Unable to use dedicated Tailscale node

[lnlyssg]

I've run the installer on an Ubuntu machine but I'm getting an error failed to create tsnet state directory: mkdir /root/.config: read-only file system I'm not sure why it's trying to create the dir though as it already exists.....

❯ curl -sL https://netrono.me/install-agent | sudo bash
===================================
Netronome Agent Installation Script
===================================

Checking dependencies...

Available network interfaces:
 1. enp0s3
 2. br-15c0ab620114
 3. docker0
 4. tailscale0
 5. veth107aec1@if2
 6. veth7c4711a@if2
 7. veth7044867@if2

Type the interface name from the list above (e.g., eth0, ens18, etc.)
Enter the interface name to monitor (leave empty for all):

Tailscale Configuration (optional):
Tailscale provides secure, encrypted connectivity without exposing ports to the internet.

Do you want to enable Tailscale for secure connectivity? (y/n): y

Tailscale Method:
1. Use host's existing Tailscale (no new machine in Tailscale admin)
2. Create dedicated Tailscale node (requires auth key)

Select method [1-2]: 2

Enter your Tailscale auth key (required): tskey-auth-xxxxxxxx

Enter custom Tailscale hostname (leave empty for default):

✓ Tailscale authentication enabled - no API key needed

Enter the host/IP to listen on (default: 0.0.0.0):
Enter the port number (default: 8200):

Disk Monitoring Configuration (optional):
You can specify additional disk mounts to monitor or exclude certain mounts.

Enter disk mounts to include (comma-separated, e.g., /mnt/storage,/mnt/backup):
Enter disk mounts to exclude (comma-separated, e.g., /boot,/tmp):

Creating directories...

Installing Netronome agent...
Downloading from: https://github.com/autobrr/netronome/releases/download/v0.11.0/netronome_0.11.0_linux_arm64.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100 22.7M  100 22.7M    0     0  36.4M      0 --:--:-- --:--:-- --:--:-- 36.4M

Creating configuration...

Creating service...

Starting service...
Created symlink /etc/systemd/system/multi-user.target.wants/netronome-agent.service → /etc/systemd/system/netronome-agent.service.

✅ Netronome Agent installed and started successfully!

===================================
Agent Information:
===================================
URL: http://0.0.0.0:8200

Add this agent in Netronome with the above URL and API key.

===================================
Useful Commands:
===================================
View logs:        journalctl -u netronome-agent -f
Check status:     systemctl status netronome-agent
Restart service:  systemctl restart netronome-agent
Stop service:     systemctl stop netronome-agent
Update agent:     sudo /opt/netronome/netronome update
Check version:    /opt/netronome/netronome version
Uninstall agent:  curl -sL https://raw.githubusercontent.com/autobrr/netronome/main/scripts/install-agent.sh | bash -s -- --uninstall


Would you like to enable automatic daily updates? (y/n): y

Setting up automatic updates...
Created symlink /etc/systemd/system/timers.target.wants/netronome-agent-update.timer → /etc/systemd/system/netronome-agent-update.timer.
✅ Automatic daily updates enabled!
Updates will run daily with a random delay of up to 4 hours.
Check update timer: systemctl status netronome-agent-update.timer
Check last update: journalctl -u netronome-agent-update
❯ tail -f /var/log/syslog
Apr  8 20:07:24 social netronome[1722718]:       --tailscale                    enable Tailscale for secure connectivity
Apr  8 20:07:24 social netronome[1722718]:       --tailscale-auth-key string    Tailscale auth key for automatic registration
Apr  8 20:07:24 social netronome[1722718]:       --tailscale-hostname string    custom Tailscale hostname (default: netronome-agent-<hostname>)
Apr  8 20:07:24 social netronome[1722718]:       --tailscale-method string      Tailscale method: auto, host, or tsnet (default: auto) (default "auto")
Apr  8 20:07:24 social netronome[1722718]:       --tailscale-state-dir string   directory for Tailscale state (default: ~/.config/netronome/tsnet)
Apr  8 20:07:24 social netronome[1722718]: Global Flags:
Apr  8 20:07:24 social netronome[1722718]:       --config string   path to config file
Apr  8 20:07:24 social netronome[1722718]: failed to create tsnet state directory: mkdir /root/.config: read-only file system
Apr  8 20:07:24 social systemd[1]: netronome-agent.service: Main process exited, code=exited, status=1/FAILURE
Apr  8 20:07:24 social systemd[1]: netronome-agent.service: Failed with result 'exit-code'.

[lnlyssg]

I was able to resolve this with some help from Claude, here's what it suggests:

When running the agent as a systemd service with ProtectSystem=strict hardening, the agent fails to start with:
failed to create tsnet state directory: mkdir /root/.config: read-only file system

The root cause is in startWithTailscale in internal/agent/agent.go:

goif err := os.MkdirAll(stateDir, 0755); err != nil {
    return fmt.Errorf("failed to create tsnet state directory: %w", err)
}

When state_dir is the default ~/.config/netronome/tsnet, MkdirAll attempts to create every component of the path including /root/.config, which is made read-only by ProtectSystem=strict even if it already exists on the real filesystem.

Workaround: Set NETRONOME__TAILSCALE_STATE_DIR to an absolute path outside of /root, e.g. /var/lib/netronome/tsnet, either in the config or as an environment variable in the systemd unit.

Suggested fix: The default state_dir should be /var/lib/netronome/tsnet (or similar) rather than ~/.config/netronome/tsnet, as the latter is unsuitable for a process running under typical systemd hardening. Alternatively, the install script / packaged systemd unit should set StateDirectory=netronome and default state_dir accordingly.