# Tailscale ACLs

This directory stores the intended tailnet policy as code.

- `tailnet-policy.hujson` is the policy to review and apply in Tailscale.
- `scripts/validate-tailnet-policy` performs repo-local checks before you copy
  or apply the policy.

The policy keeps the critical public edge path explicit:

```text
OCI edge -> Debian Gitea over Tailscale
OCI edge -> Traefik MetalLB IP through approved subnet route
tailnet members -> Pi-hole DNS and selected homelab admin ports
```

The OCI edge node must be tagged `tag:homelab-edge` in Tailscale before the
edge ACL is enforced. The tag owner is limited to tailnet admins.

## Validate

```bash
scripts/validate-tailnet-policy
```

The validator checks that the HUJSON parses after comment/trailing-comma
normalization and that host aliases match `homelab.yml`.

## Apply

Apply manually from the Tailscale admin console:

1. Open the tailnet ACL policy editor.
2. Paste `infra/tailscale/tailnet-policy.hujson`.
3. Use the preview/test flow in the console.
4. Save only after the preview matches the intended access.

Do not apply this blindly from automation until the Tailscale API token and
tailnet name are stored as SOPS-encrypted secrets.