some clarifications for tags (#2531)

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

hscontrol/db/node.go

@@ -194,7 +194,8 @@ func (hsdb *HSDatabase) SetTags(
 	})
 }
 
-// SetTags takes a Node struct pointer and update the forced tags.
+// SetTags takes a NodeID and update the forced tags.
+// It will overwrite any tags with the new list.
 func SetTags(
 	tx *gorm.DB,
 	nodeID types.NodeID,
@@ -209,14 +210,9 @@ func SetTags(
 		return nil
 	}
 
-	var newTags []string
+	slices.Sort(tags)
-	for _, tag := range tags {
+	tags = slices.Compact(tags)
-		if !slices.Contains(newTags, tag) {
+	b, err := json.Marshal(tags)
-			newTags = append(newTags, tag)
-		}
-	}
-
-	b, err := json.Marshal(newTags)
 	if err != nil {
 		return err
 	}

hscontrol/types/node.go

@@ -80,7 +80,11 @@ type Node struct {
 
 	RegisterMethod string
 
-	ForcedTags []string `gorm:"serializer:json"`
+	// ForcedTags are tags set by CLI/API. It is not considered
+	// the source of truth, but is one of the sources from
+	// which a tag might originate.
+	// ForcedTags are _always_ applied to the node.
+	ForcedTags []string `gorm:"column:forced_tags;serializer:json"`
 
 	// When a node has been created with a PreAuthKey, we need to
 	// prevent the preauthkey from being deleted before the node.

hscontrol/types/preauth_key.go

@@ -18,6 +18,11 @@ type PreAuthKey struct {
 	Reusable  bool
 	Ephemeral bool `gorm:"default:false"`
 	Used      bool `gorm:"default:false"`
+
+	// Tags are always applied to the node and is one of
+	// the sources of tags a node might have. They are copied
+	// from the PreAuthKey when the node logs in the first time,
+	// and ignored after.
 	Tags []string `gorm:"serializer:json"`
 
 	CreatedAt  *time.Time