Post

this post is correct but also tailscale ssh is awesome: no more shipping pubkeys, ssh powered by sso, fleet-wide policy changes rollout instantly with tailscale ACLs

Do you run it in check mode for the sensitive boxes? Forcing a fresh SSO login before root feels like the sweet spot between convenient and reckless.

yeah exactly, and tsrecorder for every session. theres only a handful of "real" break-glass ssh keys and everything else is tailscale ssh

tsrecorder on every session is the part most setups skip. Do the recordings stay on a node inside the tailnet, or get shipped somewhere the hosts themselves can't touch?

s3 WORM bucket

Nice. Compliance mode, or governance? Governance always felt like a WORM bucket with a side door lol