Erich Blume
eb952aae01
## Summary - Fixed borgmatic `borg: command not found` by adding `local_path` config option - Successfully tested disaster recovery: restored miniflux data from borgmatic backup to k8s-pg - Added borgmatic user to k8s-pg via CloudNativePG managed roles - Configured borgmatic to backup both localhost and k8s-pg PostgreSQL databases - Added Tailscale ACL grant for `tag:homelab` → `tag:k8s` on port 5432 - Disabled selfHeal on apps app to allow manual revision changes during development ## Changes - `ansible/roles/borgmatic/` - Added `local_path` and k8s-pg database entry - `ansible/roles/postgresql/tasks/main.yml` - Added k8s-pg to `.pgpass` - `argocd/apps/apps.yaml` - Disabled selfHeal - `argocd/manifests/databases/blumeops-pg.yaml` - Added borgmatic managed role - `argocd/manifests/databases/secret-borgmatic.yaml.tpl` - New secret template - `pulumi/policy.hujson` - Added ACL grant for backup access ## Deployment and Testing - [x] Borgmatic backup runs successfully - [x] Miniflux data restored to k8s-pg (2 users, 2 feeds, 44 entries verified) - [x] borgmatic user created in k8s-pg with pg_read_all_data role - [x] Both localhost and k8s-pg databases in backup archive - [x] zk documentation updated (borgmatic.md, postgresql.md) - [ ] After merge: set blumeops-pg app back to main revision 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/32
155 lines
4.1 KiB
Text
155 lines
4.1 KiB
Text
// Tailnet ACL policy for tail8d86e.ts.net
|
|
// Managed by blumeops-pulumi
|
|
{
|
|
// ============== Groups ==============
|
|
"groups": {
|
|
// Placeholder for future Jellyfin media access
|
|
"group:allisonflix": [
|
|
"blume.erich@gmail.com",
|
|
"acmdavis@gmail.com",
|
|
],
|
|
},
|
|
|
|
// ============== Access Grants ==============
|
|
"grants": [
|
|
// --- Admins: full access to all infrastructure ---
|
|
{
|
|
"src": ["autogroup:admin"],
|
|
"dst": ["*"],
|
|
"ip": ["*"],
|
|
},
|
|
|
|
// --- Members: user-facing services only ---
|
|
// Kiwix, Forge, devpi, Miniflux, PostgreSQL
|
|
{
|
|
"src": ["autogroup:member"],
|
|
"dst": ["tag:kiwix"],
|
|
"ip": ["tcp:443"],
|
|
},
|
|
{
|
|
"src": ["autogroup:member"],
|
|
"dst": ["tag:forge"],
|
|
"ip": ["tcp:443", "tcp:22"],
|
|
},
|
|
{
|
|
"src": ["autogroup:member"],
|
|
"dst": ["tag:devpi"],
|
|
"ip": ["tcp:443"],
|
|
},
|
|
{
|
|
"src": ["autogroup:member"],
|
|
"dst": ["tag:feed"],
|
|
"ip": ["tcp:443"],
|
|
},
|
|
{
|
|
"src": ["autogroup:member"],
|
|
"dst": ["tag:pg"],
|
|
"ip": ["tcp:5432"],
|
|
},
|
|
// Note: No member access to grafana, loki, or NAS
|
|
|
|
// --- Infrastructure ---
|
|
{
|
|
"src": ["tag:homelab"],
|
|
"dst": ["tag:homelab"],
|
|
"ip": ["*"],
|
|
},
|
|
{
|
|
"src": ["tag:homelab"],
|
|
"dst": ["tag:nas"],
|
|
"ip": ["*"],
|
|
},
|
|
|
|
// --- Kubernetes workloads ---
|
|
// k8s workloads (e.g., Woodpecker CI) can push/pull from registry
|
|
{
|
|
"src": ["tag:k8s"],
|
|
"dst": ["tag:registry"],
|
|
"ip": ["tcp:443"],
|
|
},
|
|
// k8s workloads (e.g., ArgoCD) can access forge on indri for GitOps
|
|
// HTTP on 3001, SSH on 2200
|
|
{
|
|
"src": ["tag:k8s"],
|
|
"dst": ["tag:homelab"],
|
|
"ip": ["tcp:3001", "tcp:2200"],
|
|
},
|
|
// Homelab can reach k8s PostgreSQL for borgmatic backups
|
|
{
|
|
"src": ["tag:homelab"],
|
|
"dst": ["tag:k8s"],
|
|
"ip": ["tcp:5432"],
|
|
},
|
|
],
|
|
|
|
// ============== SSH Access ==============
|
|
"ssh": [
|
|
// Members can SSH to their own devices
|
|
{
|
|
"action": "check",
|
|
"src": ["autogroup:member"],
|
|
"dst": ["autogroup:self"],
|
|
"users": ["autogroup:nonroot"],
|
|
},
|
|
// Admins can SSH to homelab (for ansible)
|
|
{
|
|
"action": "check",
|
|
"src": ["autogroup:admin"],
|
|
"dst": ["tag:homelab"],
|
|
"users": ["autogroup:nonroot"],
|
|
"checkPeriod": "12h0m0s",
|
|
},
|
|
// Admins can SSH to NAS
|
|
{
|
|
"action": "check",
|
|
"src": ["autogroup:admin"],
|
|
"dst": ["tag:nas"],
|
|
"users": ["autogroup:nonroot"],
|
|
"checkPeriod": "12h0m0s",
|
|
},
|
|
],
|
|
|
|
// ============== Tag Owners ==============
|
|
"tagOwners": {
|
|
"tag:blumeops": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:homelab": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:workstation": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:nas": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:grafana": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:kiwix": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:forge": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:devpi": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:loki": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:pg": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:feed": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:registry": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:k8s-api": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:k8s-operator": ["autogroup:admin", "tag:blumeops"],
|
|
"tag:k8s": ["autogroup:admin", "tag:blumeops", "tag:k8s-operator"],
|
|
},
|
|
|
|
// ============== ACL Tests ==============
|
|
"tests": [
|
|
// Erich can access everything
|
|
{
|
|
"src": "blume.erich@gmail.com",
|
|
"accept": ["tag:grafana:443", "tag:kiwix:443", "tag:feed:443", "tag:loki:3100", "tag:pg:5432", "tag:homelab:22", "tag:registry:443", "tag:k8s-api:443"],
|
|
},
|
|
// Allison can access user services but NOT grafana, loki, or NAS
|
|
{
|
|
"src": "acmdavis@gmail.com",
|
|
"accept": ["tag:kiwix:443", "tag:forge:443", "tag:feed:443", "tag:pg:5432"],
|
|
"deny": ["tag:grafana:443", "tag:loki:3100", "tag:nas:445", "tag:registry:443", "tag:k8s-api:443"],
|
|
},
|
|
// Homelab can reach homelab and NAS
|
|
{
|
|
"src": "tag:homelab",
|
|
"accept": ["tag:homelab:22", "tag:nas:445"],
|
|
},
|
|
// K8s workloads can reach registry and forge (on indri:3001 HTTP, :2200 SSH)
|
|
{
|
|
"src": "tag:k8s",
|
|
"accept": ["tag:registry:443", "tag:homelab:3001", "tag:homelab:2200"],
|
|
},
|
|
],
|
|
}
|