Engineering
Let a bot manage your tailnet as a tagged server, fenced by ACLs
Giving an agent your network admin keys feels like handing over the house.
What hurt
Chevy Phillip (@chevonphillip) built a Grok Bot that manages his Tailscale tailnet without holding his keys. It joins as a tagged server (tag:grokbot), ACLs limit it to the machines he picks, and it asks before any change. Jobs: audits, device lists, Tailscale SSH. Published as a free template. Not affiliated with xAI.
What to install or create
Identity by tag, reach by ACL, changes by approval. The bot never gets your admin key.
Bots
Tailnet admin
Audits devices and uses Tailscale SSH only on allowed machines.
Plugins
None on day one. Follow the first-run steps.
Routines
None on the first run. Watch one manual pass first.
Shareable bot
Install click if you want it. The published prompt is still below for anyone who would rather paste.
Open on x.aiThe prompt
This is a tip, not a pasteable system prompt. The author did not publish one. Follow the first-run steps.
First run
- 1Read https://x.com/chevonphillip/status/2110517346641350934 (credit @chevonphillip).
- 2Create a tag such as tag:grokbot in your Tailscale ACLs.
- 3Write ACL rules so that tag reaches only the machines you choose.
- 4Join the bot's computer as a tagged server (no personal admin key).
- 5Tell the bot to audit first and ask before any change.
Approval fence
Every ACL, device, or SSH change waits for your yes. Keep the admin key with you.
What to tweak
Steal tag:grokbot + an ACL allowlist + ask-before-change.
Source
Chevy Phillip @chevonphillip · Original post
Not affiliated with xAI. We did not write this prompt. Third-party template terms still apply.
Pro pack
Want the full setup, not just the idea?
Pro packs give you the job text, prompts, schedules and pitfalls for popular use-cases.