Backfill read-only tailscale commands as coily passthroughs #17
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
Bare
tailscaleis denied by the coily lockdown (correctly - tagged devices and tailnet-wide actions are sensitive). But there's no coily verb for the day-to-day read-only commands either, so Kai has to drop down to bare invocations or fall back to the admin web UI.The investigation today (WSL SSH access debugging) needed
tailscale statusto see which devices are online and at what IPs, plustailscale ping <host>to confirm reachability. Neither has a coily wrapper. Workaround was a one-off Python script (list_tailscale_devices.py, just filed as infrastructure#149) that hits the admin REST API.Fix
Backfill the simple read-only tailscale CLI commands into coily as passthroughs. First pass:
coily ops tailscale status [--json]- device list with statecoily ops tailscale netcheck- NAT/derp diagnosticscoily ops tailscale ping <host>- reachability checkcoily ops tailscale ip [host]- resolve tailnet IPcoily ops tailscale whois <ip|host>- reverse-lookup user/tagscoily ops tailscale dns status- MagicDNS stateThese are all read-only on the local daemon. Pure passthroughs, no SSM resolution needed (the host is already authenticated to the tailnet).
Mutating commands stay denied (or move to a separate
coily ops tailscale up-style flow with their own gates). The destructive ones -tailscale up,tailscale down,tailscale logout,tailscale set- are out of scope here.Why coily and not a per-script Makefile target
The Python-script workaround pattern (one file per query) doesn't scale - every diagnostic question becomes a new file. Direct passthrough to the local
tailscalebinary is correct for read-only state. Same shape ascoily ops kubectlandcoily ops aws.Where this lives
Code repo for the routing is
coilysiren/agent-guard(thecoilyRoutestable). The user-facing framing stays coily.