jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
my-homelab-configs/infra/tailscale
History
juvdiaz acb6817c98 Add repo-managed Tailscale ACL policy 2026-06-27 17:46:21 -06:00
..
README.md Add repo-managed Tailscale ACL policy 2026-06-27 17:46:21 -06:00
tailnet-policy.hujson Add repo-managed Tailscale ACL policy 2026-06-27 17:46:21 -06:00

README.md

Tailscale ACLs

This directory stores the intended tailnet policy as code.

  • tailnet-policy.hujson is the policy to review and apply in Tailscale.
  • scripts/validate-tailnet-policy performs repo-local checks before you copy or apply the policy.

The policy keeps the critical public edge path explicit:

OCI edge -> Debian Gitea over Tailscale
OCI edge -> Traefik MetalLB IP through approved subnet route
tailnet members -> Pi-hole DNS and selected homelab admin ports

The OCI edge node must be tagged tag:homelab-edge in Tailscale before the edge ACL is enforced. The tag owner is limited to tailnet admins.

Validate

scripts/validate-tailnet-policy

The validator checks that the HUJSON parses after comment/trailing-comma normalization and that host aliases match homelab.yml.

Apply

Apply manually from the Tailscale admin console:

  1. Open the tailnet ACL policy editor.
  2. Paste infra/tailscale/tailnet-policy.hujson.
  3. Use the preview/test flow in the console.
  4. Save only after the preview matches the intended access.

Do not apply this blindly from automation until the Tailscale API token and tailnet name are stored as SOPS-encrypted secrets.