115 lines
2.6 KiB
Text
115 lines
2.6 KiB
Text
|
{
|
||
|
|
// Declare static groups of users. Use autogroups for all users or users with a specific role.
|
||
|
|
"groups": {
|
||
|
|
"group:admin": ["tine.jozelj@tjo.space"],
|
||
|
|
},
|
||
|
|
|
||
|
|
// Define the tags which can be applied to devices and by which users.
|
||
|
|
"tagOwners": {
|
||
|
|
// Cloud
|
||
|
|
"tag:system-tjo-cloud": ["group:admin"],
|
||
|
|
"tag:network-tjo-cloud": ["group:admin"],
|
||
|
|
"tag:kubernetes-tjo-cloud": ["group:admin"],
|
||
|
|
"tag:ingress-tjo-cloud": ["group:admin"],
|
||
|
|
// Space
|
||
|
|
"tag:system-tjo-space": ["group:admin"],
|
||
|
|
},
|
||
|
|
|
||
|
|
"autoApprovers": {
|
||
|
|
"routes": {
|
||
|
|
// VM Subnets
|
||
|
|
"10.0.0.0/8": ["tag:network-tjo-cloud"],
|
||
|
|
"fd9b:5314::/32": ["tag:network-tjo-cloud"],
|
||
|
|
},
|
||
|
|
},
|
||
|
|
|
||
|
|
// Define access control lists for users, groups, autogroups, tags,
|
||
|
|
// Tailscale IP addresses, and subnet ranges.
|
||
|
|
"acls": [
|
||
|
|
// Own Devices
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["*"],
|
||
|
|
"dst": ["autogroup:self:*"],
|
||
|
|
},
|
||
|
|
// Between Systems
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["tag:system-tjo-cloud"],
|
||
|
|
"dst": ["tag:system-tjo-cloud:*"],
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["tag:system-tjo-space"],
|
||
|
|
"dst": ["tag:system-tjo-space:*"],
|
||
|
|
},
|
||
|
|
// From system.tjo.space to system.tjo.cloud Proxmox Access
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["tag:system-tjo-space"],
|
||
|
|
"dst": ["tag:system-tjo-cloud:8006"],
|
||
|
|
},
|
||
|
|
// Network to VM Subnets
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["tag:network-tjo-cloud"],
|
||
|
|
"dst": [
|
||
|
|
"10.0.0.0/8:*",
|
||
|
|
"fd9b:5314::/32:*",
|
||
|
|
],
|
||
|
|
},
|
||
|
|
// Admins Everywhere
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["group:admin"],
|
||
|
|
"dst": ["*:*"],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
// Define users and devices that can use Tailscale SSH.
|
||
|
|
"ssh": [
|
||
|
|
// Own Devices
|
||
|
|
{
|
||
|
|
"action": "check",
|
||
|
|
"src": ["autogroup:member"],
|
||
|
|
"dst": ["autogroup:self"],
|
||
|
|
"users": ["autogroup:nonroot", "root"],
|
||
|
|
},
|
||
|
|
// Between Systems
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["tag:system-tjo-cloud"],
|
||
|
|
"dst": ["tag:system-tjo-cloud"],
|
||
|
|
"users": ["autogroup:nonroot", "root"],
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["tag:system-tjo-space"],
|
||
|
|
"dst": ["tag:system-tjo-space"],
|
||
|
|
"users": ["autogroup:nonroot", "root"],
|
||
|
|
},
|
||
|
|
// Admins to Systems Access
|
||
|
|
{
|
||
|
|
"action": "accept",
|
||
|
|
"src": ["group:admin"],
|
||
|
|
"dst": [
|
||
|
|
"tag:system-tjo-space",
|
||
|
|
"tag:system-tjo-cloud",
|
||
|
|
"tag:ingress-tjo-cloud",
|
||
|
|
"tag:network-tjo-cloud",
|
||
|
|
],
|
||
|
|
"users": ["autogroup:nonroot", "root"],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
"nodeAttrs": [
|
||
|
|
{
|
||
|
|
// Funnel policy, which lets tailnet members control Funnel
|
||
|
|
// for their own devices.
|
||
|
|
// Learn more at https://tailscale.com/kb/1223/tailscale-funnel/
|
||
|
|
"target": ["autogroup:member"],
|
||
|
|
"attr": ["funnel"],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
}
|