Erich Blume
e6d302b40b
## Summary - Replace permissive wildcard ACL (`*` -> `*`) with specific service grants - Admin: full access to all services including NAS - Member: user-facing services only (no Grafana/Loki/NAS) - Add device tagging for gilbert (workstation) and sifaka (NAS) via Pulumi - SSH hardening: remove root access, use "check" action with MFA - Add ACL tests to validate policy behavior ## Deployment and Testing - [x] Pulumi preview passes - [x] HuJSON syntax validated - [x] ACL tests defined and passing - [ ] Deploy with `mise run tailnet-up` - [ ] Verify SSH access from gilbert to indri - [ ] Verify Allison cannot access Grafana/Loki/NAS 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/23 |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| __main__.py | ||
| policy.hujson | ||
| Pulumi.tail8d86e.yaml | ||
| Pulumi.yaml | ||
| pyproject.toml | ||