tailscale-acl.hujson

// This tailnet's ACLs are maintained in https://github.com/BCNelson/nix-config

// Example/default ACLs for unrestricted connections.
{
	// Declare static groups of users beyond those in the identity service.
	"groups": {
		"group:admin": ["bradleynelson102@gmail.com"],
		"group:nelsonFamily": [
			"bradleynelson102@gmail.com",
			"cknelson8@gmail.com",
			"cwnelson1990@gmail.com"
		],
		"group:gaming": [
			"brennonschow@gmail.com",
			"nelson.7.jeffery@gmail.com"
		]
	},

	// Declare convenient hostname aliases to use in place of IP addresses.
	"hosts": {
		"vor": "100.73.83.164",
		"vor6": "fd7a:115c:a1e0:ab12:4843:cd96:6249:53a4",
		"romeo": "100.76.49.168",
		"romeo6": "fd7a:115c:a1e0:ab12:4843:cd96:624c:31a8",
		"xray": "100.114.232.151",
		"porter-pc": "100.111.54.18",
		"sierra": "100.92.32.99",
		"whiskey": "100.89.15.100",
		"whiskey6": "fd7a:115c:a1e0::ad01:f64"
	},

	"tagOwners": {
		"tag:server":  ["bradleynelson102@gmail.com"],
		"tag:client":  ["bradleynelson102@gmail.com"],
		"tag:iso":     ["bradleynelson102@gmail.com"]
	},

	// Access control lists.
	"acls": [
		// Match absolutely everything.
		// Comment this section out if you want to define specific restrictions.
		{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]},
		// Allow Outgoing syncthing connections
		{"action": "accept", "src": ["romeo", "romeo6"], "dst": ["*:22000"]},
		// Allow to vor for smb
		{"action": "accept", "src": ["group:nelsonFamily"], "dst": ["vor:445"]},
		{"action": "accept", "src": ["romeo", "romeo6"], "dst": ["tag:server:22"]},
		{"action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:22"]},
		{"action": "accept", "src": ["group:gaming"], "dst": ["sierra:52450"]},
		// Prometheus node exporter
		{"action": "accept", "src": ["whiskey", "whiskey6"], "dst": ["tag:server:9100"]},
		//Loki
		{"action": "accept", "src": ["tag:server"], "dst": ["whiskey:3100", "whiskey6:3100"]}
	],
	"ssh": [
		{
			"action": "accept",
			"src":    ["group:admin"],
			"dst":    ["tag:server"],
			"users":  ["autogroup:nonroot", "root"]
		},
		{
			"action": "accept",
			"src":    ["group:admin"],
			"dst":    ["tag:client"],
			"users":  ["autogroup:nonroot", "root"]
		},
		{ // any user can use Tailscale SSH to connect to their own devices
			// in check mode as a root or non-root user
			"action": "check",
			"src": ["autogroup:member"],
			"dst": ["autogroup:self"],
			"users": ["autogroup:nonroot"]
		},
		{
			"action": "accept",
			"src":    ["tag:server"],
			"dst":    ["tag:server"],
			// "users":  ["syncoid"]
			"users":  ["autogroup:nonroot", "root"]
		}
	],
	"tests": [
		{
			"src": "bradleynelson102@gmail.com",
			"accept": ["tag:server:22"]
		},
		{
			"src": "group:nelsonFamily",
			"accept": ["vor:445"],
			"deny": ["vor:22"]
		},
		//Romeo should be able to access vor:22 for backup replication
		{
			"src": "romeo",
			"accept": ["vor:22"],
			"deny": ["xray:22", "porter-pc:22"]
		},
		// Whiskey should be able to access romeo:9002 for prometheus node exporter
		{
			"src": "whiskey",
			"accept": ["romeo:9100", "vor:9100", "tag:server:9100"],
			"deny": ["xray:22", "porter-pc:22"]
		},
		// Romeo should not be able to access node_exporter on whiskey
		{
			"src": "romeo",
			"deny": ["whiskey:9100"]
		},
		{
			"src": "tag:server",
			"accept": ["whiskey:3100", "whiskey6:3100"]
		}
	],
	"sshTests": [
		{
			"src": "bradleynelson102@gmail.com",
			"dst": ["tag:server"],
			"accept": ["autogroup:nonroot", "root"]
		}
	]
}