blumeops/pulumi/policy.hujson

// Example/default ACLs for unrestricted connections.
{
	// Declare static groups of users. Use autogroups for all users or users with a specific role.
	// "groups": {
	//   "group:example": ["alice@example.com", "bob@example.com"],
	// },

	// Define the tags which can be applied to devices and by which users.
	// "tagOwners": {
	//   "tag:example": ["autogroup:admin"],
	// },

	// Define grants that govern access for users, groups, autogroups, tags,
	// Tailscale IP addresses, and subnet ranges.
	"grants": [
		// Allow all connections.
		// Comment this section out if you want to define specific restrictions.
		{
			"src": ["*"],
			"dst": ["*"],
			"ip":  ["*"],
		},

		// Allow users in "group:example" to access "tag:example", but only from
		// devices that are running macOS and have enabled Tailscale client auto-updating.
		// {"src": ["group:example"], "dst": ["tag:example"], "ip": ["*"], "srcPosture":["posture:autoUpdateMac"]},
	],

	// Define postures that will be applied to all rules without any specific
	// srcPosture definition.
	// "defaultSrcPosture": [
	//      "posture:anyMac",
	// ],

	// Define device posture rules requiring devices to meet
	// certain criteria to access parts of your system.
	// "postures": {
	//      // Require devices running macOS, a stable Tailscale
	//      // version and auto update enabled for Tailscale.
	//  "posture:autoUpdateMac": [
	//      "node:os == 'macos'",
	//      "node:tsReleaseTrack == 'stable'",
	//      "node:tsAutoUpdate",
	//  ],
	//      // Require devices running macOS and a stable
	//      // Tailscale version.
	//  "posture:anyMac": [
	//      "node:os == 'macos'",
	//      "node:tsReleaseTrack == 'stable'",
	//  ],
	// },

	// Define users and devices that can use Tailscale SSH.
	"ssh": [
		// Allow all users to SSH into their own devices in check mode.
		// Comment this section out if you want to define specific restrictions.
		{
			"action": "check",
			"src":    ["autogroup:member"],
			"dst":    ["autogroup:self"],
			"users":  ["autogroup:nonroot", "root"],
		},
		// Allow Erich to ssh on to the homelab server.
		{
			"src":         ["blume.erich@gmail.com"],
			"dst":         ["tag:homelab"],
			"users":       ["autogroup:nonroot"],
			"action":      "check",
			"checkPeriod": "12h0m0s",
		},
	],

	"tagOwners": {
		// Grafana service host tag
		"tag:grafana": ["autogroup:admin", "tag:blumeops"],

		// This tag applies to instances which are meant to be accessible in my homelab. These instances can be SSH'ed in to by any member of the admin autogroup.
		"tag:homelab": ["autogroup:admin", "tag:blumeops"],

		// Kiwix, a local wiki server. I use it to create mirrors of wikipedia.
		"tag:kiwix": ["autogroup:admin", "tag:blumeops"],

		// Service tag for forgejo, scm host and code forge
		"tag:forge": ["autogroup:admin", "tag:blumeops"],

		// devpi pypi index
		"tag:devpi": ["autogroup:admin", "tag:blumeops"],

		// Loki log collection
		"tag:loki": ["autogroup:admin", "tag:blumeops"],

		// PostgreSQL database server
		"tag:pg": ["autogroup:admin", "tag:blumeops"],

		// Miniflux RSS/Atom feed reader
		"tag:feed": ["autogroup:admin", "tag:blumeops"],

		// This tag is applied to resources modified by blumeops-pulumi IaC
		// Includes itself so the OAuth client can apply it to devices
		"tag:blumeops": ["autogroup:admin", "tag:blumeops"],
	},

	// Test access rules every time they're saved.
	// "tests": [
	//   {
	//       "src": "alice@example.com",
	//       "accept": ["tag:example"],
	//       "deny": ["100.101.102.103:443"],
	//   },
	// ],
}