Reaching a private network

Explains F-COMP-14: a pattern the customer runs on their own network, not a mode the product manages for them.

The division of responsibility

The customer operates the mesh or tunnel client and its own network; Botseon does not monitor it. This is a pattern the customer runs, not a managed mode — the product installs nothing by default and shows no status for a client it did not start.

The exercised recipe: a Tailscale exit node

The recipe below is the one exercised fixture, quoted from the file rather than retyped so it cannot drift silently from what a computer actually runs:

{
  "manifestId": "private-network",
  "entries": [
    {
      "id": "install-network-client",
      "setup": "#!/usr/bin/env bash\nset -euo pipefail\n# Installs the mesh client from the vendor's package repository through the one sudo rule the\n# guest grants (pkg: package installs only). Egress allowlist (F-COMP-7):\n#   pkgs.tailscale.com, login.tailscale.com, controlplane.tailscale.com, *.tailscale.com\n# Verify the current host list against the vendor's documentation before rollout.\nsudo -n pkg repo-add tailscale https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg \"deb [signed-by=/usr/share/keyrings/tailscale-keyring.gpg] https://pkgs.tailscale.com/stable/debian bookworm main\"\nsudo -n pkg update\nsudo -n pkg install tailscale\n",
      "check": "command -v tailscale"
    },
    {
      "id": "join-network-via-exit-node",
      "setup": "#!/usr/bin/env bash\nset -euo pipefail\n# Set EXIT_NODE to the name of the exit node inside your network before proposing this manifest.\nEXIT_NODE=replace-with-your-exit-node\n# No auth key here (\"Don't put secret values in setup scripts\"). Once per computer a member opens\n# the computer's terminal, runs\n#   tailscale --socket=/data/workspace/.tailscale/tailscaled.sock login\n# and finishes the sign-in in the computer's browser, where the identity provider's policies apply.\n# The guest has no service manager, so the client runs as this user in userspace mode, started with\n# setsid -f so it outlives this script. Its local proxy on 127.0.0.1:1055 carries a tool's traffic\n# into the network (HTTPS_PROXY=http://127.0.0.1:1055); everything else keeps leaving through the\n# shared egress, and the client's own control-plane dials use the guest's proxy variables.\nif [ \"$EXIT_NODE\" = replace-with-your-exit-node ]; then\n  echo \"setup: set EXIT_NODE in this entry to your exit node name\" >&2\n  exit 2\nfi\nSTATE=/data/workspace/.tailscale\nSOCK=$STATE/tailscaled.sock\nmkdir -p \"$STATE\"\nif ! tailscale --socket=\"$SOCK\" status --json >/dev/null 2>&1; then\n  setsid -f tailscaled --tun=userspace-networking --state=\"$STATE/state\" --socket=\"$SOCK\" --outbound-http-proxy-listen=127.0.0.1:1055 </dev/null >>\"$STATE/tailscaled.log\" 2>&1\n  for _ in 1 2 3 4 5 6 7 8 9 10; do\n    [ -S \"$SOCK\" ] && break\n    sleep 1\n  done\nfi\ntailscale --socket=\"$SOCK\" up --exit-node=\"$EXIT_NODE\" --exit-node-allow-lan-access=false --accept-routes=false --timeout=30s\n",
      "check": "tailscale --socket=/data/workspace/.tailscale/tailscaled.sock status --json | grep -q '\"BackendState\": *\"Running\"'"
    }
  ]
}

The first entry installs the client; its own check is command -v tailscale. The second joins the network through an exit node the customer names, and needs one interactive sign-in per computer inside the computer's own browser — no auth key is ever placed in the script.

The control-plane hosts on the allowlist

Under Only the sites below on Settings → Computer → Internet access, add the client's coordination, relay and gateway hosts with Add a site — the hosts the fixture's own # comment lines name: pkgs.tailscale.com (the install-time host), login.tailscale.com, controlplane.tailscale.com and *.tailscale.com. Botseon's own egress watcher polls the control plane and swaps its compiled ruleset without restarting anything, so a running computer picks up a new entry in about a minute — it does not wait for its next recreate.

Cloudflare Tunnel: documented, not exercised

The cloudflared client can run on the computer with the connector configured in the customer's own network; this path is documented, not exercised in this release. A TCP listener opened for one session does not survive a recreate.

What a recreate does

The daily refresh re-applies every manifest entry. A session inside the mesh or tunnel client may need re-establishing from inside the computer's own browser afterwards.

Limits

The vendor's client, the tailnet sign-in and the exit node are exercised on a pilot computer the customer runs, not in CI — CI has no tailnet to join. A tool reaches the private network only when it is pointed at the client's local proxy (HTTPS_PROXY=http://127.0.0.1:1055, the recipe's own comment); ordinary traffic still egresses through the shared per-region ranges, there is no per-customer egress address, and there is no fleet-wide view of results.