feat: switch agent to a periodic dump rather than long running process

internal/config/preflight.go

@@ -3,10 +3,13 @@ package config
 import (
 	"fmt"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 )
 
-// Checks to make sure all required environment variables are set
+// Checks to make sure all required environment variables are set.
+// TSAuthKey is only required when there is no existing tsnet state.
 func validateRequired(config *Config) error {
 	if config.Hostname == "" {
 		return fmt.Errorf("%s is required", HostnameEnv)
@@ -16,17 +19,23 @@ func validateRequired(config *Config) error {
 		return fmt.Errorf("%s is required", TSControlURLEnv)
 	}
 
-	if config.TSAuthKey == "" {
-		return fmt.Errorf("%s is required", TSAuthKeyEnv)
-	}
-
 	if config.WorkDir == "" {
 		return fmt.Errorf("%s is required", WorkDirEnv)
 	}
 
+	if config.TSAuthKey == "" && !hasExistingState(config.WorkDir) {
+		return fmt.Errorf("%s is required for first run (no existing state in %s)", TSAuthKeyEnv, config.WorkDir)
+	}
+
 	return nil
 }
 
+// hasExistingState checks if tsnet has previously stored identity state.
+func hasExistingState(workDir string) bool {
+	_, err := os.Stat(filepath.Join(workDir, "tailscaled.state"))
+	return err == nil
+}
+
 // Pings the Tailscale control server to make sure it's up and running
 func validateTSReady(config *Config) error {
 	testURL := config.TSControlURL