diff --git a/tailcfg/tailcfg_clone.go b/tailcfg/tailcfg_clone.go
index 513b9890a..c112888ec 100644
--- a/tailcfg/tailcfg_clone.go
+++ b/tailcfg/tailcfg_clone.go
@@ -7,6 +7,10 @@
 package tailcfg
 
 import (
+	"github.com/tailscale/wireguard-go/wgcfg"
+	"inet.af/netaddr"
+	"tailscale.com/types/opt"
+	"tailscale.com/types/structs"
 	"time"
 )
 
@@ -23,6 +27,19 @@ func (src *User) Clone() *User {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _UserNeedsRegeneration = User(struct {
+	ID            UserID
+	LoginName     string
+	DisplayName   string
+	ProfilePicURL string
+	Domain        string
+	Logins        []LoginID
+	Roles         []RoleID
+	Created       time.Time
+}{})
+
 // Clone makes a deep copy of Node.
 // The result aliases no memory with the original.
 func (src *Node) Clone() *Node {
@@ -42,6 +59,27 @@ func (src *Node) Clone() *Node {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _NodeNeedsRegeneration = Node(struct {
+	ID                NodeID
+	Name              string
+	User              UserID
+	Key               NodeKey
+	KeyExpiry         time.Time
+	Machine           MachineKey
+	DiscoKey          DiscoKey
+	Addresses         []wgcfg.CIDR
+	AllowedIPs        []wgcfg.CIDR
+	Endpoints         []string
+	DERP              string
+	Hostinfo          Hostinfo
+	Created           time.Time
+	LastSeen          *time.Time
+	KeepAlive         bool
+	MachineAuthorized bool
+}{})
+
 // Clone makes a deep copy of Hostinfo.
 // The result aliases no memory with the original.
 func (src *Hostinfo) Clone() *Hostinfo {
@@ -57,6 +95,23 @@ func (src *Hostinfo) Clone() *Hostinfo {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _HostinfoNeedsRegeneration = Hostinfo(struct {
+	IPNVersion    string
+	FrontendLogID string
+	BackendLogID  string
+	OS            string
+	OSVersion     string
+	DeviceModel   string
+	Hostname      string
+	GoArch        string
+	RoutableIPs   []wgcfg.CIDR
+	RequestTags   []string
+	Services      []Service
+	NetInfo       *NetInfo
+}{})
+
 // Clone makes a deep copy of NetInfo.
 // The result aliases no memory with the original.
 func (src *NetInfo) Clone() *NetInfo {
@@ -74,6 +129,21 @@ func (src *NetInfo) Clone() *NetInfo {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _NetInfoNeedsRegeneration = NetInfo(struct {
+	MappingVariesByDestIP opt.Bool
+	HairPinning           opt.Bool
+	WorkingIPv6           opt.Bool
+	WorkingUDP            opt.Bool
+	UPnP                  opt.Bool
+	PMP                   opt.Bool
+	PCP                   opt.Bool
+	PreferredDERP         int
+	LinkType              string
+	DERPLatency           map[string]float64
+}{})
+
 // Clone makes a deep copy of Group.
 // The result aliases no memory with the original.
 func (src *Group) Clone() *Group {
@@ -86,6 +156,14 @@ func (src *Group) Clone() *Group {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _GroupNeedsRegeneration = Group(struct {
+	ID      GroupID
+	Name    string
+	Members []ID
+}{})
+
 // Clone makes a deep copy of Role.
 // The result aliases no memory with the original.
 func (src *Role) Clone() *Role {
@@ -98,6 +176,14 @@ func (src *Role) Clone() *Role {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _RoleNeedsRegeneration = Role(struct {
+	ID           RoleID
+	Name         string
+	Capabilities []CapabilityID
+}{})
+
 // Clone makes a deep copy of Capability.
 // The result aliases no memory with the original.
 func (src *Capability) Clone() *Capability {
@@ -109,6 +195,14 @@ func (src *Capability) Clone() *Capability {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _CapabilityNeedsRegeneration = Capability(struct {
+	ID   CapabilityID
+	Type CapType
+	Val  ID
+}{})
+
 // Clone makes a deep copy of Login.
 // The result aliases no memory with the original.
 func (src *Login) Clone() *Login {
@@ -120,6 +214,18 @@ func (src *Login) Clone() *Login {
 	return dst
 }
 
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _LoginNeedsRegeneration = Login(struct {
+	_             structs.Incomparable
+	ID            LoginID
+	Provider      string
+	LoginName     string
+	DisplayName   string
+	ProfilePicURL string
+	Domain        string
+}{})
+
 // Clone makes a deep copy of DNSConfig.
 // The result aliases no memory with the original.
 func (src *DNSConfig) Clone() *DNSConfig {
@@ -132,3 +238,102 @@ func (src *DNSConfig) Clone() *DNSConfig {
 	dst.Domains = append(src.Domains[:0:0], src.Domains...)
 	return dst
 }
+
+// A compilation failure here means this code must be regenerated, with command:
+//   tailscale.com/cmd/cloner -type User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig
+var _DNSConfigNeedsRegeneration = DNSConfig(struct {
+	Nameservers []netaddr.IP
+	Domains     []string
+	PerDomain   bool
+	Proxied     bool
+}{})
+
+// Clone duplicates src into dst and reports whether it succeeded.
+// To succeed, <src, dst> must be of types <*T, *T> or <*T, **T>,
+// where T is one of User,Node,Hostinfo,NetInfo,Group,Role,Capability,Login,DNSConfig.
+func Clone(dst, src interface{}) bool {
+	switch src := src.(type) {
+	case *User:
+		switch dst := dst.(type) {
+		case *User:
+			*dst = *src.Clone()
+			return true
+		case **User:
+			*dst = src.Clone()
+			return true
+		}
+	case *Node:
+		switch dst := dst.(type) {
+		case *Node:
+			*dst = *src.Clone()
+			return true
+		case **Node:
+			*dst = src.Clone()
+			return true
+		}
+	case *Hostinfo:
+		switch dst := dst.(type) {
+		case *Hostinfo:
+			*dst = *src.Clone()
+			return true
+		case **Hostinfo:
+			*dst = src.Clone()
+			return true
+		}
+	case *NetInfo:
+		switch dst := dst.(type) {
+		case *NetInfo:
+			*dst = *src.Clone()
+			return true
+		case **NetInfo:
+			*dst = src.Clone()
+			return true
+		}
+	case *Group:
+		switch dst := dst.(type) {
+		case *Group:
+			*dst = *src.Clone()
+			return true
+		case **Group:
+			*dst = src.Clone()
+			return true
+		}
+	case *Role:
+		switch dst := dst.(type) {
+		case *Role:
+			*dst = *src.Clone()
+			return true
+		case **Role:
+			*dst = src.Clone()
+			return true
+		}
+	case *Capability:
+		switch dst := dst.(type) {
+		case *Capability:
+			*dst = *src.Clone()
+			return true
+		case **Capability:
+			*dst = src.Clone()
+			return true
+		}
+	case *Login:
+		switch dst := dst.(type) {
+		case *Login:
+			*dst = *src.Clone()
+			return true
+		case **Login:
+			*dst = src.Clone()
+			return true
+		}
+	case *DNSConfig:
+		switch dst := dst.(type) {
+		case *DNSConfig:
+			*dst = *src.Clone()
+			return true
+		case **DNSConfig:
+			*dst = src.Clone()
+			return true
+		}
+	}
+	return false
+}