Post work PR #701

backend/app/api/routes/settings.py

@@ -853,7 +853,7 @@ async def get_virtual_printer_settings(
         "model": model or DEFAULT_VIRTUAL_PRINTER_MODEL,
         "target_printer_id": int(target_printer_id) if target_printer_id else None,
         "remote_interface_ip": remote_interface_ip or "",
-        "tailscale_disabled": tailscale_disabled_raw == "true" if tailscale_disabled_raw else False,
+        "tailscale_disabled": tailscale_disabled_raw == "true" if tailscale_disabled_raw else True,
         "status": virtual_printer_manager.get_status(),
     }
 
@@ -894,7 +894,8 @@ async def update_virtual_printer_settings(
     current_target_id = int(current_target_id_str) if current_target_id_str else None
     current_remote_iface = await get_setting(db, "virtual_printer_remote_interface_ip") or ""
     current_ts_disabled_raw = await get_setting(db, "virtual_printer_tailscale_disabled")
-    current_ts_disabled = current_ts_disabled_raw == "true" if current_ts_disabled_raw else False
+    # Default True (opt-in) when the setting has never been saved — matches the model default.
+    current_ts_disabled = current_ts_disabled_raw == "true" if current_ts_disabled_raw else True
 
     # Apply updates
     new_enabled = enabled if enabled is not None else current_enabled
@@ -905,6 +906,21 @@ async def update_virtual_printer_settings(
     new_remote_iface = remote_interface_ip if remote_interface_ip is not None else current_remote_iface
     new_ts_disabled = tailscale_disabled if tailscale_disabled is not None else current_ts_disabled
 
+    # Guard: enabling Tailscale (disabled=False) requires the binary to be present. Otherwise
+    # the toggle looks like it worked but the service will silently fall back to self-signed.
+    if tailscale_disabled is False and current_ts_disabled is True:
+        from backend.app.services.virtual_printer.tailscale import tailscale_service
+
+        ts_status = await tailscale_service.get_status()
+        if not ts_status.available:
+            return JSONResponse(
+                status_code=409,
+                content={
+                    "detail": "tailscale_not_available",
+                    "reason": ts_status.error or "tailscale binary not found",
+                },
+            )
+
     # Validate mode
     # "review" is the new name for "queue" (pending review before archiving)
     # "print_queue" archives and adds to print queue (unassigned)

backend/app/api/routes/virtual_printers.py

@@ -336,6 +336,20 @@ async def update_virtual_printer(
     if body.remote_interface_ip is not None:
         vp.remote_interface_ip = body.remote_interface_ip
     if body.tailscale_disabled is not None:
+        # Guard: user trying to enable Tailscale (disabled=False) must have the binary available.
+        # Otherwise the toggle looks like it works but silently falls back to self-signed.
+        if body.tailscale_disabled is False and vp.tailscale_disabled is True:
+            from backend.app.services.virtual_printer.tailscale import tailscale_service
+
+            ts_status = await tailscale_service.get_status()
+            if not ts_status.available:
+                return JSONResponse(
+                    status_code=409,
+                    content={
+                        "detail": "tailscale_not_available",
+                        "reason": ts_status.error or "tailscale binary not found",
+                    },
+                )
         vp.tailscale_disabled = body.tailscale_disabled
 
     # Auto-inherit model when switching to proxy mode with existing target printer

backend/app/core/database.py

@@ -480,8 +480,13 @@ async def run_migrations(conn):
     # Migration: Add wiki_url column to maintenance_types for documentation links
     await _safe_execute(conn, "ALTER TABLE maintenance_types ADD COLUMN wiki_url VARCHAR(500)")
 
-    # Migration: Add tailscale_disabled column to virtual_printers for user opt-out
-    await _safe_execute(conn, "ALTER TABLE virtual_printers ADD COLUMN tailscale_disabled BOOLEAN DEFAULT 0")
+    # Migration: Add tailscale_disabled column to virtual_printers. Opt-in: default TRUE so
+    # the auto-detect + fallback noise only runs for users who explicitly enable it.
+    # Postgres rejects `DEFAULT 1` for BOOLEAN (#1070 round-2 review).
+    if is_sqlite():
+        await _safe_execute(conn, "ALTER TABLE virtual_printers ADD COLUMN tailscale_disabled BOOLEAN DEFAULT 1")
+    else:
+        await _safe_execute(conn, "ALTER TABLE virtual_printers ADD COLUMN tailscale_disabled BOOLEAN DEFAULT true")
 
     # Migration: Add ams_mapping column to print_queue for storing filament slot assignments
     await _safe_execute(conn, "ALTER TABLE print_queue ADD COLUMN ams_mapping TEXT")

backend/app/models/virtual_printer.py

@@ -26,8 +26,8 @@ class VirtualPrinter(Base):
     bind_ip: Mapped[str | None] = mapped_column(String(45), nullable=True)  # dedicated IP (proxy mode)
     remote_interface_ip: Mapped[str | None] = mapped_column(String(45), nullable=True)  # SSDP advertise IP
     tailscale_disabled: Mapped[bool] = mapped_column(
-        Boolean, server_default="false"
-    )  # opt out of Tailscale auto-detect
+        Boolean, server_default="true"
+    )  # opt-in: user must explicitly enable; auto-detect only runs then
     serial_suffix: Mapped[str] = mapped_column(String(9), default="391800001")  # unique per printer
     position: Mapped[int] = mapped_column(Integer, default=0)
     created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())

backend/app/services/virtual_printer/manager.py

@@ -113,7 +113,7 @@ class VirtualPrinterInstance:
         auto_dispatch: bool = True,
         bind_ip: str = "",
         remote_interface_ip: str = "",
-        tailscale_disabled: bool = False,
+        tailscale_disabled: bool = True,
         base_dir: Path,
         session_factory: Callable | None = None,
     ):