// Homelab tailnet policy managed in this repository.
//
// Review in the Tailscale admin console or with the Tailscale API before
// applying. Device tags are optional until you tag machines in the console.
{
  "tagOwners": {
    "tag:homelab-admin": ["autogroup:admin"],
    "tag:homelab-control-plane": ["autogroup:admin"],
    "tag:homelab-rpi": ["autogroup:admin"],
    "tag:homelab-edge": ["autogroup:admin"],
  },

  "hosts": {
    "debian": "100.85.138.30",
    "rpi4": "100.77.80.72",
    "oci-edge": "100.118.255.19",
    "traefik-lan": "192.168.100.240",
  },

  "acls": [
    // Full access for tailnet admins.
    {
      "action": "accept",
      "src": ["autogroup:admin"],
      "dst": ["*:*"],
    },

    // Public edge path back into the homelab over Tailscale and approved
    // subnet routes. Tag the OCI edge node with tag:homelab-edge before
    // relying on this rule for lab2025.duckdns.org.
    {
      "action": "accept",
      "src": ["tag:homelab-edge"],
      "dst": [
        "debian:3000",
        "traefik-lan:80,443",
      ],
    },

    // Homelab members can reach normal operational surfaces.
    {
      "action": "accept",
      "src": ["autogroup:member"],
      "dst": [
        "debian:22,3000,32222,30500,8088,11434",
        "rpi4:22,53,8081,3001",
        "oci-edge:22,80,443",
      ],
    },

    // DNS from tailnet clients to the RPi resolver.
    {
      "action": "accept",
      "src": ["autogroup:member"],
      "dst": ["rpi4:53"],
    },
  ],

  "ssh": [
    {
      "action": "accept",
      "src": ["autogroup:admin"],
      "dst": [
        "tag:homelab-admin",
        "tag:homelab-control-plane",
        "tag:homelab-rpi",
        "tag:homelab-edge",
      ],
      "users": ["jv", "ubuntu", "root"],
    },
  ],

  "autoApprovers": {
    "routes": {
      "192.168.100.0/24": [
        "tag:homelab-edge",
        "tag:homelab-rpi",
      ],
    },
  },
}