82 lines
1.9 KiB
Plaintext
82 lines
1.9 KiB
Plaintext
// Homelab tailnet policy managed in this repository.
|
|
//
|
|
// Review in the Tailscale admin console or with the Tailscale API before
|
|
// applying. Device tags are optional until you tag machines in the console.
|
|
{
|
|
"tagOwners": {
|
|
"tag:homelab-admin": ["autogroup:admin"],
|
|
"tag:homelab-control-plane": ["autogroup:admin"],
|
|
"tag:homelab-rpi": ["autogroup:admin"],
|
|
"tag:homelab-edge": ["autogroup:admin"],
|
|
},
|
|
|
|
"hosts": {
|
|
"debian": "100.85.138.30",
|
|
"rpi4": "100.77.80.72",
|
|
"oci-edge": "100.118.255.19",
|
|
"traefik-lan": "192.168.100.240",
|
|
},
|
|
|
|
"acls": [
|
|
// Full access for tailnet admins.
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:admin"],
|
|
"dst": ["*:*"],
|
|
},
|
|
|
|
// Public edge path back into the homelab over Tailscale and approved
|
|
// subnet routes. Tag the OCI edge node with tag:homelab-edge before
|
|
// relying on this rule for lab2025.duckdns.org.
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:homelab-edge"],
|
|
"dst": [
|
|
"debian:3000",
|
|
"traefik-lan:80,443",
|
|
],
|
|
},
|
|
|
|
// Homelab members can reach normal operational surfaces.
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:member"],
|
|
"dst": [
|
|
"debian:22,3000,32222,30500,8088,11434",
|
|
"rpi4:22,53,8081,3001",
|
|
"oci-edge:22,80,443",
|
|
],
|
|
},
|
|
|
|
// DNS from tailnet clients to the RPi resolver.
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:member"],
|
|
"dst": ["rpi4:53"],
|
|
},
|
|
],
|
|
|
|
"ssh": [
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:admin"],
|
|
"dst": [
|
|
"tag:homelab-admin",
|
|
"tag:homelab-control-plane",
|
|
"tag:homelab-rpi",
|
|
"tag:homelab-edge",
|
|
],
|
|
"users": ["jv", "ubuntu", "root"],
|
|
},
|
|
],
|
|
|
|
"autoApprovers": {
|
|
"routes": {
|
|
"192.168.100.0/24": [
|
|
"tag:homelab-edge",
|
|
"tag:homelab-rpi",
|
|
],
|
|
},
|
|
},
|
|
}
|