40 lines
1.2 KiB
Markdown
40 lines
1.2 KiB
Markdown
# Tailscale ACLs
|
|
|
|
This directory stores the intended tailnet policy as code.
|
|
|
|
- `tailnet-policy.hujson` is the policy to review and apply in Tailscale.
|
|
- `scripts/validate-tailnet-policy` performs repo-local checks before you copy
|
|
or apply the policy.
|
|
|
|
The policy keeps the critical public edge path explicit:
|
|
|
|
```text
|
|
OCI edge -> Debian Gitea over Tailscale
|
|
OCI edge -> Traefik MetalLB IP through approved subnet route
|
|
tailnet members -> Pi-hole DNS and selected homelab admin ports
|
|
```
|
|
|
|
The OCI edge node must be tagged `tag:homelab-edge` in Tailscale before the
|
|
edge ACL is enforced. The tag owner is limited to tailnet admins.
|
|
|
|
## Validate
|
|
|
|
```bash
|
|
scripts/validate-tailnet-policy
|
|
```
|
|
|
|
The validator checks that the HUJSON parses after comment/trailing-comma
|
|
normalization and that host aliases match `homelab.yml`.
|
|
|
|
## Apply
|
|
|
|
Apply manually from the Tailscale admin console:
|
|
|
|
1. Open the tailnet ACL policy editor.
|
|
2. Paste `infra/tailscale/tailnet-policy.hujson`.
|
|
3. Use the preview/test flow in the console.
|
|
4. Save only after the preview matches the intended access.
|
|
|
|
Do not apply this blindly from automation until the Tailscale API token and
|
|
tailnet name are stored as SOPS-encrypted secrets.
|