Spinneryspinnery tailscale statusShows the selected organization connection state, tailnet, access mode, device state, and tags.
Docs / Tailscale private access
Tailscale private access stays separate from public dev links.
Tailscale is a first-class access mode for teams that want private shell or runtime routes. It can run beside Auth0 login and signed dev links, or a workspace can be Tailscale-only when public dev link access should stay closed.
private accessorganization scoped
$spinnery tailscale status signed-links
Tailscale: connected
tailnet: acme.ts.net
shell: tagged spinnery-shell
runtime: tagged spinnery-runtime
public dev gateway: optional
signed dev links: app surface only
CLI status
spinnery tailscale status makes private access reviewable.
The CLI status command is read-only: it reports organization connection state and, when a workspace is supplied, the shell and runtime context for that private access handoff.
spinnery tailscale status signed-linksAdds shell and runtime state for the workspace so private-route handoffs can say what is reachable now.
--jsonReturns a bounded payload for scripts while omitting OAuth client secret and client secret fields.
Access modes
Private access chooses the surface before the host.
The product setting should say whether the team is opening shell access, runtime access, or a fully private workspace. Users should not need raw VM names, IP addresses, or unmanaged SSH hostnames.
private SSH surfaceDevelopers and agents can reach the workspace shell through the customer tailnet when the organization enables private shell access.
private service surfaceRuntime services can join the same tailnet for private app, API, database proxy, cache, or worker debugging without turning those routes public.
public gateway disabledA workspace can keep public dev link access off while still allowing approved tailnet users to reach shell and runtime surfaces.
Provisioning
Tailscale joins are automated, scoped, and cleaned up.
Spinnery should own the lifecycle instead of asking every workspace to paste an auth key into a shell. The organization connects once, then shell and runtime VMs join with tags that policy can understand.
- OAuth client
An organization admin connects a scoped Tailscale OAuth client for automated device provisioning.
- SSM SecureString
Spinnery stores the OAuth client secret as an organization-scoped SecureString and does not copy it into workspace repos.
- Tagged devices
Shell and runtime VMs join the tailnet with organization and workspace tags so policy can distinguish shell, runtime, and dedicated hosts.
- Device cleanup
When a host is replaced, a runtime is deprovisioned, or an organization disconnects Tailscale, Spinnery removes stale devices.
Policy boundary
Private network access does not widen public dev link access.
The public dev gateway can stay enabled for signed reviewer links while Tailscale covers private shell or runtime surfaces. Signed dev links still block SSH, logs, secrets, and runtime admin.
SurfaceAllowedBlocked
Auth0 and dashboard
Login, organization context, project role checks, signed link creation, billing, and admin settings.
Bypassing Spinnery product authorization just because a device is on the tailnet.
Signed dev links
Public reviewer access to web, same-origin /api, assets, WebSockets, and marketing routes.
SSH, logs, secrets, runtime admin, root policy, Mailpit, and private resource consoles.
Tailscale private access
Private shell and runtime routes for approved tailnet users and tagged Spinnery devices.
Expanding public dev link scope or replacing Spinnery role checks.