peterwood/shell
1
0
Fork 0
mirror of https://github.com/acedanger/shell.git synced 2025-12-06 01:10:12 -08:00
Code Issues 19 Packages Projects Releases Wiki Activity

removed since the Tailscale ACLs are maintained in <https://github.com/acedanger/tailscale>

Browse Source
This commit is contained in:
Peter Wood
2025-05-29 13:13:07 -04:00
parent 4bdcc23822
commit 1cd2dace22
1 changed files with 0 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
dotfiles/tailscale-acl.json
View File

@@ -1,59 +0,0 @@
// Example/default ACLs for unrestricted connections.
{
// Define access control lists for users, groups, autogroups, tags,
// Tailscale IP addresses, and subnet ranges.
"acls": [
{
"action": "accept",
"src": ["tag:client", "tag:server", "acedanger49@gmail.com"],
"dst": ["tag:golink:*", "tag:server:*"],
},
// Allow all connections.
// Comment this section out if you want to define specific restrictions.
{"action": "accept", "src": ["*"], "dst": ["*:*"]},
],
// Define users and devices that can use Tailscale SSH.
"ssh": [
{
// any user can use Tailscale SSH to connect to their own devices
// in check mode as a root or non-root user
"action": "accept",
"src": ["tag:client", "tag:server", "acedanger49@gmail.com"],
"dst": ["tag:server"],
"users": ["autogroup:nonroot", "root"],
},
{
// any user can use Tailscale SSH to connect to their own devices
// in check mode as a root or non-root user
"action": "check",
"src": ["autogroup:member"],
"dst": ["autogroup:self"],
"users": ["autogroup:nonroot", "root"],
},
],
"nodeAttrs": [
{
// Funnel policy, which lets tailnet members control Funnel
// for their own devices.
// Learn more at https://tailscale.com/kb/1223/tailscale-funnel/
"target": ["autogroup:member"],
"attr": ["funnel"],
},
{"target": ["*"], "app": {"tailscale.com/app-connectors": []}},
],
// Define the tags which can be applied to devices and by which users.
"tagOwners": {
"tag:golink": ["acedanger49@gmail.com"],
"tag:server": ["acedanger49@gmail.com"],
"tag:client": ["acedanger49@gmail.com"],
"tag:docker": ["acedanger49@gmail.com"],
},
"autoapprovers": {
"exitNode": ["autogroup:admin"],
},
// Test access rules every time they're saved.
}