From 0d40ac52a40e4b61fbbf99dd97d48d773159e552 Mon Sep 17 00:00:00 2001
From: Joshua Gilman <joshuagilman@gmail.com>
Date: Wed, 19 Aug 2026 11:53:50 -0700
Subject: [PATCH] feat(tailscale): authorize sandbox hosts

---
 tailscale/policy.hujson | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tailscale/policy.hujson b/tailscale/policy.hujson
index 23e57f4..e737629 100644
--- a/tailscale/policy.hujson
+++ b/tailscale/policy.hujson
@@ -12,6 +12,7 @@
 	// Who may assign each tag to a device.
 	"tagOwners": {
 		"tag:subnet-router": ["autogroup:admin"],
+		"tag:sandbox":       ["autogroup:admin"],
 	},
 
 	// Routes a subnet router may advertise without manual approval. These are
@@ -51,5 +52,21 @@
 			"dst":    ["autogroup:self"],
 			"users":  ["autogroup:nonroot", "root"],
 		},
+
+		// Tailscale SSH to sandbox hosts as josh or sandbox.
+		{
+			"action": "accept",
+			"src":    ["autogroup:member"],
+			"dst":    ["tag:sandbox"],
+			"users":  ["josh", "sandbox"],
+		},
+
+		// Tailscale SSH to sandbox hosts as root, with periodic reauthentication.
+		{
+			"action": "check",
+			"src":    ["autogroup:member"],
+			"dst":    ["tag:sandbox"],
+			"users":  ["root"],
+		},
 	],
 }