Setting up a PostHog devbox

A devbox is a Coder workspace running the full PostHog stack on an EC2 instance, managed through hogli devbox:* (the only supported interface — drive those commands, don't reimplement them). It ships ready to use: the repo cloned at ~/posthog, the stack pre-warmed, and Claude Code installed. This skill gets a dev connected and working; how they personalize beyond that is their choice, not something to push.

Prerequisite: tailnet access (the thing people miss)

The devbox control plane lives inside a private VPC reachable only over Tailscale. The ACL that grants the route is tailnet-policy.hujson in posthog-cloud-infra: your email must be in group:engineering. Without that grant, the Coder control plane (10.70.0.1:443) is simply unroutable and every hogli devbox:* command dies at the reachability check — not an auth or install problem, and no amount of re-running devbox:setup fixes it.

If hogli devbox:doctor reports the control plane unreachable, the fix is a PR adding the user to group:engineering in tailnet-policy.hujson (then ask Team DevEx if still blocked). Diagnose this before touching anything else.

Control plane unreachable with a DNS cause? Check the exit node first

When doctor shows [ok] Tailscale connected but fails reachability with a DNS cause (DNS lookup for coder.dev.posthog.dev failed), that's usually not the grant: the client's split-DNS routes don't cover dev.posthog.dev, so the name never reaches the internal resolver. The fix is selecting a Tailscale exit node — it routes DNS through infra that resolves *.dev.posthog.dev. Check available exit nodes and select one via the Tailscale menu bar app (Exit Node) or CLI: