4 ms·

We love Tailscale. Everyone employee has it, and we use it to provide access to dev, staging, and prod environments as well. Fun little thing we did with it: n

We love Tailscale. Everyone employee has it, and we use it to provide access to dev, staging, and prod environments as well. Fun little thing we did with it: nobody can access the prod network without requesting access via a Slack bot (powered by https://indent.com/ https://indent.com/). So somebody requests access, another authorized person approves it, and the Tailscale ACLs are updated for X minutes and then reset. Access to secure environments is super low friction but more secure (with fantastic audit trails) than ever.

fwip 4y ago
That's gonna be exciting next time Slack is down.
- dx034 4y ago
  I'd assume they have a fallback option to provide access.
  - VWWHFSfQ 4y ago
    I wouldn't assume anything
  - Lightbody 4y ago
    It's a very safe assumption: we're just automating Tailscale ACLs. Tailscale admins (3 of us) can still come in and manually change them.
    - fwip 4y ago
      That's reassuring, the phrasing of "nobody can access prod without a Slack bot" was worrying.
- obogobo 4y ago
  it was down for many folks about 2 hours after you posted this lol
ignoramous 4y ago
Well, we run our servers without ssh access... no amount escalation through ACLs / Security Groups let you in. Can't say it would work for everyone, but at least, no one can mutate prod unless the code itself exposes those interfaces.