An SSH Key to Home in My Pocket Pi Zero + Tailscale

The problem

I have a Tailscale network for my home network, and I needed a reliable way to SSH into it without having to install Tailscale on whatever machine I happened to be sitting at.

Docker could work, but there’s some startup cost to that on a blank machine. Not to mention it needs Docker installed in the first place.

The big one for me was my work laptop. I didn’t want Tailscale on it, because I like keeping my work computer and my home computer separate. But I still wanted a way to log in to my home PC while I’m at the office.

The solution: a Pi Zero on a USB cable

In the end I settled on a Pi Zero with Tailscale configured on it. I set it up as a USB Ethernet gadget, so I can plug it into any machine and get an SSH client that tunnels into my home network.

The laptop only ever sees a little USB network device. Tailscale, the keys and the home network all live on the Pi, and come back out of my pocket when I leave.

I did this on a Pi Zero 2 W running 64-bit Debian Trixie. There were a few steps to setting it up.

Step 1: Flash the SD card

Use Raspberry Pi Imager to put 64-bit Trixie on the SD card. The Lite version is plenty, since this thing will never have a screen.

During setup, open the customisation settings and:

Enable SSH with public-key authentication only

Paste in your computer’s public SSH key as an authorised key

Add your Wi-Fi details, because the Pi needs Wi-Fi to reach Tailscale

That authorised key is how you’ll get into the Pi from whatever machine you plug it into, so add the key for every computer you plan to use.

Step 2: Tailscale and the Pi’s SSH key

Boot the Pi, SSH in over Wi-Fi, and install Tailscale:

curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up

Follow the login link it prints and the Pi joins your tailnet.

Next, give the Pi its own SSH key and set its public key as an authorised key on every machine you want to reach. This is key, because without it there’s no SSH.

ssh-keygen -t ed25519 ssh-copy-id you@home-pc

Repeat the ssh-copy-id for each target machine on your network.

Step 3: Make it a USB Ethernet gadget

This is what lets the Pi show up as a wired network adapter when you plug it in. It means editing config.txt and cmdline.txt, and adding a blank ssh file, all on the bootfs partition of the SD card.

In config.txt, add this at the end, under [all]:

dtoverlay=dwc2

In cmdline.txt, add this straight after rootwait. The file must stay on a single line, so separate it with a space, not a newline:

modules-load=dwc2,g_ether

Finally, create an empty file called ssh in the root of bootfs, with no extension. On the Pi itself bootfs is mounted at /boot/firmware, so you can do all of this there too:

sudo touch /boot/firmware/ssh

Step 4: Plug in and hop through

Plug the Pi into your laptop using the port marked USB, not the one marked PWR. The data port powers it too. Give it a minute to boot and it’ll appear as a new wired network connection.

SSH into the Pi, then hop from there to any machine on your home network:

ssh [email protected] ssh you@home-pc

Or do it in one go:

ssh -t [email protected] ssh you@home-pc

Use whatever username and hostname you picked in Imager, and your home PC’s Tailscale name or IP.

Wrapping up

Once that’s all done, you can SSH tunnel via the Pi to any machine on your network, provided the right SSH keys are set as authorised keys. Your laptop’s key on the Pi, and the Pi’s key on everything else.

Nothing gets installed on the work laptop, my home network stays separate, and the whole thing fits in my pocket