Tailscale Device Cleanup Digest for Slack and Linear

PromptCreate

Every Monday at 8am, review my whole Tailscale tailnet for hygiene problems and give me a prioritized action list instead of a raw dump.

Start by pulling the full picture. Use the Tailscale List tailnet devices operation requesting all fields, so you get the complete field set including last seen time, creation date, owner, tags, whether key expiry is disabled, and whether the device is ephemeral. Then use List tailnet keys to get every auth key in the tailnet. If you need to confirm details on a specific device before judging it, use Get a device.

From that data, work out four things: which devices have not checked in for more than 30 days, which devices have key expiry disabled, which devices are ephemeral leftovers that should have cleaned themselves up, and which auth keys are close to their expiry date or already stale. Device freshness comes from the lastSeen and created timestamps.

Judge each finding in context rather than flagging everything that matches a rule. A tagged server with key expiry disabled on purpose is fine and should not be treated as an incident. A personal laptop that vanished six weeks ago is a real problem. Use the device tags, the owner, and the naming pattern to tell managed infrastructure apart from personal machines.

Post a ranked digest to my Slack channel using the Slack Bot Send a Message operation, grouped into three sections: revoke now, check with owner, and safe to ignore. Include the device name, owner, last seen date, and tags on every line so I can act without opening the admin console. Order each group so the most urgent item comes first, and say briefly why each item landed in the group it did.

Then, for each item in the revoke now group, open a Linear issue using Create Issue so the cleanup actually gets tracked. Give each issue a clear title naming the device or key, and put the owner, last seen date, tags, and the reason it was flagged in the description. Do not open issues for the check with owner or safe to ignore groups.

What does this prompt do?

Checks every device on your Tailscale network once a week and works out which ones have gone quiet, which never expire their access, and which were meant to be temporary but stuck around.
Reviews your access keys for ones that are close to expiring or have been sitting unused for too long.
Sorts findings into revoke now, check with owner, and safe to ignore, so an intentionally long-lived server does not get treated the same as a laptop that vanished six weeks ago.
Posts the ranked list to a Slack channel and opens a Linear ticket for each urgent item so the cleanup actually gets followed through.

What do I need to use this?

A Tailscale account with admin access to the network you want reviewed.
A Slack workspace and a channel where the weekly digest should land.
A Linear workspace and the team that should own the cleanup tickets.

How can I customize it?

Change the schedule. Monday at 8am is just a starting point, and monthly works well for smaller networks.
Adjust the thresholds, like treating 60 days of silence as stale instead of 30, or flagging keys further ahead of their expiry date.
Tell it which tags or naming patterns mark intentional always-on servers so they stay in the safe to ignore group.

FAQs

Will this remove devices or revoke keys on its own?

No. It only reads your network and reports what it finds. Removing a device or revoking a key stays a manual decision you make after reading the digest, which is why the urgent items become tickets rather than actions.

How does it tell a long-lived server apart from a forgotten laptop?

It looks at the tags, the owner, and the naming pattern on each device. A tagged server that is deliberately set to never expire gets grouped as safe to ignore, while an untagged personal machine that has not appeared in six weeks gets flagged for removal.

What if we do not use Linear?

The Slack digest still works on its own. You can point the ticket step at a different tracker you already use, or drop it entirely and keep just the weekly summary.

Will this still be readable if we have hundreds of devices?

Yes. That is the point of the grouping and ranking. Instead of a full inventory dump you get a short revoke now list at the top, a middle group worth a quick question, and everything else tucked into safe to ignore.

Can the digest go to a private channel?

Yes. It can post to any channel you choose, including a private security or infrastructure channel, so device owners and access details are not shared workspace wide.