Ephemeral Castle Tailscale Foundation
Scope
This page describes the Tailscale control-plane and networking foundation work that lives inside ephemeral-castle/.
Current Synthesis
Inside ephemeral-castle/, Tailscale is a first-class macro-area rather than an incidental utility. It acts as the private network backbone for operator access, runtime connectivity, and cluster-adjacent exposure patterns, and it is managed as infrastructure-as-code through the tailscale/ path.
The repository treats tailscale/acl.json as the policy source of truth, main.tf as the Terraform object model, and setup.sh as the idempotent bootstrap path that publishes the OAuth client back into TazPod.
Main Responsibilities
- define tailnet ACL and tag ownership rules
- bootstrap Tailscale OAuth credentials
- support operator access to infrastructure and runtime surfaces
- provide the networking backbone used by multiple TazLab tracks
Code Map
acl.json- tag ownership and ACL rulesmain.tf- tailnet settings plus OAuth bootstrap clientsetup.sh- Terraform apply, credential extraction, vault update, S3 pushvariables.tf- API key and tailnet inputsoutputs.tf- bootstrap outputs for the OAuth clientlogs/- structured setup logs
Important Operational Characteristics
tailscale_tailnet_settingsdisables device auto-updates and sets key duration to 180 days- the bootstrap client uses
auth_keysanddevicesscopes - ACL source of truth lives in
ephemeral-castle/tailscale/acl.json - live execution forced policy fixes such as
tag:tazpodowningtag:tazlab-vaultandtag:vault-api - SSH on port
22had to be explicitly included for thetag:tazpodtotag:tazlab-vaultpath - in the current operator environment, userspace-networking can require
tailscale ncor SSH proxy behavior rather than assuming normal kernel routing
ACL Shape
tag:tazpodcan owntag:tazlab-vault,tag:vault-api, and itselftag:tazlab-k8scan own its own tagtag:tazlab-vaultis allowed to reach itself on8201,tag:tazlab-dbon5432, and the TazPod operator on22,6443,50000tag:tazpodcan reachtag:vault-api:8200andtag:tazlab-db:5432
Relationships
- parent repository hub: ephemeral-castle
- part of the TazLab Cluster Delivery Flow
- supports the runtime connectivity assumptions in Ephemeral Castle Hetzner Vault Runtime
- intersects the TazLab Secret And Identity Flow because OAuth bootstrap material is handled through the operator secret model
- belongs to Ephemeral Castle Repository Map
Source Basis
AGENTS.ctx/ephemeral-castle/CONTEXT.mdAGENTS.ctx/memory/system-state.md