Erich Blume 08d57ef4d4 Review pulumi reference doc: fix Tailscale auth, add how-to links

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-02 10:55:57 -07:00

1.7 KiB

Raw Blame History

title

modified

last-reviewed

Pulumi

Infrastructure-as-Code for DNS and Tailscale ACL management. Two independent projects, both using the Python SDK with uv toolchain.

Projects

Project	Stack	Source	Manages
`blumeops-dns`	`eblu-me`	`pulumi/gandi/`	DNS records for `eblu.me` via Gandi LiveDNS
`blumeops-tailnet`	`tail8d86e`	`pulumi/tailscale/`	ACL policy, device tags, auth keys

DNS (`blumeops-dns`)

Manages *.ops.eblu.me wildcard and base records pointing to indri's Tailscale IP, plus public CNAME records for services routed via flyio-proxy.

Tailnet (`blumeops-tailnet`)

Manages the ACL policy (policy.hujson), device tags for indri and sifaka, and auth keys for the Fly.io proxy.

CLI Patterns

All operations use mise tasks that wrap pulumi with the correct stack and working directory:

# DNS
mise run dns-preview     # Preview DNS changes
mise run dns-up          # Apply DNS changes

# Tailscale
mise run tailnet-preview # Preview ACL/tag changes
mise run tailnet-up      # Apply ACL/tag changes

Authentication

Gandi: GANDI_PERSONAL_ACCESS_TOKEN (fetched from 1Password by the mise task)
Tailscale: TAILSCALE_OAUTH_CLIENT_ID + TAILSCALE_OAUTH_CLIENT_SECRET (fetched from 1Password by the mise task)
Pulumi state: Local backend (no Pulumi Cloud)

gandi-operations — DNS PAT rotation and Pulumi workflow
update-tailscale-acls — ACL editing and Pulumi workflow
gandi — DNS hosting
tailscale — Tailnet configuration
routing — How DNS records map to services

1.7 KiB Raw Blame History