headplane-agent requires new pre-auth keys at each reboot

[RJDavison]

Description

headplane-agent fails after each reboot requiring new pre-auth keys

headplane | 2025-10-30T20:35:44.578Z [agent] INFO: Headplane agent started
headplane | 2025-10-30T20:35:44.632Z [agent] INFO: tsnet running state path /var/lib/headplane/agent/tailscaled.state
headplane | 2025-10-30T20:35:44.633Z [agent] INFO: tsnet starting with hostname "headplane-agent", varRoot "/var/lib/headplane/agent"
headplane | 2025-10-30T20:35:44.634Z [agent] INFO: Authkey is set; but state is NoState. Ignoring authkey. Re-run with TSNET_FORCE_LOGIN=1 to force use of authkey.
headplane | 2025-10-30T20:35:44.786Z [agent] WARN: Headplane agent exited with code 1 and signal undefined
headplane | 2025-10-30T20:35:44.787Z [agent] WARN: Headplane agent will restart in 296.514 seconds (attempt 40)

Headplane Version

0.6.1

Headscale Version

0.27.0

[tale]

This doesn't sound like a bug, it sounds like the pre-auth key you supplied is not reusable.

[LorenDB]

Why does the agent need a pre-auth key at every start? I'd think the agent could join the tailnet and then persist like a normal Tailscale connection.

[tale]

Is it not a reusable pre-auth-key? That should prevent a new one from being required constantly, along with making sure the folder that the Headplane agent uses to store its state is persisted if in Docker.

[LorenDB]

I don't think the reusable key is a good idea, because that technically opens a security hole to anyone who brute forces auth keys (plus I don't love having a persistent key hanging around in the UI).