peterwood/shell
1
0
Fork 0
mirror of https://github.com/acedanger/shell.git synced 2025-12-06 03:20:12 -08:00
Code Issues 19 Packages Projects Releases Wiki Activity

slimmed down acl after reddit post feedback

Browse Source
This commit is contained in:
Peter Wood
2024-11-14 15:11:40 +00:00
parent 535c0b3c39
commit be3eea5d80
1 changed files with 3 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
tailscale-acl.json
View File

@@ -1,38 +1,25 @@
// Example/default ACLs for unrestricted connections. // Example/default ACLs for unrestricted connections.
{ {
// Declare static groups of users. Use autogroups for all users or users with a specific role.
"groups": {
"group:admin": ["acedanger49@gmail.com"],
"group:owner": ["acedanger49@gmail.com"],
},
// Define access control lists for users, groups, autogroups, tags, // Define access control lists for users, groups, autogroups, tags,
// Tailscale IP addresses, and subnet ranges. // Tailscale IP addresses, and subnet ranges.
"acls": [ "acls": [
{ {
"action": "accept", "action": "accept",
"src": ["tag:client", "tag:server"], "src": ["tag:client", "tag:server", "acedanger49@gmail.com"],
"dst": ["tag:golink:*", "tag:server:*"], "dst": ["tag:golink:*", "tag:server:*"],
}, },
// Allow all connections. // Allow all connections.
// Comment this section out if you want to define specific restrictions. // Comment this section out if you want to define specific restrictions.
{"action": "accept", "src": ["*"], "dst": ["*:*"]}, {"action": "accept", "src": ["*"], "dst": ["*:*"]},
], ],
"hosts": {
"ts-io": "100.114.112.100",
"ts-svr-office": "100.84.197.41",
"ts-vperanda": "100.102.106.71",
"ts-wood-surface8": "100.67.131.121",
"ts-desktop-pete": "100.102.106.71",
"go": "100.112.82.132",
},
// Define users and devices that can use Tailscale SSH. // Define users and devices that can use Tailscale SSH.
"ssh": [ "ssh": [
{ {
// any user can use Tailscale SSH to connect to their own devices // any user can use Tailscale SSH to connect to their own devices
// in check mode as a root or non-root user // in check mode as a root or non-root user
"action": "accept", "action": "accept",
"src": ["tag:client", "tag:server"], "src": ["tag:client", "tag:server", "acedanger49@gmail.com"],
"dst": ["tag:server"], "dst": ["tag:server"],
"users": ["autogroup:nonroot", "root"], "users": ["autogroup:nonroot", "root"],
}, },