Tailscale died while you're traveling

Same hotel feeling, three different problems

Before you rebuild anything, sort out what's actually failing. Same three cases as when the box goes dark:

• Dead hardware: power, SD card, or a wedged OS. Nothing local answers.
• Flaky path: the box is fine, but the shop Wi‑Fi or the ISP isn't.
• Dead Tailscale auth: the machine's fine on site; there's just nothing remote until someone signs it back in.

Hotel Wi‑Fi can't tell those apart. Your break-glass plan can.

What still works when you're not there

1. A neighbor or a key. Who has a key or code? Who can sit in front of the box? Write that name down before you leave town, not in the middle of a panic thread.
2. A smart plug, if you already trust it. Remote power-cycling can clear a wedged OS, but it won't fix expired Tailscale auth by itself. After power comes back, someone may still need to sign in once — unless you already set up unattended start after reboot.
3. A second node. Another always-on device on the same LAN — a spare Pi, a second shop PC — already on Tailscale. If the primary is dark but the second node answers, you still have a foothold, and often a way to check whether the site's internet is even alive.
4. A one-pager. Who, where, and what to try first, with pointers to where secrets live (your password manager) — not passwords photographed on a sticky note. This is the pack's break-glass chapter, in plain language.

Try this order first

1. Power and local life. Can someone on site see lights, a local screen, or log in at the keyboard?
2. Whole-site internet. Are phones on the shop Wi‑Fi failing too? Fix the path before you blame Tailscale.
3. Did the Healthchecks shout fire? A dead-man email means the box stopped checking in — not that Tailscale or a camera app is healthy (email when the box dies).
4. Check the Tailscale admin. Is the node online? Does it need re-auth? Was it disabled?
5. Walk or send someone. If there's no power, no local life, and both remote and local access fail on something that matters today, that's when you use the keys and the on-site bag. Set a cap on how many minutes you'll burn remotely before you call it.

Stop guessing. Write down what you actually observed — your site name, your box's hostname, your people.

What this is not

• Not opening a WAN port "just until I get home"
• Not Ring or cloud cams as your always-on box (wrong target)
• Not me on-call at 2 a.m. from Edmond
• Not pasting Tailscale auth keys into a group text