Doesn't work yet.

android/src/main/java/com/tailscale/ipn/IPNService.java

@@ -24,7 +24,15 @@ public class IPNService extends VpnService {
 		if (intent != null && ACTION_DISCONNECT.equals(intent.getAction())) {
 			close();
 			return START_NOT_STICKY;
+		} else if (intent != null && ACTION_CONNECT.equals(intent.getAction())) {
+			connect();
+			return START_STICKY;
+		} else if (intent != null) {
+			// we're being started due to Always-on VPN
+			connectAtBoot();
+			return START_STICKY;
 		}
+		// dunno what this is.
 		connect();
 		return START_STICKY;
 	}
@@ -87,4 +95,5 @@ public class IPNService extends VpnService {
 
 	private native void connect();
 	private native void disconnect();
+	private native void connectAtBoot();
 }

cmd/tailscale/callbacks.go

@@ -7,6 +7,7 @@ package main
 // JNI implementations of Java native callback methods.
 
 import (
+	"log"
 	"unsafe"
 
 	"github.com/tailscale/tailscale-android/jni"
@@ -81,12 +82,14 @@ func notifyVPNClosed() {
 
 //export Java_com_tailscale_ipn_IPNService_connect
 func Java_com_tailscale_ipn_IPNService_connect(env *C.JNIEnv, this C.jobject) {
+	log.Printf("Java_com_tailscale_ipn_IPNService_connect")
 	jenv := (*jni.Env)(unsafe.Pointer(env))
 	onConnect <- jni.NewGlobalRef(jenv, jni.Object(this))
 }
 
 //export Java_com_tailscale_ipn_IPNService_disconnect
 func Java_com_tailscale_ipn_IPNService_disconnect(env *C.JNIEnv, this C.jobject) {
+	log.Printf("Java_com_tailscale_ipn_IPNService_disconnect")
 	jenv := (*jni.Env)(unsafe.Pointer(env))
 	onDisconnect <- jni.NewGlobalRef(jenv, jni.Object(this))
 }
@@ -174,3 +177,10 @@ func Java_com_tailscale_ipn_App_onShareIntent(env *C.JNIEnv, cls C.jclass, nfile
 	}
 	onFileShare <- files
 }
+
+//export Java_com_tailscale_ipn_IPNService_connectAtBoot
+func Java_com_tailscale_ipn_IPNService_connectAtBoot(env *C.JNIEnv, cls C.jclass) {
+	log.Printf("Java_com_tailscale_ipn_IPNService_connectAtBoot")
+	requestBackend(WantRunningEvent{})
+	requestBackend(ConnectEvent{Enable: true})
+}

cmd/tailscale/main.go

@@ -181,6 +181,7 @@ type (
 	GoogleAuthEvent  struct{}
 	LogoutEvent      struct{}
 	FileTargetsEvent struct{}
+	WantRunningEvent struct{}
 )
 
 // serverOAuthID is the OAuth ID of the tailscale-android server, used
@@ -412,6 +413,10 @@ func (a *App) runBackend() error {
 				go b.backend.SetPrefs(state.Prefs)
 				state.updateExitNodes()
 				a.notify(state)
+			case WantRunningEvent:
+				state.Prefs.WantRunning = true
+				go b.backend.SetPrefs(state.Prefs)
+				a.notify(state)
 			}
 		case s := <-onConnect:
 			jni.Do(a.jvm, func(env *jni.Env) error {