kindle-pw6-tailscale

Run Tailscale natively on a jailbroken Kindle Paperwhite 6 (12th gen) — kernel-TUN mode, Tailscale SSH, and autostart on boot. No KOReader, no KUAL required.

🤖 AI-assisted setup (easiest path): clone this repo, plug your jailbroken Kindle in over USB, and ask your AI coding agent to set it up. Point it at AGENTS.md — it contains exact device facts, access methods, and the full procedure with verification gates. Manual steps below if you'd rather do it yourself.

What you get

• tailscaled running in kernel TUN mode (yes, /dev/net/tun exists and works on the PW6 — the userspace-networking mode that KOReader plugins use is not required here)
• tailscale ssh root@kindle from any machine on your tailnet
• Autostart on boot via a native upstart job — verified to survive a cold reboot
• MagicDNS enabled with --accept-dns
• On-device start/stop/status scriptlets in your documents folder

Requirements

• A jailbroken 12th-gen Kindle with a scriptlet runner (runs .sh files from the documents folder, as root) — the KMC-style jailbreaks from kindlemodding.org provide this. KUAL is not needed.
• A Tailscale account
• A computer to push files over USB (MTP) — Linux/macOS/Windows all fine

Manual setup

1. Get the binaries

Get the official static binaries from https://pkgs.tailscale.com/stable/#static and choose the arm build — 32-bit ARMv7, matching the PW6's Cortex-A7 (armv7l). Not arm64, not armhf:

tailscale_<version>_arm.tgz

Extract it. You need tailscaled and tailscale (~66 MB total). Tested with 1.102.2.

2. Create an auth key

https://login.tailscale.com/admin/settings/keys → generate a reusable, non-ephemeral key (tskey-auth-...). Save it in a file named auth.key (just the key text, no quotes).

3. Copy files to the Kindle

Plug in the Kindle. Using your MTP client of choice (Linux: gio copy, see AGENTS.md for the exact URI pattern; Windows/macOS: drag-and-drop in the file manager):

Source	Destination on Kindle ("Internal Storage")
tailscaled, tailscale (from step 1)	ts/bin/ (create folders)
auth.key (from step 2)	ts/auth.key
tailscaled.conf (this repo)	ts/tailscaled.conf
scriptlets/ts-*.sh (this repo)	documents/

4. Run the scriptlets on the Kindle

In your jailbreak's scriptlet runner, in order:

1. ts-recon (optional but recommended on non-PW6 devices) — writes a hardware/init report to documents/ts-recon.txt. Read it back over MTP. You want: scriptlets run as root, /dev/net/tun present, upstart present, mntroot rw works.
2. ts-install — creates /var/local/tailscale (persistent state dir) and imports identity/auth key if you happen to have the KOReader plugin installed.
3. ts-start — starts tailscaled and runs tailscale up --ssh --accept-dns. Screen should end with a peer table and a 100.x.y.z IP.
4. ts-status — anytime you want to check; holds output for 5s.

5. Enable Tailscale SSH on your tailnet

Add an ssh section to your tailnet policy (https://login.tailscale.com/admin/acls):

"ssh": [
  {
    "action": "accept",
    "src":    ["autogroup:member"],
    "dst":    ["autogroup:self"],
    "users":  ["autogroup:nonroot", "root"]
  }
]

Then from any tailnet machine: tailscale ssh root@kindle

6. Install boot autostart

Over SSH (or paste into a scriptlet):

mntroot rw
cp /mnt/us/ts/tailscaled.conf /etc/upstart/tailscaled.conf
mntroot ro
initctl reload-configuration   # may be unnecessary; harmless
initctl start tailscaled

The job starts on framework_ready (same late-boot event the jailbreak itself uses) and respawns the daemon if it dies.

7. Reboot test

Restart the Kindle. Within ~30 s of the home screen appearing (and WiFi connecting), tailscale status on your computer should show kindle online, and SSH should work — no tapping required.

8. Admin console housekeeping

Machines → kindle → Disable key expiry, or the node silently drops off the tailnet after the default expiry period.

Notes & caveats

• Deep sleep: the Kindle turns off WiFi when suspended. It shows offline while asleep and reconnects seconds after you wake it. Normal, not a bug.
• OTA firmware updates wipe the rootfs, which deletes /etc/upstart/tailscaled.conf. Everything else lives on /mnt/us and /var/local and survives. Recovery: repeat step 6. (Most jailbreak setups block OTA anyway.)
• KOReader tailscale plugin: don't run both. Its start script does killall tailscaled and its uninstaller deletes its own binaries. If you have it, uninstall it — this repo replaces it and works everywhere, not just inside KOReader.
• Where things live:
  • binaries: /mnt/us/ts/bin/ (USB storage, 11+ GB, executable)
  • state: /var/local/tailscale/ (persistent ext4 — /mnt/us can't chmod, which tailscaled requires of its state dir; /var is tmpfs and would lose identity on reboot)
  • upstart job: /etc/upstart/tailscaled.conf
  • logs: /mnt/us/ts/tailscaled-boot.log
• If /dev/net/tun is missing on some other Kindle model: fall back to --tun=userspace-networking (see the KOReader plugin's start_tailscale.sh for a reference), but know that inbound connections and Tailscale SSH do not work in that mode — outbound only, via its SOCKS5 proxy.

Files

tailscaled.conf        upstart job (→ /etc/upstart/)
scriptlets/
  ts-recon.sh          device capability report → documents/ts-recon.txt
  ts-install.sh        one-time: state dir + identity/auth-key import
  ts-start.sh          start (upstart-aware) + tailscale up --ssh
  ts-stop.sh           stop (upstart-aware)
  ts-status.sh         status + tailnet IP, holds 5s for on-screen reading