state: stop expiring tagged nodes on logout

tailscale logout sends a past-dated RegisterRequest; handleLogout stamped
that expiry on the node with no IsTagged guard. Tagged nodes have key
expiry permanently disabled (KB 1068), so the stamp left them IsExpired
forever: re-registration kept the stale expiry, the client saw
NodeKeyExpired, rotated its key and retried with a now-spent key ->
authkey already used, forever (or an interactive hang).

Guard handleLogout so a tagged node is never stamped. Defensively clear a
stale past expiry on re-registration (both the pre-auth-key and auth
paths), scoped to IsExpired() so a deliberate future expiry from
headscale nodes expire survives, and exclude tagged nodes from the
expired-node re-validation gate so a spent key is not re-checked.

Fixes #3371

Author: kradalby

CHANGELOG.md

@@ -44,6 +44,7 @@ keys remain all-access.
 
 - Expiring or deleting a non-existent pre-auth key now returns an error instead of silently succeeding [#3324](https://github.com/juanfont/headscale/pull/3324)
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
+- A tagged node can re-authenticate after `tailscale logout` again: logout no longer stamps a key expiry on a tagged node, and a stale expiry left by an older version is cleared on re-registration [#3371](https://github.com/juanfont/headscale/issues/3371)
 
 ## 0.29.2 (2026-07-01)
 

hscontrol/auth.go

@@ -233,6 +233,20 @@ func (h *Headscale) handleLogout(
 			Msg("Node is not ephemeral, setting expiry instead of deleting")
 	}
 
+	// Tagged nodes have key expiry permanently disabled (they are owned by
+	// their tags, not a user, and never expire - KB 1068). Logging one out has
+	// no expiry semantics, so do not stamp an expiry on it: doing so leaves the
+	// node IsExpired() forever and it can never re-authenticate (#3371). The
+	// admin path `headscale nodes expire` remains free to set a deliberate
+	// expiry via SetNodeExpiry; only the logout path is guarded here.
+	if node.IsTagged() {
+		log.Debug().
+			EmbedObject(node).
+			Msg("Tagged node logout: not stamping expiry (tagged nodes never expire)")
+
+		return nodeToRegisterResponse(node), nil
+	}
+
 	// Update the internal state with the nodes new expiry, meaning it is
 	// logged out.
 	//