Tailscale
Give the Sazabi agent access to your private Tailscale tailnet from its sandbox, with zero stored credentials, via OpenID Connect workload identity federation.
All Tailscale integration capabilities
About
This CLI connection makes the Tailscale CLI (tailscale) available in the Sazabi agent's sandbox and joins each sandbox to your private tailnet as an ephemeral node, so the agent can reach internal APIs, private databases, and staging infrastructure during an investigation.
Unlike token-based CLI connections, Tailscale connects through OpenID Connect (OIDC) workload identity federation — Sazabi stores no long-lived keys or secrets. Each sandbox joins your tailnet under tag:sazabi, access is governed by your Tailscale access policy for that tag, and the ephemeral node is removed from your tailnet when the sandbox session ends. Commands reach the tailnet on an opt-in basis via standard HTTP/SOCKS proxy settings or the sazabi-tailnet-forward port-forwarding helper.
Prerequisites
- A Sazabi project.
- Admin access to your Tailscale tailnet, to create a
tag:sazabitag, grant it access in your access policy, and create an OpenID Connect trust credential.
Set up in the dashboard
Configure the sandbox in the dashboard under Settings > Sandbox CLIs.
Copy the Sazabi trust values
In Settings > Sandbox CLIs, find Tailscale under Browse sandbox CLIs and choose to connect it. The setup page shows an environment-specific Issuer URL and a project-specific Subject — keep the page open and copy both values exactly as shown.
Create the tag and grant access
In the Tailscale admin console, under Access controls > Tags, create a tag named tag:sazabi with owner autogroup:admin. Then add a grant to your access policy with tag:sazabi as the source and the destinations, protocols, and ports the sandbox needs — for example tcp:443 for HTTPS or tcp:5432 for PostgreSQL. Narrow the destinations to specific devices, tags, or subnets when possible.
Create the OpenID Connect trust credential
In the Tailscale admin console, under Settings > Trust credentials, create an OpenID Connect credential: set the issuer to Custom issuer and paste the exact Issuer URL and Subject from Sazabi, grant the credential Auth Keys > Write scope, and tag it with tag:sazabi. Generate the credential and copy the Client ID.
Save the Client ID in Sazabi
Back on the open Tailscale setup page in Sazabi, paste the generated Client ID. Keep the sandbox tag as tag:sazabi unless the trust credential uses a different tag; the tailnet name is optional. Connect to save.
Set up with the CLI
After creating the trust credential using the issuer and subject shown in the dashboard, you can save its Client ID with sazabi sandbox-clis connect. The public API verifies the federated identity and binds the Client ID to your project before saving, as the dashboard does. Disconnecting removes that project binding.
Verify
Ask the agent, in a thread, to reach a tailnet-only service — for example fetch an internal HTTPS endpoint or connect to a private database — and confirm it returns real output. While the sandbox session is active, an ephemeral node appears on the Machines page of the Tailscale admin console and disappears when the session ends.
Troubleshooting
Sandbox cannot join the tailnet — The trust credential's issuer and subject must match the values on the Sazabi setup page exactly; re-copy both from Settings > Sandbox CLIs and recreate the credential if they differ. Also confirm the credential has Auth Keys > Write scope and is tagged with the sandbox tag.
Tailnet joins but a service is unreachable — Your Tailscale access policy must grant tag:sazabi the destination, protocol, and port the agent is trying to reach. Add the missing grant, or widen the destination to include the target device, tag, or subnet.