Erich Blume
7112297150
Phase 1 of docs restructuring: move all zettelkasten cards to a temporary docs/zk/ subdirectory while preparing to build a new Diataxis-based documentation structure. - Move all existing markdown files from docs/ to docs/zk/ - Update zk-docs mise task to look in the new location - Add docs/README.md explaining the restructuring plan Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1.7 KiB
1.7 KiB
| id | aliases | tags | |||
|---|---|---|---|---|---|
| pulumi |
|
|
Pulumi Tailnet IaC Management Log
Pulumi manages the tail8d86e.ts.net tailnet configuration, including ACLs, tags, and DNS settings.
Architecture
Two-layer approach:
- Layer 1 (Pulumi): Tailnet-wide config - ACLs, tags, DNS (this card)
- Layer 2 (Ansible): Node-local
tailscale serveconfig - seetailscale_serverole
Service Details
- State backend: Pulumi Cloud (https://app.pulumi.com/eblume/blumeops-tailnet)
- Stack:
tail8d86e - Config directory:
pulumi/in blumeops repo - Policy file:
pulumi/policy.hujson(HuJSON with comments)
Authentication
Uses OAuth client stored in 1Password (blumeops vault):
- Client configured with scopes: acl, dns, devices, services
- Auto-applies
tag:blumeopsto IaC-managed resources
Useful Commands
# Preview changes
mise run tailnet-preview
# Apply changes
mise run tailnet-up
# View current state
mise run tailnet-preview
# Pass additional args
mise run tailnet-up -- --yes
Making ACL Changes
- Edit
pulumi/policy.hujsonin the blumeops repo - Run
mise run tailnet-previewto see what will change - Run
mise run tailnet-upto apply - Commit and push
What's Managed
Currently managed by Pulumi:
- ACL policy (
tailscale:index:Acl)
Can be added later:
- DNS nameservers (
tailscale:index:DnsNameservers) - DNS search paths (
tailscale:index:DnsSearchPaths) - Tailnet settings (
tailscale:index:TailnetSettings)
Log
Wed Jan 15 2026
- Initial setup with Pulumi + Python
- Imported existing ACL from Tailscale
- State stored in Pulumi Cloud (free tier)
- OAuth authentication via 1Password