Tailscale
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/tailscale-connector
Tailscale
Give every Cinatra dev instance a deterministic public URL through your tailnet. Once set up, each clone automatically gets a Tailscale Funnel URL (e.g. https://my-clone.acme.ts.net) so webhooks, OAuth callbacks, and MCP clients reach your instance without configuring a tunnel each session.
Setup (recommended — OAuth client): In the connector settings, choose OAuth client. In Tailscale, open Trust credentials (login.tailscale.com/admin/settings/trust-credentials), add a Credential → OAuth with Keys (auth_keys) = Write, attach your clone tag (for example, tag:cinatra-clone), and Generate credential. Back in Cinatra, click Connect OAuth client and enter the client ID + secret in the connection service dialog. An OAuth client has no 90-day expiry.
Setup (API access token): Alternatively, paste a Tailscale API access token (tskey-api-…) and choose the same clone tag. API tokens expire after up to 90 days; the connector reminds you as expiry approaches.
Security model: Both modes require a tagOwners entry for your clone tag in the tailnet policy (e.g. owner autogroup:admin). Credentials live in the connection service (Nango); the OAuth secret stays there and is never read by Cinatra or its clones. Each clone mints its own short-lived, tag-scoped, per-node auth-key at start through that service.
Troubleshooting: If connection fails, regenerate the credential and confirm its auth_keys Write scope (OAuth) or Tags scope (API token) matches the tag. If Tailscale rejects the tag (tailscale.tag_denied), confirm it appears under tagOwners in your ACL policy. Detailed error codes go to the server logs.
Works with
- Tailscale (tailnet — any paid or personal plan with API access enabled)
- Cinatra connection service (stores the API token and OAuth credentials)
Capabilities
- Provision a deterministic Funnel URL per dev instance so webhooks, OAuth callbacks, and MCP clients reach it without manual tunnel setup
- Mint per-clone, tag-scoped ephemeral auth-keys automatically on clone start
- Connect via a no-expiry OAuth client (secret stays in the connection service) or a Tailscale API access token
- Display the predicted Funnel URL in the dev tab before the sidecar is provisioned
- Show the tailnet name, clone tag, auth mode, and token expiry reminder in the status view
- Disconnect and remove credential storage from the connection service in one action
- fix: declared cinatra.vendor identity ahead of a marketplace re-submit (#38)
- chore: stripped private tracker references from public source (#35)
- feat: OAuth-client auth mode via the Nango Connect UI ("Design C", shipped flag-off) (#26, #32)
- docs: updated OAuth setup copy for the Trust-credentials flow; expanded README to the org standard (#34, #28)
- ci: ramped the raw-JSX lint block to error and re-vendored the UI-gate preset with the dynamic-import ban; adopted source-leak-gate (#29, #33, #30, #31)
- feat: inline reminder before the 90-day API token expires (#25)
- ci: added the truthful-attribution gate (advisory/WARN mode); adopted the reusable extension→host IoC conformance gate, the tag-driven GitHub release workflow, and secret-scan-gate (#18, #19, #20, #21)
- feat: self-registration at serverEntry activation via capability services; friendlier operation-specific error copy instead of raw action errors; dev-tunnel-status capability registration; dev CLI modules declared in the extension manifest (#6, #7, #10, #14)
- chore: adopted source-leak-gate, SHA-pinned org gate callers, npm packaging hygiene, Renovate config, reusable release-workflow pinning (#1–#5, #8, #9, #11–#13, #15, #16)
- Initial release.
- Unreleased
- chore: stripped private tracker references from workflow comments; pinned the reusable extension-release workflow to the gated version (release-approval wall); declared cinatra.consumes for closure-gate enrollment (#39, #40, #41)
More from Cinatra
Run an outbound email campaign from scratch in one guided flow. The agent walks you through setting up the campaign, confirming recipients, picking drafting…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/email-outreach-agent
A hero or inline illustration produced for a blog article. Blog Images are deliberately "article art" — composed, brand-consistent, intentionally illustrative — and kept…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/blog-image-artifact
Point this agent at a handful of web pages and a description of the shape of data you want — company directories, event speaker…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/web-scrape-agent
A security-review helper that sits beside the agent-authoring chat experience. It reads a draft agent definition and flags the fuzzy risks a deterministic linter…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/security-reviewer-agent
Renders data charts in the Cinatra chat surface. Agents describe a chart as a small data spec — a type (bar, line, or area),…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/chart-artifact
Point this agent at a YouTube channel URL or a podcast website and get back a clean list of its videos or episodes. It…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/media-feed-lister-agent
Reviews
There are no reviews yet.