128 lines
2.1 KiB
Markdown
128 lines
2.1 KiB
Markdown
---
|
|
title: Update Tailscale ACLs
|
|
modified: 2026-02-25
|
|
last-reviewed: 2026-02-25
|
|
tags:
|
|
- how-to
|
|
- tailscale
|
|
- pulumi
|
|
---
|
|
|
|
# Update Tailscale ACLs
|
|
|
|
How to modify Tailscale access control policies for the tailnet.
|
|
|
|
## Prerequisites
|
|
|
|
- Pulumi CLI installed (`brew install pulumi`)
|
|
- Access to 1Password blumeops vault (for OAuth credentials)
|
|
|
|
## Edit the Policy
|
|
|
|
The ACL policy lives in `pulumi/tailscale/policy.hujson` (HuJSON format with comments).
|
|
|
|
Common changes:
|
|
|
|
### Add a new ACL rule
|
|
|
|
```json
|
|
{
|
|
"acls": [
|
|
// ... existing rules ...
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:admin"],
|
|
"dst": ["tag:newservice:*"]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
### Add a new tag
|
|
|
|
```json
|
|
{
|
|
"tagOwners": {
|
|
// ... existing tags ...
|
|
"tag:newservice": ["autogroup:admin"]
|
|
}
|
|
}
|
|
```
|
|
|
|
### Add a new group
|
|
|
|
```json
|
|
{
|
|
"groups": {
|
|
// ... existing groups ...
|
|
"group:newgroup": ["user1@example.com", "user2@example.com"]
|
|
}
|
|
}
|
|
```
|
|
|
|
## Preview and Apply
|
|
|
|
```bash
|
|
# Preview changes (always do this first)
|
|
mise run tailnet-preview
|
|
|
|
# Apply changes (auto-confirms via --yes)
|
|
mise run tailnet-up
|
|
```
|
|
|
|
## Verify
|
|
|
|
Check the Tailscale admin console at https://login.tailscale.com/ to confirm changes.
|
|
|
|
## Common Patterns
|
|
|
|
### Service-specific access
|
|
|
|
Grant access to a specific service port:
|
|
|
|
```json
|
|
{
|
|
"action": "accept",
|
|
"src": ["group:users"],
|
|
"dst": ["tag:homelab:8080"]
|
|
}
|
|
```
|
|
|
|
### SSH access
|
|
|
|
```json
|
|
{
|
|
"ssh": [
|
|
{
|
|
"action": "check",
|
|
"src": ["autogroup:admin"],
|
|
"dst": ["tag:servers"],
|
|
"users": ["autogroup:nonroot"]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
### All ports for admins
|
|
|
|
```json
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:admin"],
|
|
"dst": ["*:*"]
|
|
}
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
**"Credential expired" error:**
|
|
Re-authenticate Pulumi with Tailscale. The OAuth token may need refreshing.
|
|
|
|
**Changes not taking effect:**
|
|
ACL changes are applied immediately. If a device isn't following new rules, try `tailscale down && tailscale up` on that device.
|
|
|
|
## Related
|
|
|
|
- [[tailscale]] - ACL reference and current configuration
|
|
- [[pulumi]] - Pulumi IaC reference
|
|
- [[routing]] - Service routing
|