nobody  ALL=NOPASSWD: /usr/local/bin/tailscale-wrapper
