Tailscale
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/tailscale-connector
Tailscale
Give every Cinatra dev instance a deterministic public URL through your tailnet. Once set up, each clone automatically gets a Tailscale Funnel URL (e.g. https://my-clone.acme.ts.net) so webhooks, OAuth callbacks, and MCP clients reach your instance without configuring a tunnel each session.
Setup (recommended — OAuth client): In the connector settings, choose OAuth client. In Tailscale, open Trust credentials (login.tailscale.com/admin/settings/trust-credentials), add a Credential → OAuth with Keys (auth_keys) = Write, attach your clone tag (for example, tag:cinatra-clone), and Generate credential. Back in Cinatra, click Connect OAuth client and enter the client ID + secret in the connection service dialog. An OAuth client has no 90-day expiry.
Setup (API access token): Alternatively, paste a Tailscale API access token (tskey-api-…) and choose the same clone tag. API tokens expire after up to 90 days; the connector reminds you as expiry approaches.
Security model: Both modes require a tagOwners entry for your clone tag in the tailnet policy (e.g. owner autogroup:admin). Credentials live in the connection service (Nango); the OAuth secret stays there and is never read by Cinatra or its clones. Each clone mints its own short-lived, tag-scoped, per-node auth-key at start through that service.
Troubleshooting: If connection fails, regenerate the credential and confirm its auth_keys Write scope (OAuth) or Tags scope (API token) matches the tag. If Tailscale rejects the tag (tailscale.tag_denied), confirm it appears under tagOwners in your ACL policy. Detailed error codes go to the server logs.
Works with
- Tailscale (tailnet — any paid or personal plan with API access enabled)
- Cinatra connection service (stores the API token and OAuth credentials)
Capabilities
- Provision a deterministic Funnel URL per dev instance so webhooks, OAuth callbacks, and MCP clients reach it without manual tunnel setup
- Mint per-clone, tag-scoped ephemeral auth-keys automatically on clone start
- Connect via a no-expiry OAuth client (secret stays in the connection service) or a Tailscale API access token
- Display the predicted Funnel URL in the dev tab before the sidecar is provisioned
- Show the tailnet name, clone tag, auth mode, and token expiry reminder in the status view
- Disconnect and remove credential storage from the connection service in one action
- fix: declared cinatra.vendor identity ahead of a marketplace re-submit (#38)
- chore: stripped private tracker references from public source (#35)
- feat: OAuth-client auth mode via the Nango Connect UI ("Design C", shipped flag-off) (#26, #32)
- docs: updated OAuth setup copy for the Trust-credentials flow; expanded README to the org standard (#34, #28)
- ci: ramped the raw-JSX lint block to error and re-vendored the UI-gate preset with the dynamic-import ban; adopted source-leak-gate (#29, #33, #30, #31)
- feat: inline reminder before the 90-day API token expires (#25)
- ci: added the truthful-attribution gate (advisory/WARN mode); adopted the reusable extension→host IoC conformance gate, the tag-driven GitHub release workflow, and secret-scan-gate (#18, #19, #20, #21)
- feat: self-registration at serverEntry activation via capability services; friendlier operation-specific error copy instead of raw action errors; dev-tunnel-status capability registration; dev CLI modules declared in the extension manifest (#6, #7, #10, #14)
- chore: adopted source-leak-gate, SHA-pinned org gate callers, npm packaging hygiene, Renovate config, reusable release-workflow pinning (#1–#5, #8, #9, #11–#13, #15, #16)
- Initial release.
- Unreleased
- chore: stripped private tracker references from workflow comments; pinned the reusable extension-release workflow to the gated version (release-approval wall); declared cinatra.consumes for closure-gate enrollment (#39, #40, #41)
More from Cinatra
The centralized credential vault that the rest of your connectors quietly rely on. Configure it once and every other connector — Gmail, Calendar, GitHub,…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/nango-connector
The built-in fallback type that guarantees every item in the library has at least one valid classification. When a file, connector reference, or dashboard…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/default-artifact
Send mail from your Gmail account through Cinatra and pick up the replies. Each user connects their own Google account, and Cinatra agents that…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/gmail-connector
Set up Google sign-in for your workspace and connect every Google-backed service through a single shared OAuth client. One Google Cloud project, configured once,…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/google-oauth-connector
Draft a follow-up sequence for recipients who did not reply to the initial outreach. The agent writes a cadence of follow-up emails, each spaced…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/email-follow-up-agent
Turn a company name or website into one clean, deduplicated account in your workspace. Hand the agent whatever you know — a name, a…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/company-discovery-agent
Reviews
There are no reviews yet.