Tailscale
Give the Sazabi agent access to your private Tailscale tailnet from its sandbox, with zero stored credentials, via OpenID Connect workload identity federation.
About
This CLI connection makes the Tailscale CLI (tailscale) available in the Sazabi agent's sandbox and joins each sandbox to your private tailnet as an ephemeral node, so the agent can reach internal APIs, private databases, and staging infrastructure during an investigation.
Unlike token-based CLI connections, Tailscale connects through OpenID Connect (OIDC) workload identity federation — Sazabi stores no long-lived keys or secrets. Each sandbox joins your tailnet under tag:sazabi, access is governed by your Tailscale access policy for that tag, and the ephemeral node is removed from your tailnet when the sandbox session ends. Commands reach the tailnet on an opt-in basis via standard HTTP/SOCKS proxy settings or the sazabi-tailnet-forward port-forwarding helper.
Prerequisites
- A Sazabi project.
- Admin access to your Tailscale tailnet, to create a
tag:sazabitag, grant it access in your access policy, and create an OpenID Connect trust credential.
Set up in the dashboard
Configure the sandbox in the dashboard under Settings > Sandbox CLIs.
Copy the Sazabi trust values
In Settings > Sandbox CLIs, find Tailscale under Browse sandbox CLIs and choose to connect it. The setup page shows an environment-specific Issuer URL and a project-specific Subject — keep the page open and copy both values exactly as shown.
Create the tag and grant access
In the Tailscale admin console, under Access controls > Tags, create a tag named tag:sazabi with owner autogroup:admin. Then add a grant to your access policy with tag:sazabi as the source and the destinations, protocols, and ports the sandbox needs — for example tcp:443 for HTTPS or tcp:5432 for PostgreSQL. Narrow the destinations to specific devices, tags, or subnets when possible.
Create the OpenID Connect trust credential
In the Tailscale admin console, under Settings > Trust credentials, create an OpenID Connect credential: set the issuer to Custom issuer and paste the exact Issuer URL and Subject from Sazabi, grant the credential Auth Keys > Write scope, and tag it with tag:sazabi. Generate the credential and copy the Client ID.
Save the Client ID in Sazabi
Back on the open Tailscale setup page in Sazabi, paste the generated Client ID. Keep the sandbox tag as tag:sazabi unless the trust credential uses a different tag; the tailnet name is optional. Connect to save.
Set up with the CLI
Tailscale setup is dashboard-only today. Connecting in the dashboard does more than store the Client ID — it verifies the trust credential against your tailnet and authorizes the Client ID for your project, and that step has no Sazabi CLI equivalent yet, so a configuration saved with sazabi sandbox-clis set cannot join the tailnet. Use the dashboard setup above.
Verify
Ask the agent, in a thread, to reach a tailnet-only service — for example fetch an internal HTTPS endpoint or connect to a private database — and confirm it returns real output. While the sandbox session is active, an ephemeral node appears on the Machines page of the Tailscale admin console and disappears when the session ends.
Troubleshooting
Sandbox cannot join the tailnet — The trust credential's issuer and subject must match the values on the Sazabi setup page exactly; re-copy both from Settings > Sandbox CLIs and recreate the credential if they differ. Also confirm the credential has Auth Keys > Write scope and is tagged with the sandbox tag.
Tailnet joins but a service is unreachable — Your Tailscale access policy must grant tag:sazabi the destination, protocol, and port the agent is trying to reach. Add the missing grant, or widen the destination to include the target device, tag, or subnet.