-- Bring-your-own Tailscale: a workspace connects its own tailnet so we can read
-- fleet network metrics (the Tailscale device list) via their API key. The key
-- is only ever used server-side for outbound calls to api.tailscale.com.
-- TODO: move api_key into the cm-secrets broker store (like `connections`).
CREATE TABLE workspace_tailscale (
    workspace_id UUID PRIMARY KEY REFERENCES workspaces (id) ON DELETE CASCADE,
    api_key      TEXT NOT NULL,
    tailnet      TEXT NOT NULL,
    connected_at TIMESTAMPTZ NOT NULL DEFAULT now()
);