CIOverlayVPNAccess

---

title: CI Overlay VPN Access type: technique created: 2026-05-26 last_updated: 2026-05-26 related: ["radar/techniques/WireGuardTunnel", "radar/tools/TailscaleSynology", "radar/platforms/Defguard"] sources: ["https://github.com/zerotier/github-action"] radar_quadrant: Techniques radar_ring: Assess radar_position: inner

CI Overlay VPN Access

Pattern for connecting ephemeral CI runners (GitHub Actions, GitLab CI) to private infrastructure — self-hosted Kubernetes clusters, internal Docker registries, homelab staging environments — by joining the runner to a mesh VPN overlay network at job start and leaving at job end.

The Problem

GitHub-hosted CI runners live on the public internet. They cannot reach services behind a firewall or on a private network without a connection mechanism. Common workarounds are fragile:

• Static firewall rules with GitHub's published IP ranges — GitHub's IP ranges change and are shared across all customers; this is not meaningful access control
• Bastion hosts and SSH tunnels — requires maintaining persistent jump infrastructure
• Exposing private services publicly — expands the attack surface

The overlay VPN approach is cleaner: the runner joins the private network for the duration of the job, reaches any resource on that network by private IP, then disappears.

Implementation

ZeroTier variant:

- name: Join ZeroTier network
  uses: zerotier/github-action@v1
  with:
    network_id: ${{ secrets.ZEROTIER_NETWORK_ID }}
    auth_token: ${{ secrets.ZEROTIER_TOKEN }}

- name: Deploy to private cluster
  run: kubectl apply -f manifests/

Tailscale variant (alternative, same pattern):

- name: Connect to Tailscale
  uses: tailscale/github-action@v2
  with:
    authkey: ${{ secrets.TAILSCALE_AUTHKEY }}

Both approaches join the runner to an existing overlay network using a one-time auth key. The runner receives a private IP and can reach any authorised resource on the network. Authorization is controlled by the mesh VPN platform — ZeroTier Central or Tailscale ACLs — not by firewall rules.

Use Cases

• Integration tests against a private database or service
• Deployments to a self-hosted Kubernetes cluster
• Pushing images to a private Docker registry
• Running smoke tests against a homelab staging environment
• Fetching secrets from a self-hosted Vault or Infisical instance

Radar Assessment

CI Overlay VPN Access sits in the Assess ring of the Techniques quadrant, at inner position. First studied via the ZeroTier GitHub Action repository (2024-09-03). The pattern is directly applicable to any team running private infrastructure that CI needs to reach — a common homelab and small-team scenario. The ephemeral join model avoids persistent firewall holes or bastion maintenance. ZeroTier and Tailscale both provide official GitHub Actions for this. Inner position reflects zero ongoing infrastructure cost (both have free tiers), clear implementation path, and direct complementarity with WireGuard Tunnel, Tailscale for Synology, and defguard already on the radar. Remaining gate before Trial is a working CI pipeline that deploys to or tests against a private service using this pattern.