fix(headscale): valid default ACL + document /admin gating
headscale rejects autogroups as tagOwners (only user/group:/tag:), which made the shipped policy fatal. Replace with a valid allow-all default plus correct commented examples for tightening. Document gating /admin to a pocket-id superuser group via the headplane client's Allowed User Groups. Rebuild archive.
This commit is contained in:
@@ -67,6 +67,12 @@ by the launcher, or set in `.env`). Leave them blank to use headplane's
|
||||
API-key login instead. Pin the image with `HEADPLANE_TAG` (defaults to
|
||||
`latest`).
|
||||
|
||||
**Gate `/admin` to a superuser group:** restrict it at pocket-id — edit the
|
||||
headplane OIDC client and set its **Allowed User Groups** to your superuser
|
||||
group. Only members of that group can complete the OIDC login, so only they can
|
||||
reach `/admin`. (Enforced at the IdP, so it covers the UI regardless of
|
||||
headplane's own checks.)
|
||||
|
||||
> headplane integration is version-sensitive; if the UI doesn't come up,
|
||||
> check `docker compose logs headplane` and verify `headplane.yaml` /
|
||||
> the minted `HEADPLANE_HS_API_KEY` in `.env`.
|
||||
|
||||
@@ -414,82 +414,81 @@ EOF
|
||||
# __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64).
|
||||
exit 0
|
||||
__ARCHIVE_BELOW__
|
||||
H4sIAAAAAAAAA+1bfW/bONLv3/4UhFNgk24k23ntqsiDzZMY1zxNk1xesHc4FFpaom1dZFFLynG9
|
||||
RYH7EPcJ75Pcb4aSLLtp+9xeuy+A2aC2KHI4HA5nfjOkYx3dK+NFepJrq/z5JH3yxUsX5WBv70n3
|
||||
oNs73O/xZ7fb43qU/e7e7pPe/k5vt3u4c3iw86Tb2zk83Hsiul+elQ/L1BbSCPFk/zD8QacP6tcY
|
||||
83dUNsRYydhGMlUCkojuheeJSMbxXGzent9siW8bDTZvZZLyV1YYWSQD1EZamzjJZKHNVmujtSFu
|
||||
da5TPZoH+C5E3UdEaaKywgrvf9wIwd7eLj3UAwTPu8+7TOJCi+NsOkgsXhoVPELE5krei5e3t1ed
|
||||
HbCQFUanIje60JFOt0WmC7x8fb4NYlYLKa70DyIayzRV2UiJmZ6msRgYolGM1cQXLysmvrHi+OpM
|
||||
2KkZykgJsDAbywJkqpHHSfFCFOhaiKQQaXKvhMzmQoOOcV2VeUgi5fNMLs9OTwSkkWREKlapGslC
|
||||
xaLQIqe9V3hJLEDq6dXlyav+7dlpeHr5+vjswhfXapTYAjRlPTjxapQYJsaCh0jnc6opX4Yg9G31
|
||||
3arIKDCYYRxfZQ9+q5XJCSRZC7vVetDpdKJs0BKLWi+Whaxq8lRmixpes5UnCH6YjIJWq5yzrV/R
|
||||
FyGSiRxhUFfz9N3J8enpX8Pb4z8F3o4n0zzJ1HtuRwso8WRCxyV34DdG0QYtAjHNUmWtZwud5yrm
|
||||
d7k2hXUDCeGJ9vMuNKi9eIZ+kY5VNRuNus40zttcxyq0S2ofJ1ZCoWMMVSSpOOFd8Oe7sxOI1agH
|
||||
ZawKoWFv5yW9x8qGgNAiNdZpjJUbTEe06sPkLahu/sW7VjL1zq4wXcgdS2f0dDT+JDU1yQvoVgYl
|
||||
ntAOhdpN7BYph6cy4lakUCfjM5HGgjoJ+B2exDDB3uqoIuqwXBuVRtdtG8vbof9XXpQr3XGf/BJq
|
||||
lRidTaBv1ZAv+8enNyfH5/1SiwPRfvputfJ9tSDHJ6/7YR9V59xu8Vi2iFWustiGOqvoL0xFLTUw
|
||||
FCdFgjbVxgvRKi3Gbpnc92isovuqTwGVCsTf2ievT9vboj0bqYI+vZ8uPfocF0UedDpwQn4X/3rB
|
||||
Trf3XTnvTvtNSQQ7C6PJNBC7XVsRTiZKT0F7v6rBHjQJVkTslhWszGGuTKLjQPTQtfXBrMpNU9d2
|
||||
Fu+bwuRt1PV3nvvdxzfRYqt/biNBHycyi50Eq+YyhuDTeQBbN3V1xSQfNrSr8yBNx0yzzvJAj2ih
|
||||
E54/l5PU6eFibs1XDW30O/AhSTT3x9O/W6ztSq/ll41+K4aMWUyTwQqLn1eKun35gOZfZelhk75c
|
||||
YXovK8Mt/vWPf4qZGoi7MzHUZiGabbfM8H/z0sjB/3RkPEkynxyYx8vOxAqZ3lvyVeRmFkCAvNws
|
||||
Kcbwq/cKSCHT4pSBJMwU+TTyv2KsbVF55i2fyTUWm+ziSEFZ2RuCE2z2VM99OxZDoyel0/ryAqr9
|
||||
2tJeG40j4ye6U1TbzTVx2+3q/Pii3G5kbG3x8e3G3T673R7ZIXXnlU3CdR/bJCs+eknZF5z8t1b0
|
||||
t4ao6/IVSw0FvuIYn4n/dnZ39hfxH7Xr9Xp7B+v479coG6LWgGUn4aJBF8McTwvtJdZOAVqlOFcF
|
||||
YqR+Fpl5DgOvTME9n67CPERFcYWbPcLN8IYgBmcybsRaBL8RRCHQgSUloMtBoP9IxGfUT9ME0U8x
|
||||
ToiOeiujgp0MmV+hMQ4Tu0Go887h0wloiHdPG7iy9R4vP+D0vSg7ZJGOlfjZFrEY/ZzkLa5tutTS
|
||||
nabJA4li4TWvpLXsIxEUjytgD9OPiBPhZlzS2awNs/PAFgGkVekQDSlacMQA7vuYyxzTzEZCpZZj
|
||||
0IbISmKrMa8LAb5nGo4NR6/86DxzyAeLApmWzd7V9n8pvmk4yV1sUG70vtXs/6mOi1C+0axyO/CW
|
||||
01wsIqF3hLZ9Wlr4S3xOdKF8WtT3S103xLnORh7JPQa2SKzqzKALo6k0cS2JMjp6geUZcqgM1zeU
|
||||
07RYIZXQDNJkgujdMrIB+NDZNwXwCLppk+FxlvlLvYbp1I7DCvkJr7f0tjAysxSNCprOyrSdlICm
|
||||
S4wogP0mH7SYmaRQdZPVFgtpvF9aDZZoY7wbYM6o8G4rfrwbFU1BeS7aE/nWA9Y52u3t7x5gVV8A
|
||||
x0bpNFY308GpxlbJbLum8xfvBELFtvNu57nyLnOCBpbetDNts2Q4XLS9VkNljDLeFYPyBtdt69jR
|
||||
JhklmTcbq8yLjAYacjULGuAT+8E055bqUWNiEEoOuWBn4ltdC7szkQwyrS6hPW3x39qo/oFKA1l+
|
||||
tTE+l//d3e1V/r93uLNL/n/vYJ3//VVKM//bjM48T7jUAgOAq0ZOq9D3CqZg8+7qqn8d3lwcv+rD
|
||||
eEkKbmBRYDqnlJVij2YjjTBoS0ijKA07HdgiKaYU72HTuniPA+dHwj+y3jC0hDhAlINBhJhkpK2i
|
||||
ZCwlbTk3LGL4gahI52WgJeZ6+g2qzTTLyIEupgfDYZNYlY6BB7eRSfLCd+lLck0GQT2ZcBt0OmG4
|
||||
ihPCsOWQSgjMZALR5QRR16WtJxTvRzZ8tMV33e+6LbA9ur46Ec7LeZXbQjCNuVW5RxYFe60XNfKZ
|
||||
Wsc1VDWL4fFA6Md6Xj+Kk/MzCKmeWx2XUmWBZr64yyjDQwnkb4Gb6KRHJEOSFCjNJKodS8KhGeLT
|
||||
5NHjM9nv7u3tVi1kmuoZvKIlL4MQeCgBV1otdtAUW+YmeUDEHN6reUiQJBAfJmQ63Dosm/po2mrl
|
||||
RlHOlCPkhz1KlnT9gz0av9MjOPJwgLHiQxn0evtRIHuqGwSdved4QxxFsgpkgSqyIpEpif60f30V
|
||||
sChraAn4mUNbk4hfionMgb0mAxXHWAiucnpBgp9boYdDAAYSmSoBQ6ZcJl8jwhZ3p1ed3b3D5yXN
|
||||
dO63sAdymoMjE5Qgkxe6EpYQULoyFeDVulfqhssIFBW/PlaxQzTBaWeBbUiyNhB/o/yUBFQHwopJ
|
||||
6vVIZQKvrB4y2sqieSB29satFuUOBtItWAFvD8H9lAKMEN/8xTH30fWLB37docIxkl6HcOGN7OFM
|
||||
piGxx2m3XANL8cJiX1A7NEkBJbH/kmxIKQ7n29FfvS1o/Y5PzoVL+20DG0haIrYUUryc/t/N5YXg
|
||||
GGbTKiWWsoPbYqKnWcHWySWyWhuLPQK0vbAQUA67pB10WANE05ZRatslR+5sqT0CxCps22+5wYj/
|
||||
CYKHgNlo1eL6RNqSJvVajkj7Lm44hKLdS4udqcIXtCRhzMBMDFR1YgAjMB1ib3D7DAOSZqM7xUAw
|
||||
ysof+SKVeaFzPwxvEfJc9G9r67UFjcxY1yY0bkgP1fo0hgvEh13RgiIsAyMT0g5LXedKh3l4VvJS
|
||||
lUepHsh0keHq+fyv8cy59fp556B7EOwddrvuP2zs3ideAj3wS5tD7wLx7j3vMWmicTmFajtAd4wM
|
||||
4SC0iV1deSQX1EdxtGXGZCac2aiSnYvDOecryHqunMllauaO98rDOYq76l6cHjXKeSdxd33mTkM/
|
||||
5Vw6OonpiCZNBwi9W/REAqRsbOiSx8kwpNowsaF8gKLQ/q5XkAN00/RfK0eKvIr1WSGtMnEfwn30
|
||||
L25DNGu8d+eHq21u+ifXUApqB9+eq8pskf1L4vIBkWC5B+iJg3DO4169OulztAqBOFUmySMS+JkF
|
||||
73Hsrd66kBmG2FkvJ0hqfbOzf+CyyPUxLnzuWMcEVibynraGUSuL11wf6KpGAGsdJ5ojvPw+Uit2
|
||||
uTZYjnqwGPhauYBGzMZaRDLD+lbqwHux6Wg1gnxs0QkQkEtjs69UcQgj4zbJBstHwiKo79VbOcmd
|
||||
gV9qPDJ6mjda167AY1dtlxpXql+3XqX6Us9gOgGKHLulW2voP+EPBcsC+IQRUE+phzLvAhhxO8Yj
|
||||
/iRTi6fG7RhiCBh6k+yiJC8Ko4pZhkAaiZmHZKVDRo21CaHER72wTIzXiRvB7CL6Fq6zoJiRV8Tn
|
||||
3Ux18BrPu6Rsj45R2aTfGlj/QcqSR/pKY3wm/ts97B4s4r8e5X93ugfr/O+vUjqd5rFeDbHEpgNV
|
||||
gWBoxVsVTUvjZjm1C8+apBRi8emxBbjodPAnzl5fXV7fHl/cBp+CVs8ctnpWDVimcmDKGQXp3GM4
|
||||
SARL+CWNkXNqcHF5y43gf2F6KyQm7ByY7u0ifFxkkNlWtph/ThSVlowBY+JckSPi2WKe1mlDl9ZL
|
||||
ZY0dHSPVPPtxAjBItjOgx8axWjUnRrpitWxQYJsQFBebLBYa30XQZstRit1hankrrzpLbAxQUUIn
|
||||
RL6b5XgEQMURz2urZPJYDIFShkoW8I3uNpXYJBTOniWg7PO2g5WIvAdAdvccrjvZdmBdlUloySWv
|
||||
BBDOggfSgYmcl+eLlLpHQGkEYUB4BV+cDRuNjfp76fYTS5RKjmXhjsW3hYWOReMafSkzAZ5JHhSZ
|
||||
c8ZD1JZeDXRR6InPOX4QuinghCLSLyOct9wWjILbbobOT7bpaP8DV9t+Q17FNaQm795vtxzVH+Dg
|
||||
aW5OvrNxQqzJER+Fx4pvOnFX1F3OEEZwbwYN6IzKwI4hRUYmsuzAl8QmCuGlYR/qnDYRNEpGY5du
|
||||
bi/6OpbrlXI922+20a5m80IVM20gmiii1IeZphQE8PUwsE/ynGHyLyqF9mJVXVSbIebmQ3mn0xir
|
||||
4r4PZpw4HcKhR/RIDLvlcvLbtNyYgruC5Xh/R7QIEIBamzjK+VqNNdHHpiLasS1WXpJGBs/ab8pJ
|
||||
MkvH2Zzg1IKfkguS9IhkWAvtF/D1bImRBamKCSHeVOJeWJSbm5eVtAlJWTGBH6Gck/ixhmiIt7H+
|
||||
2Fc/OkHjW1PORIKtCu+ahmyhumw42tjK7rYI9Htg9IzWpMJlmw44rbBVrjPw1x3MRjXZMtfTPNxL
|
||||
saFsaZ/IapSSKiOuhrwcJ9vVCyc0lI+pJrdywlxpRQvbaMMwmFo122Q6M1rz8vBn2Xx5Fegih7h6
|
||||
xED8x3dBQOxa8X09tiyVnxkAplboFDt1kwxdbHTulnCLxEnN3fpTbpMpOQtHKog15d0t1OIcDyYE
|
||||
YscqAPnynZfA9WpswP9MUZ85/SSx/DcHHpxZLU3il0MVy+Uz+G9vZ39vcf5/eEj5//3D3TX++zXK
|
||||
hjjhW8TuljD7dMCHVNCh9goKyROyGdwMlo027YRcL1R97lNa5V///If7E1cuqVqdzdvFq9/zH6bw
|
||||
vwR96isFdK3NwgBO1BbFoaZ5A25GQhoo5484Nq6McOOmOOBmRtkf7tu8oLCa+zkaW78ZrINGny8v
|
||||
UJZv+b6FSzmUkXenCpMReifDMoMFt7e48XDE+Of7FeKcdvQob7iSTbTNg4Q6Fdl3vQM2inTBfyk5
|
||||
eETtmuxvA/O4y3+Up4lF2yUk205ogKG0z6ByoFSmKlcp+OL13c0tyTdOhkNILyscrl8VnN/6DC/L
|
||||
islZhs06O7T1h1HMl4/ppC7d+mOpym2CcLGQLrqgeYOKyxBCuNMaH9JbVy3urs+bP0mIoa9FYvme
|
||||
C/p2/JlKU+8+A1LpuHxfeSe8TAP5rZV04xEBldW1uG5kzD6RPoXCuxsqd2efy6Q+cr98JZEKhaUs
|
||||
Ui4xsDshAzV3MOQiIr+1nAg9an2Y9Dxa1qTFlaDN8k5QfRvod6BVYPVP9d1a2AkXETjteCFSJbH/
|
||||
BuD+3pkid8H15PLy1Vm/nm557SuiH7pUZy2Nw9RlooxHIYXyxzMuHtn66FAvb0I0C1/1/0rjuNsl
|
||||
dJ+68WOZ6jKaE/JDIhfK0UzDC7B7eXFaafgvyMQ/pj/uxtSqFp27ySB+cjMir0nniTWbbvYeXYku
|
||||
f/FTHsA2pr6qaY+/eVTnzuiusgtDf3MN+4V6ufTrhaPyhsHSHesjd8W6Vf9U6Kj6pdA6pbsu67Iu
|
||||
67Iu67Iu67Iu67Iu67Iu67Iu67Iu67Iu67Iu6/L/LP8GXiwbbgBQAAA=
|
||||
H4sIAAAAAAAAA+1b/W7bOLbv334Kwil2kk4k24mTdFTkYrJJsMltmuTm484uFgMNI9G2NrKoEaW4
|
||||
niLAPsQ+4T7J/Z1DfdlN28HetjMDmA1qiyIPycPz8TuHdKiDe5U5gZ6m2ih3Po2fffbSR9kdDp/1
|
||||
d/uDvZ0Bf/b7A65H2ekPt58NdrYG2/29rb3drWf9wdbe3vCZ6H/+qbxfCpPLTIhnO3v+Dzp+UF9j
|
||||
zN9RWRMTJUMTyFgJcCK4F44jAhmGc7F+c3a9Ib5tNVi/kVHMX1lgZB7doTbQOgujROY62+isddbE
|
||||
jU51rMdzD9+FqPuIII5Ukhvh/JcdwRsOt+mhHsB72X/ZZxLnWhwkxV1k8DJT3hNETKrkvTi5ubns
|
||||
bWEKSZ7pWKSZznWg402R6Bwv35xtgpjRQopL/YMIJjKOVTJWYqaLOBR3GdHIJ2rqipNqEt8YcXB5
|
||||
KkyRjWSgBKYwm8gcZKqRJ1H+SuTomosoF3F0r4RM5kKDTma7quwhCpTLK7k4PToU4EaUEKlQxWos
|
||||
cxWKXIuUdC93olCA1PPLi8PXxzenR/7RxZuD03NXXKlxZHLQlPXgNNdMiVGUGcwh0OmcasqXPgh9
|
||||
W303KsgUJphgHFclD26nk8gpOFkzu9N50HExVcbriKbWCWUuq5o0lklTw3u29ATGj6Kx1+mUazb1
|
||||
K/oiRDSVYwxqa56/Ozw4Ovqbf3PwF8/ZcmScRol65Ha0gRJPmW9nyR34TaZIQXNPFEmsjHFMrtNU
|
||||
hfwu1Vlu7EBCOKL7sg8J6jbPkC+SsapmrVXXK8K0y3UsQtsk9mFkJAQ6xFB5FItD1oL/uT09BFsz
|
||||
9aAyo3xI2Nt5Se+psibAtEBNdBxi5+6KMe36KHoLqut/da6UjJ3TSywXfMfWZboYTz5KTU3THLKV
|
||||
QIinpKEQu6nZIOFwVEKzFTHEKXOZSGtDLQfcHi9iFEG3eioPeszXVmWm67at7e3R/0svyp3u2U9+
|
||||
CbGKMp1MIW/VkCfHB0fXhwdnx6UUe6L7/N1y5WO1IQeHb479Y1SdcbvmsWwRqlQlofF1UtFvTEXN
|
||||
NUwojPIIbSrF89Eqzid2m+z3YKKC+6pPDpHyxN+7h2+OupuiOxurnD6dny8c+pzkeer1enBCbh//
|
||||
Bt5Wf/Bdue5e98eSCDQLo8nYE9t9UxGOpkoXoL1T1UAHswg7IrbLChZmP1VZpENPDNC1896qSqWp
|
||||
a3vN+zYzWY367tZLt/+0EjWq/ilFgjxOZRJaDlbNZQjGx3MPtq6wdfk0HbWkq/cgs15WJL3FgZ6Q
|
||||
Qss8dy6nsZXDZm3tVy1pdHvwIVEwdyfFPwz2dqnX4stWvyVDxlOMo7ulKX5aKOr25QOaf5Gth036
|
||||
fIXpnVSGW/z7n/8SM3Unbk/FSGcNazbtNsP/zUsjB//Tk+E0SlxyYA5vOxPLZXxvyFeRm2mAAHm5
|
||||
WZRP4FfvFZBCosURA0mYKfJp5H/FRJu88swbLpNrbTbZxbGCsLI3xEyg7LGeu2YiRpmelk7r8zOo
|
||||
9msLujaeBJkb6V5eqZttYtXt8uzgvFQ3MrYm/7C6cbdPqtsTGlJ3XlISrvuQkiz56AVhb2by/7Wi
|
||||
vzVEXZUvWGoo8AXH+ET8t7W9tdPEf9RuMBgMd1fx39coa6KWgEUnYaNBG8McFLl2ImMKgFYpzlSO
|
||||
GOk4CbJ5CgOvspx7Pl+GeYiKwgo3O4Sb4Q1BDM5k0oq1CH4jiEKgA0tKQJeDQPeJiC9TPxcRop98
|
||||
EhEd9VYGOTsZMr9CYxwmdo1Q553Fp1PQEO+et3Bl5xEv35vpoyg7JIEOlfjF5KEY/xKlHa5tu9TS
|
||||
ncbRA7Gi8ZqX0hj2kQiKJxWwh+lHxIlwMyzprNeG2XpggwDSqHiEhhQtWGIA98dYyxzLTMZCxYZj
|
||||
0BbLSmLLMa8NAb5nGnYall750XthkQ82BTwtm72r7f9CfNNykttQUG702Gn3/1jHJpRvNavcDrxl
|
||||
kYomEnpHaNulrYW/xOdU58qlTX1c6LomznQydojvIbBFZFRvBlkYFzILa06U0dErbM+IQ2W4vpEs
|
||||
4nyJVEQriKMponfDyAbgQyff5MAj6KazBI+zxF3oNYoLM/Er5CecwcLbPJOJoWhU0HKWlm25BDRd
|
||||
YkQB7Dd9r8Usi3JVN1lu0XDjcWE3mKOt8a6BOYPcuanm41yroADluehO5VsHWGd/e7CzvYtdfQUc
|
||||
G8RFqK6LuyMNVUlMt6bzV+cQTIXaOTfzVDkXKUEDQ2+6iTZJNBo1ba/USGWZypxLBuWtWXeNnY7O
|
||||
onGUOLOJSpwg00BDtqahgXlCH7L22mI9bi0MTEnBF2gmvtW1sDtTySDT6BLak4r/1kb1D1RayPKL
|
||||
jfGp/O/29qDy/4O9rW3y/8PdVf73q5R2/rcdnTmOsKkFBgCXrZxWru8VTMH67eXl8ZV/fX7w+hjG
|
||||
S1JwA4sC01lQVoo9mgk0wqANITNFadjizuRRXlC8B6W18R4Hzk+Ef2S9YWgJcYAoB4MIMclIG0XJ
|
||||
WEracm5YhPADQR7Py0BLzHXxDaqzIknIgTbLg+EwUahKx8CDmyCL0ty16UtyTRmCejLhxuv1fH8Z
|
||||
J/h+xyIVH5gp80SfE0R9m7aeUrwfGP/JFt/1v+t3MO3x1eWhsF7OqdwWgmmsrco9MivYa72qkU9h
|
||||
7KwhqkkIjwdCP9Xr+kkcnp2CSfXa6riUKnM0c8VtQhkeSiB/C9xEJz0iGhGnQGkmUW2nJCyaoXlm
|
||||
afD0Snb6w+F21ULGsZ7BKxryMgiBRxJwpdNhB02xZZpFD4iY/Xs19wmSeOL9hEyPW/tlUxdNO500
|
||||
U5Qz5Qj5YUjJkr67O6TxewOCIw+7GCvck95gsBN4cqD6ntcbvsQbmlEgq0AWqCLJIxkT64+Ory49
|
||||
ZmUNLQE/U0hrFPBLMZUpsNf0ToUhNoKrrFwQ4+dG6NEIgIFYpkrAkCibydeIsMXt0WVve7j3sqQZ
|
||||
z90OdCClNVgyXgkyeaMrZgkBoStTAU4te6Vs2IxAXs3XxS72iCZm2muwDXHWeOLvlJ+SgOpAWCFx
|
||||
vR6pTOCV1SNGW0kw98TWcNLpUO7gTtoNy+HtwbifY4ARmjd/sZP74P6Fd27docIxkl77cOGt7OFM
|
||||
xj5Nj9NuqQaW4o2FXlA7NIkBJaF/UTKiFIf17eiv3ua0fweHZ8Km/TaBDSRtEVsKKU6K/76+OBcc
|
||||
w6wbpcRCdnBTTHWR5GydbCKrs9boCNB2YyEgHGZBOuiwBoimK4PYdMsZ2bOl7hgQKzddt2MHo/lP
|
||||
ETx4PI1Oza6PpC1pUW/kmKTv/JpDKNJe2uxE5a6gLfFDBmbiTlUnBjACxQi6we0TDEiSje4UA8Eo
|
||||
K3fsilimuU5d379ByHN+fFNbrw1IZMKyNqVxfXqo9qc1nCfe74oWFGFlMDI+aVhsO1cyzMOzkJei
|
||||
PI71nYybDNfA5X+tZ86t189bu/1db7jX79v/oNiDj7wEeuCXJoXceeLdI+uYzIJJuYRKHSA7mfTh
|
||||
IHQW2rrySM6rj+JIZSZkJqzZqJKdzeGc9RVkPZfO5BI1s8d75eEcxV11L06PZsp6J3F7dWpPQz/m
|
||||
XHo6CumIJo7vEHp36IkYSNlY3yaPo5FPtX5kfPkAQSH9rneQA/Ss7b+WjhR5F+uzQtplmr0P93F8
|
||||
fuOjWeu9PT9cbnN9fHgFoaB28O2pqswW2b8oLB8QCZY6QE8chHMe9/L14TFHq2CIFWXiPCKBX5jx
|
||||
Dsfe6q0NmWGIrfWyjKTW11s7uzaLXB/jwudOdEhgZSrvSTUytbR57f2BrGoEsMbORHOEl94Hasku
|
||||
1wbLUveaga+UDWjEbKJFIBPsbyUOrIttR6sR5ENFp0BANo3NvlKFPoyMVZI15o+ERVDfq7dymloD
|
||||
v9B4nOkibbWuXYHDrtosNK5Ev269TPVEz2A6AYrsdEu31pJ/wh8KlgXwCSOgnlIPZd4FMOJmgkf8
|
||||
SaYWFpnVGJoQMPQ62UVJXhRGFav0gTSibO6TlfYZNdYmhBIf9cYyMd4nbgSzi+hb2M6CYkbeEZe1
|
||||
mergNV72SdieHKOySb81sP6DlAWP9IXG+ET8t721V+d/t4fDHbr/09/bWsV/X6P0eu1jvRpiiXUL
|
||||
qjzB0IpVFU1L42Y4tQvPGsUUYvHpsQG46PXwJ07fXF5c3Ryc33gfg1YvLLZ6UQ1YpnJgyhkF6dRh
|
||||
OEgES/gls0zOqcH5xQ03qjCYMHOgubdN4Njkjm2as8wPuTy7nC0YuQJrzCmkhctpdSI/TgGveUVQ
|
||||
D14BiFOKbi7HFzNAxq6YQmhgKImcpJXB9pFb6X7f3eCWbLW9F91N8gC2J56qqWMsgsHcqOLZ/8IN
|
||||
EDhvzG88J9bCugLgUIvWqV3FMgbSYrmsWV7zgS2dwFJ0aOPzzNIJQtEz2UMDS8Wf/oR4ho9vy3uA
|
||||
1ella0x2NGmKOHudcO4+ufiNcvY3TaoVC4AzIhZjvCkgSfQAUM4eysH/4M9sEgWTeg/aeW1QulMT
|
||||
+RDpIrMil+gKy4ubaDxBNEqOozDEGhvqsjzCbZWuzric+wel6xzOKbC7Y72oK94oBHeZoXyEdThw
|
||||
RXB8ecTQmYCKsUJU4wc+t2aulZtq3W6Xbgq857npqsCdvluo+nGzU/WlXu8eNzuW4g+AEFPIs+Wp
|
||||
ZQrkhA/bQ8V3qVzB8mYqeSuFbXNRwCy5SsbWlyWMpK7ZxUz9g9EXxwndupE3Zc50W8slemYCToW8
|
||||
2IXV20VV+rC4rnOVz3R2L2QQUDYmK2JiLt9Yw3pzrHIGEq8qeXGwA+XduVlkFE/A6jtGZRQGmgck
|
||||
PkLVpyKEw1lDSwzBopHZsTZ5bV7VVYh3RI9wCih2aVYp3/YxWfDUwkQ3NDm/eAF2/igeN381pRfU
|
||||
vZ39rig1rGyT/DXUnprMjxWnG4N1fX0i1jXn6GX8irFdKTRZkYifatAoWByMmfxEh0xWSr16x1Ff
|
||||
Mp2fPzDD5rWoJiuelI+mlV2EWODEchtGxVataqFMdJJpzVzhz5IB3AndV3n+z1A4s1oarC81xifw
|
||||
33BrZ9ic/+/tUf5/Z297hf++RlkTh3yL2N4SZlwHzx4LOtRewgRpFNwb2wx2hNR0Si4WXn3uUlrl
|
||||
3//6p/0TlzapWp3Nm+bV7/kPS/gzIYP6SgFdazMAWVO1QXFo1r4BNyMm3ZFDlWgRtu4rtG6KA3cm
|
||||
lP3hvu0LCsu5n/2JcdvBOmgc8+UFyvIt3rewKYcy8u5VYTJwajQqM1jAQM2Nh302yd8vEee0o0N5
|
||||
w6VsomkfJNSpyMpVsLulC/4LycF9ateePmFge/mP8jSh6NqEZNcyDdCS9AwiB0plqnKZAqDa7fUN
|
||||
8TeMRiNwL8ktMFtmnNv5xFwWBZNB33qD7v4wgnnylExqPsLJnkxVbhJUDIW0gQCtG1RshhDMLWow
|
||||
Rm9ttbi9Omv/JCGEvOaR4Xsu6NtzZyqOnftEz5KezfeVd8LLNJDbWUo37lMCaXkvrloZs4+kTyHw
|
||||
NnS7Pf1UJvWJ++VLidQ1ClDoTgwGtmEDqNmDIfv7ErezmAjd77yf9NxflKTmStB6eSeovg30O5Aq
|
||||
TPUv9d1a2AkLv610vBKxktC/O8z+3poie8H18OLi9elxvdzy2ldAP3Spzlpah6mLRMU68fX2tPzx
|
||||
jAX/Gx8c6uTaRzP/9fHfaJyLErl67R/LVJfRLJMfItkIRzsNLzDdi/OjSsL/g0z8U/Jjb0wtS9GZ
|
||||
XQyCFbsi8pp0nlhP067eoSvR5S9+ygPY1tKXJe3pN0/K3CndVbZB4m8uYf+hXC78emG/vGGwcMd6
|
||||
316x7tQ/Fdqvfim0gvursiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiq/svwfUE85lwBQ
|
||||
AAA=
|
||||
|
||||
@@ -1,49 +1,39 @@
|
||||
// headscale ACL policy (HuJSON: JSON with // comments and trailing commas).
|
||||
//
|
||||
// IMPORTANT: headscale uses Tailscale's *legacy* policy format -- the top-level
|
||||
// "acls" array -- NOT the newer "grants" syntax from the Tailscale admin
|
||||
// console. This file is the grants-style default translated into "acls".
|
||||
// "acls" array -- NOT the "grants" syntax from the Tailscale admin console.
|
||||
// It is also stricter than Tailscale in places; notably, a "tagOwner" must be
|
||||
// a user (has "@"), a "group:*", or a "tag:*" -- NOT an autogroup.
|
||||
//
|
||||
// Edit, then:
|
||||
// headscale policy check # validate (uses the wrapper)
|
||||
// docker compose restart headscale # apply (policy mode = file)
|
||||
// Validate before relying on it:
|
||||
// headscale policy check # uses the host CLI wrapper
|
||||
// cd /srv/headscale && docker compose restart headscale # apply (mode=file)
|
||||
//
|
||||
// A few features here (autogroup:self, the ssh block) are newer/experimental
|
||||
// in headscale and may depend on your version. If headscale rejects this
|
||||
// policy at start, switch to the permissive fallback at the bottom.
|
||||
// The default below is permissive (allow-all), which is also headscale's
|
||||
// behaviour with no policy. Tighten it using the commented examples.
|
||||
{
|
||||
// Static user groups, e.g. "group:admins": ["alice@example.com"].
|
||||
// Static user groups. Members are OIDC identities (emails from pocket-id).
|
||||
// "group:admins": ["alice@example.com", "bob@example.com"],
|
||||
"groups": {},
|
||||
|
||||
// Who may apply which tags to devices.
|
||||
"tagOwners": {
|
||||
// tag:shared -- a device any member is allowed to reach.
|
||||
"tag:shared": ["autogroup:member"],
|
||||
},
|
||||
// Who may apply which tags to devices. Owners must be a user, "group:*", or
|
||||
// "tag:*" (NOT an autogroup -- headscale rejects e.g. "autogroup:member").
|
||||
// "tag:shared": ["group:admins"],
|
||||
"tagOwners": {},
|
||||
|
||||
// Network access rules (first match wins; default-deny otherwise).
|
||||
"acls": [
|
||||
// Each user can reach their own devices, on all ports.
|
||||
{ "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:*"] },
|
||||
|
||||
// Anyone can reach devices tagged tag:shared, on all ports.
|
||||
{ "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] },
|
||||
// Allow everything. Replace with tighter rules, e.g.:
|
||||
// { "action": "accept", "src": ["group:admins"], "dst": ["*:*"] },
|
||||
// { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] },
|
||||
{ "action": "accept", "src": ["*"], "dst": ["*:*"] },
|
||||
],
|
||||
|
||||
// Tailscale SSH rules (nodes must run `tailscale up --ssh`).
|
||||
"ssh": [
|
||||
// SSH into your own devices. "check" = periodic browser re-auth (the
|
||||
// Tailscale default). Use "accept" if your headscale lacks check mode.
|
||||
{
|
||||
"action": "check",
|
||||
"src": ["autogroup:member"],
|
||||
"dst": ["autogroup:self"],
|
||||
"users": ["autogroup:nonroot", "root"],
|
||||
},
|
||||
],
|
||||
|
||||
// ---- Permissive fallback ----------------------------------------------
|
||||
// Replace the "acls" above with this (and drop "ssh") if the rules are
|
||||
// rejected, to allow everything while you iterate:
|
||||
// "acls": [ { "action": "accept", "src": ["*"], "dst": ["*:*"] } ],
|
||||
// Tailscale SSH (optional; nodes must run `tailscale up --ssh`). Example:
|
||||
// "ssh": [
|
||||
// { "action": "accept",
|
||||
// "src": ["group:admins"],
|
||||
// "dst": ["tag:shared"],
|
||||
// "users": ["autogroup:nonroot", "root"] },
|
||||
// ],
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user