tailscale: open the downloaded .pkg and follow the installer. Allow the system extension and the VPN configuration when macOS asks.
3. Click the Tailscale icon in the menu bar and choose Log in. Your browser opens the Skyfillers sign-in.

Tailscale opens its own sign-in page instead of Skyfillers'? Hold Option, click the Tailscale icon and choose Debug → Custom Login Server → Add Account…. Enter https://hs.skyfillers.com and press Add Account. After you have signed in, turn on Use Tailscale subnets in the same menu.

On a computer? Scan this with the iPhone's camera.

1. Open this page in Safari: other browsers cannot install profiles. Tap Download the Skyfillers profile, then Allow.
2. Open Settings → Profile Downloaded, tap Install and enter your passcode. The profile must show Verified and connect.skyfillers.com.
3. Open Settings → General → About → Certificate Trust Settings, turn on Skyfillers Root CA and tap Continue. Don't skip this: installing the profile is not enough, and without full trust Tailscale's Log in does nothing. To check, open https://hs.skyfillers.com/health in Safari: it must open without a warning.
4. Install Tailscale from the App Store.
5. Open Tailscale, tap the account icon at the top right and choose Log in…. Then tap the options menu at the top right, choose Use custom coordination server and enter https://hs.skyfillers.com.
6. Sign in on the Skyfillers page and allow the VPN configuration.

On a computer? Scan this with the phone's camera.

1. Tap Download the root certificate. If Android does not offer to install it: open Settings, search for CA certificate, choose Install anyway and pick skyfillers-root.crt from your downloads.
2. Install Tailscale from Google Play.
3. Open Tailscale. Before you sign in, open the settings at the top right, tap Accounts, open the menu ⋮, choose Use an alternate server and enter https://hs.skyfillers.com.
4. Sign in on the Skyfillers page and allow the VPN connection.

In a terminal, as a user with sudo rights:

sudo apt-get update && sudo apt-get install -y curl ca-certificates openssl
curl -fsSLO https://connect.skyfillers.com/skyfillers-root.crt
openssl x509 -noout -fingerprint -sha256 -in skyfillers-root.crt   # must match the SHA-256 fingerprint above
sudo cp skyfillers-root.crt /usr/local/share/ca-certificates/ && sudo update-ca-certificates
. /etc/os-release; CODENAME=${VERSION_CODENAME:-$UBUNTU_CODENAME}
curl -fsSL "https://pkgs.tailscale.com/stable/${ID}/${CODENAME}.noarmor.gpg" \
  | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL "https://pkgs.tailscale.com/stable/${ID}/${CODENAME}.tailscale-keyring.list" \
  | sudo tee /etc/apt/sources.list.d/tailscale.list
sudo apt-get update && sudo apt-get install -y tailscale
echo 'TS_NO_LOGS_NO_SUPPORT=true' | sudo tee -a /etc/default/tailscaled && sudo systemctl restart tailscaled
sudo tailscale up --login-server https://hs.skyfillers.com --accept-routes

tailscale up prints a link: open it and sign in on the Skyfillers page. On other distributions, install Tailscale from Tailscale's packages, then run the certificate, telemetry and tailscale up lines.