FABRYKA.AISecure access kit · Linux

Private server bootstrap

Remote access,
properly private.

Add a Linux server to your Tailscale network and enable Tailscale SSH—without exposing port 22 to the public internet.

01

Interactive setup

Best for a one-off server. It adds this operator’s SSH public key as a root recovery path, then prints a Tailscale sign-in link for you to open in your browser.

curl -fsSL https://setup.fabryka.ai/install.sh | bash
02

Unattended setup

For a console without a browser. Create a reusable or ephemeral pre-auth key in the Tailscale admin console, then paste this command. The key is read silently, never put in a URL, and is not written by this installer.

read -rsp 'Tailscale auth key: ' TS_AUTHKEY; echo; export TS_AUTHKEY; curl -fsSL https://setup.fabryka.ai/install.sh | bash; unset TS_AUTHKEY

After the installer succeeds

Connect from a device in the same tailnet

tailscale ssh root@<machine-name>

The machine name and Tailscale IPv4 address are printed at the end. This does not edit OpenSSH or open public port 22. If you are currently connected through Tailscale on port 22, expect that session to hang when Tailscale SSH takes over.

Tailscale SSH policy required

Enabling the server is separate from authorizing access. If your tailnet has a custom policy, it must allow both network connectivity to port 22 and Tailscale SSH. For a personal, user-owned machine, Tailscale’s conservative SSH default is:

"ssh": [{
  "action": "check",
  "src": ["autogroup:member"],
  "dst": ["autogroup:self"],
  "users": ["root", "autogroup:nonroot"]
}]

Use a narrow group and tagged destination for shared or production servers; do not copy this fragment blindly into an existing policy. A custom network policy also needs a matching grant/ACL for TCP port 22.