RDP via Tailscale - GitHub Actions Workflow

Overview

This is a GitHub Actions workflow that automates the setup of a secure Remote Desktop Protocol (RDP) connection on a Windows Server using Tailscale. The workflow creates a temporary RDP server, generates a secure user account, and provides remote access through Tailscale's secure network.

What This Workflow Does

The workflow performs the following steps:

1. Configure Core RDP Settings - Enables Remote Desktop Protocol on Windows Server 2025 and configures security settings
2. Create RDP User - Generates a local user account with a cryptographically secure random password
3. Install Tailscale - Downloads and silently installs the Tailscale VPN client
4. Establish Tailscale Connection - Authenticates and connects the runner to your Tailscale network
5. Verify RDP Accessibility - Tests the RDP connection to ensure it's working properly
6. Maintain Connection - Keeps the connection active until manually cancelled

Prerequisites

Before using this workflow, you need:

1. GitHub Repository - A repository with access to GitHub Actions
2. Tailscale Account - A free or paid Tailscale account
3. Tailscale Auth Key - Generate an authentication key from your Tailscale admin console
4. GitHub Secret - Store your Tailscale auth key as a repository secret named TAILSCALE_AUTH_KEY

Setting Up the Tailscale Auth Key

1. Visit https://login.tailscale.com/admin
2. Navigate to Settings → Keys
3. Generate a new Auth key
4. In your GitHub repository, go to Settings → Secrets and variables → Actions
5. Click New repository secret
6. Name it TAILSCALE_AUTH_KEY and paste the key value

How to Run

1. Go to your GitHub repository
2. Click on the Actions tab
3. Select the RDP workflow from the left sidebar
4. Click Run workflow button
5. Select the branch where the workflow is stored
6. Click Run workflow

The workflow will start immediately and display:

• Tailscale IP address
• Username: RDP
• Password: (automatically generated and secure)

Connection Details

Once the workflow is running, you'll see the connection information:

=== RDP ACCESS ===
Address: [Tailscale IP address]
User: RDP
Password: [Generated secure password]
==================

Connecting via RDP

Windows:

mstsc /v:[Tailscale_IP_Address]

macOS/Linux:

• Install Microsoft Remote Desktop from the App Store or Microsoft's official repository
• Enter the Tailscale IP address
• Use username: RDP and the generated password

Technical Details

Security Features

• Secure Password Generation - Uses cryptographic randomization with uppercase, lowercase, numbers, and special characters
• Tailscale Encryption - All connections are encrypted through Tailscale's WireGuard-based VPN
• No Direct Internet Exposure - RDP is only accessible through Tailscale, not exposed to the public internet
• Admin Access - The RDP user is added to the Administrators and Remote Desktop Users groups
• Temporary Nature - The connection is temporary and can be cancelled anytime via GitHub Actions

System Requirements

• OS - Windows Server 2025 (managed by GitHub Actions)
• Timeout - Maximum 60 minutes (3600 seconds) per workflow run
• Port - Uses standard RDP port 3389 through Tailscale

Troubleshooting

"Tailscale Auth Key not found"

• Ensure TAILSCALE_AUTH_KEY secret is properly configured in repository settings

"Failed to establish Tailscale connection"

• Verify your auth key is valid and hasn't expired
• Check that your Tailscale account is active

"TCP connection to RDP port failed"

• Wait a few seconds for the RDP service to fully start
• Check the workflow logs for any error messages

"Cannot connect to the RDP address"

• Ensure you're using the correct Tailscale IP address from the workflow output
• Verify you're connected to the same Tailscale network
• Check firewall settings on your local machine

Stopping the Workflow

To stop the RDP session:

1. Go to Actions tab in GitHub
2. Click on the running workflow
3. Click Cancel workflow button

The RDP connection will be terminated immediately.

Important Notes

⚠️ Security Considerations:

• This workflow creates an active RDP server - use with caution
• The password is randomly generated and secure, but unique per session
• Always cancel the workflow when no longer needed to avoid unnecessary resource usage
• The connection is accessible to anyone with the Tailscale IP address - share credentials carefully

⚠️ Costs:

• GitHub Actions has free tier limits - check your account's remaining minutes
• Tailscale is free for personal use (up to 3 devices)

Support

For issues with:

• Tailscale - Visit https://tailscale.com/help
• GitHub Actions - Check GitHub Actions documentation
• RDP - Refer to Microsoft Remote Desktop documentation

License

This workflow is provided as-is for educational and personal use.