From 00f22a84437a9ee61dcfa5139484ac3690a5e8f5 Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@dalby.cc>
Date: Fri, 9 Jan 2026 10:41:06 +0000
Subject: [PATCH] state: disable key expiry for nodes with approved
 advertise-tags

Extends #2971 fix to also cover nodes that authenticate as users but
become tagged immediately via --advertise-tags. When RequestTags are
approved by policy, the node's expiry is now disabled, consistent with
nodes registered via tagged PreAuthKeys.
---
 hscontrol/state/state.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hscontrol/state/state.go b/hscontrol/state/state.go
index 5ddb9c97..03ba6e90 100644
--- a/hscontrol/state/state.go
+++ b/hscontrol/state/state.go
@@ -1188,6 +1188,10 @@ func (s *State) createAndSaveNewNode(params newNodeParams) (types.NodeView, erro
 			nodeToRegister.Tags = approvedTags
 			slices.Sort(nodeToRegister.Tags)
 			nodeToRegister.Tags = slices.Compact(nodeToRegister.Tags)
+
+			// Tagged nodes have key expiry disabled.
+			nodeToRegister.Expiry = nil
+
 			log.Info().
 				Str("node.name", nodeToRegister.Hostname).
 				Strs("tags", nodeToRegister.Tags).