From 6a3fc68b751faa399d18e6dd23d3359ee90f14a4 Mon Sep 17 00:00:00 2001 From: William Gill Date: Fri, 12 Jun 2026 16:17:26 -0500 Subject: [PATCH] fix(headscale): valid default ACL + document /admin gating headscale rejects autogroups as tagOwners (only user/group:/tag:), which made the shipped policy fatal. Replace with a valid allow-all default plus correct commented examples for tightening. Document gating /admin to a pocket-id superuser group via the headplane client's Allowed User Groups. Rebuild archive. --- deployments/headscale/README.md | 6 ++ deployments/headscale/deploy.sh | 157 ++++++++++++++-------------- deployments/headscale/policy.hujson | 60 +++++------ 3 files changed, 109 insertions(+), 114 deletions(-) diff --git a/deployments/headscale/README.md b/deployments/headscale/README.md index cc10968..6fc08c1 100644 --- a/deployments/headscale/README.md +++ b/deployments/headscale/README.md @@ -67,6 +67,12 @@ by the launcher, or set in `.env`). Leave them blank to use headplane's API-key login instead. Pin the image with `HEADPLANE_TAG` (defaults to `latest`). +**Gate `/admin` to a superuser group:** restrict it at pocket-id — edit the +headplane OIDC client and set its **Allowed User Groups** to your superuser +group. Only members of that group can complete the OIDC login, so only they can +reach `/admin`. (Enforced at the IdP, so it covers the UI regardless of +headplane's own checks.) + > headplane integration is version-sensitive; if the UI doesn't come up, > check `docker compose logs headplane` and verify `headplane.yaml` / > the minted `HEADPLANE_HS_API_KEY` in `.env`. diff --git a/deployments/headscale/deploy.sh b/deployments/headscale/deploy.sh index 8c6432c..a58c95a 100644 --- a/deployments/headscale/deploy.sh +++ b/deployments/headscale/deploy.sh @@ -414,82 +414,81 @@ EOF # __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64). exit 0 __ARCHIVE_BELOW__ -H4sIAAAAAAAAA+1bfW/bONLv3/4UhFNgk24k23ntqsiDzZMY1zxNk1xesHc4FFpaom1dZFFLynG9 -RYH7EPcJ75Pcb4aSLLtp+9xeuy+A2aC2KHI4HA5nfjOkYx3dK+NFepJrq/z5JH3yxUsX5WBv70n3 -oNs73O/xZ7fb43qU/e7e7pPe/k5vt3u4c3iw86Tb2zk83Hsiul+elQ/L1BbSCPFk/zD8QacP6tcY -83dUNsRYydhGMlUCkojuheeJSMbxXGzent9siW8bDTZvZZLyV1YYWSQD1EZamzjJZKHNVmujtSFu -da5TPZoH+C5E3UdEaaKywgrvf9wIwd7eLj3UAwTPu8+7TOJCi+NsOkgsXhoVPELE5krei5e3t1ed -HbCQFUanIje60JFOt0WmC7x8fb4NYlYLKa70DyIayzRV2UiJmZ6msRgYolGM1cQXLysmvrHi+OpM -2KkZykgJsDAbywJkqpHHSfFCFOhaiKQQaXKvhMzmQoOOcV2VeUgi5fNMLs9OTwSkkWREKlapGslC -xaLQIqe9V3hJLEDq6dXlyav+7dlpeHr5+vjswhfXapTYAjRlPTjxapQYJsaCh0jnc6opX4Yg9G31 -3arIKDCYYRxfZQ9+q5XJCSRZC7vVetDpdKJs0BKLWi+Whaxq8lRmixpes5UnCH6YjIJWq5yzrV/R -FyGSiRxhUFfz9N3J8enpX8Pb4z8F3o4n0zzJ1HtuRwso8WRCxyV34DdG0QYtAjHNUmWtZwud5yrm -d7k2hXUDCeGJ9vMuNKi9eIZ+kY5VNRuNus40zttcxyq0S2ofJ1ZCoWMMVSSpOOFd8Oe7sxOI1agH -ZawKoWFv5yW9x8qGgNAiNdZpjJUbTEe06sPkLahu/sW7VjL1zq4wXcgdS2f0dDT+JDU1yQvoVgYl -ntAOhdpN7BYph6cy4lakUCfjM5HGgjoJ+B2exDDB3uqoIuqwXBuVRtdtG8vbof9XXpQr3XGf/BJq -lRidTaBv1ZAv+8enNyfH5/1SiwPRfvputfJ9tSDHJ6/7YR9V59xu8Vi2iFWustiGOqvoL0xFLTUw -FCdFgjbVxgvRKi3Gbpnc92isovuqTwGVCsTf2ievT9vboj0bqYI+vZ8uPfocF0UedDpwQn4X/3rB -Trf3XTnvTvtNSQQ7C6PJNBC7XVsRTiZKT0F7v6rBHjQJVkTslhWszGGuTKLjQPTQtfXBrMpNU9d2 -Fu+bwuRt1PV3nvvdxzfRYqt/biNBHycyi50Eq+YyhuDTeQBbN3V1xSQfNrSr8yBNx0yzzvJAj2ih -E54/l5PU6eFibs1XDW30O/AhSTT3x9O/W6ztSq/ll41+K4aMWUyTwQqLn1eKun35gOZfZelhk75c -YXovK8Mt/vWPf4qZGoi7MzHUZiGabbfM8H/z0sjB/3RkPEkynxyYx8vOxAqZ3lvyVeRmFkCAvNws -Kcbwq/cKSCHT4pSBJMwU+TTyv2KsbVF55i2fyTUWm+ziSEFZ2RuCE2z2VM99OxZDoyel0/ryAqr9 -2tJeG40j4ye6U1TbzTVx2+3q/Pii3G5kbG3x8e3G3T673R7ZIXXnlU3CdR/bJCs+eknZF5z8t1b0 -t4ao6/IVSw0FvuIYn4n/dnZ39hfxH7Xr9Xp7B+v479coG6LWgGUn4aJBF8McTwvtJdZOAVqlOFcF -YqR+Fpl5DgOvTME9n67CPERFcYWbPcLN8IYgBmcybsRaBL8RRCHQgSUloMtBoP9IxGfUT9ME0U8x -ToiOeiujgp0MmV+hMQ4Tu0Go887h0wloiHdPG7iy9R4vP+D0vSg7ZJGOlfjZFrEY/ZzkLa5tutTS -nabJA4li4TWvpLXsIxEUjytgD9OPiBPhZlzS2awNs/PAFgGkVekQDSlacMQA7vuYyxzTzEZCpZZj -0IbISmKrMa8LAb5nGo4NR6/86DxzyAeLApmWzd7V9n8pvmk4yV1sUG70vtXs/6mOi1C+0axyO/CW -01wsIqF3hLZ9Wlr4S3xOdKF8WtT3S103xLnORh7JPQa2SKzqzKALo6k0cS2JMjp6geUZcqgM1zeU -07RYIZXQDNJkgujdMrIB+NDZNwXwCLppk+FxlvlLvYbp1I7DCvkJr7f0tjAysxSNCprOyrSdlICm -S4wogP0mH7SYmaRQdZPVFgtpvF9aDZZoY7wbYM6o8G4rfrwbFU1BeS7aE/nWA9Y52u3t7x5gVV8A -x0bpNFY308GpxlbJbLum8xfvBELFtvNu57nyLnOCBpbetDNts2Q4XLS9VkNljDLeFYPyBtdt69jR -JhklmTcbq8yLjAYacjULGuAT+8E055bqUWNiEEoOuWBn4ltdC7szkQwyrS6hPW3x39qo/oFKA1l+ -tTE+l//d3e1V/r93uLNL/n/vYJ3//VVKM//bjM48T7jUAgOAq0ZOq9D3CqZg8+7qqn8d3lwcv+rD -eEkKbmBRYDqnlJVij2YjjTBoS0ijKA07HdgiKaYU72HTuniPA+dHwj+y3jC0hDhAlINBhJhkpK2i -ZCwlbTk3LGL4gahI52WgJeZ6+g2qzTTLyIEupgfDYZNYlY6BB7eRSfLCd+lLck0GQT2ZcBt0OmG4 -ihPCsOWQSgjMZALR5QRR16WtJxTvRzZ8tMV33e+6LbA9ur46Ec7LeZXbQjCNuVW5RxYFe60XNfKZ -Wsc1VDWL4fFA6Md6Xj+Kk/MzCKmeWx2XUmWBZr64yyjDQwnkb4Gb6KRHJEOSFCjNJKodS8KhGeLT -5NHjM9nv7u3tVi1kmuoZvKIlL4MQeCgBV1otdtAUW+YmeUDEHN6reUiQJBAfJmQ63Dosm/po2mrl -RlHOlCPkhz1KlnT9gz0av9MjOPJwgLHiQxn0evtRIHuqGwSdved4QxxFsgpkgSqyIpEpif60f30V -sChraAn4mUNbk4hfionMgb0mAxXHWAiucnpBgp9boYdDAAYSmSoBQ6ZcJl8jwhZ3p1ed3b3D5yXN -dO63sAdymoMjE5Qgkxe6EpYQULoyFeDVulfqhssIFBW/PlaxQzTBaWeBbUiyNhB/o/yUBFQHwopJ -6vVIZQKvrB4y2sqieSB29satFuUOBtItWAFvD8H9lAKMEN/8xTH30fWLB37docIxkl6HcOGN7OFM -piGxx2m3XANL8cJiX1A7NEkBJbH/kmxIKQ7n29FfvS1o/Y5PzoVL+20DG0haIrYUUryc/t/N5YXg -GGbTKiWWsoPbYqKnWcHWySWyWhuLPQK0vbAQUA67pB10WANE05ZRatslR+5sqT0CxCps22+5wYj/ -CYKHgNlo1eL6RNqSJvVajkj7Lm44hKLdS4udqcIXtCRhzMBMDFR1YgAjMB1ib3D7DAOSZqM7xUAw -ysof+SKVeaFzPwxvEfJc9G9r67UFjcxY1yY0bkgP1fo0hgvEh13RgiIsAyMT0g5LXedKh3l4VvJS -lUepHsh0keHq+fyv8cy59fp556B7EOwddrvuP2zs3ideAj3wS5tD7wLx7j3vMWmicTmFajtAd4wM -4SC0iV1deSQX1EdxtGXGZCac2aiSnYvDOecryHqunMllauaO98rDOYq76l6cHjXKeSdxd33mTkM/ -5Vw6OonpiCZNBwi9W/REAqRsbOiSx8kwpNowsaF8gKLQ/q5XkAN00/RfK0eKvIr1WSGtMnEfwn30 -L25DNGu8d+eHq21u+ifXUApqB9+eq8pskf1L4vIBkWC5B+iJg3DO4169OulztAqBOFUmySMS+JkF -73Hsrd66kBmG2FkvJ0hqfbOzf+CyyPUxLnzuWMcEVibynraGUSuL11wf6KpGAGsdJ5ojvPw+Uit2 -uTZYjnqwGPhauYBGzMZaRDLD+lbqwHux6Wg1gnxs0QkQkEtjs69UcQgj4zbJBstHwiKo79VbOcmd -gV9qPDJ6mjda167AY1dtlxpXql+3XqX6Us9gOgGKHLulW2voP+EPBcsC+IQRUE+phzLvAhhxO8Yj -/iRTi6fG7RhiCBh6k+yiJC8Ko4pZhkAaiZmHZKVDRo21CaHER72wTIzXiRvB7CL6Fq6zoJiRV8Tn -3Ux18BrPu6Rsj45R2aTfGlj/QcqSR/pKY3wm/ts97B4s4r8e5X93ugfr/O+vUjqd5rFeDbHEpgNV -gWBoxVsVTUvjZjm1C8+apBRi8emxBbjodPAnzl5fXV7fHl/cBp+CVs8ctnpWDVimcmDKGQXp3GM4 -SARL+CWNkXNqcHF5y43gf2F6KyQm7ByY7u0ifFxkkNlWtph/ThSVlowBY+JckSPi2WKe1mlDl9ZL -ZY0dHSPVPPtxAjBItjOgx8axWjUnRrpitWxQYJsQFBebLBYa30XQZstRit1hankrrzpLbAxQUUIn -RL6b5XgEQMURz2urZPJYDIFShkoW8I3uNpXYJBTOniWg7PO2g5WIvAdAdvccrjvZdmBdlUloySWv -BBDOggfSgYmcl+eLlLpHQGkEYUB4BV+cDRuNjfp76fYTS5RKjmXhjsW3hYWOReMafSkzAZ5JHhSZ -c8ZD1JZeDXRR6InPOX4QuinghCLSLyOct9wWjILbbobOT7bpaP8DV9t+Q17FNaQm795vtxzVH+Dg -aW5OvrNxQqzJER+Fx4pvOnFX1F3OEEZwbwYN6IzKwI4hRUYmsuzAl8QmCuGlYR/qnDYRNEpGY5du -bi/6OpbrlXI922+20a5m80IVM20gmiii1IeZphQE8PUwsE/ynGHyLyqF9mJVXVSbIebmQ3mn0xir -4r4PZpw4HcKhR/RIDLvlcvLbtNyYgruC5Xh/R7QIEIBamzjK+VqNNdHHpiLasS1WXpJGBs/ab8pJ -MkvH2Zzg1IKfkguS9IhkWAvtF/D1bImRBamKCSHeVOJeWJSbm5eVtAlJWTGBH6Gck/ixhmiIt7H+ -2Fc/OkHjW1PORIKtCu+ahmyhumw42tjK7rYI9Htg9IzWpMJlmw44rbBVrjPw1x3MRjXZMtfTPNxL -saFsaZ/IapSSKiOuhrwcJ9vVCyc0lI+pJrdywlxpRQvbaMMwmFo122Q6M1rz8vBn2Xx5Fegih7h6 -xED8x3dBQOxa8X09tiyVnxkAplboFDt1kwxdbHTulnCLxEnN3fpTbpMpOQtHKog15d0t1OIcDyYE -YscqAPnynZfA9WpswP9MUZ85/SSx/DcHHpxZLU3il0MVy+Uz+G9vZ39vcf5/eEj5//3D3TX++zXK -hjjhW8TuljD7dMCHVNCh9goKyROyGdwMlo027YRcL1R97lNa5V///If7E1cuqVqdzdvFq9/zH6bw -vwR96isFdK3NwgBO1BbFoaZ5A25GQhoo5484Nq6McOOmOOBmRtkf7tu8oLCa+zkaW78ZrINGny8v -UJZv+b6FSzmUkXenCpMReifDMoMFt7e48XDE+Of7FeKcdvQob7iSTbTNg4Q6Fdl3vQM2inTBfyk5 -eETtmuxvA/O4y3+Up4lF2yUk205ogKG0z6ByoFSmKlcp+OL13c0tyTdOhkNILyscrl8VnN/6DC/L -islZhs06O7T1h1HMl4/ppC7d+mOpym2CcLGQLrqgeYOKyxBCuNMaH9JbVy3urs+bP0mIoa9FYvme -C/p2/JlKU+8+A1LpuHxfeSe8TAP5rZV04xEBldW1uG5kzD6RPoXCuxsqd2efy6Q+cr98JZEKhaUs -Ui4xsDshAzV3MOQiIr+1nAg9an2Y9Dxa1qTFlaDN8k5QfRvod6BVYPVP9d1a2AkXETjteCFSJbH/ -BuD+3pkid8H15PLy1Vm/nm557SuiH7pUZy2Nw9RlooxHIYXyxzMuHtn66FAvb0I0C1/1/0rjuNsl -dJ+68WOZ6jKaE/JDIhfK0UzDC7B7eXFaafgvyMQ/pj/uxtSqFp27ySB+cjMir0nniTWbbvYeXYku -f/FTHsA2pr6qaY+/eVTnzuiusgtDf3MN+4V6ufTrhaPyhsHSHesjd8W6Vf9U6Kj6pdA6pbsu67Iu -67Iu67Iu67Iu67Iu67Iu67Iu67Iu67Iu67Iu6/L/LP8GXiwbbgBQAAA= +H4sIAAAAAAAAA+1b/W7bOLbv334Kwil2kk4k24mTdFTkYrJJsMltmuTm484uFgMNI9G2NrKoEaW4 +niLAPsQ+4T7J/Z1DfdlN28HetjMDmA1qiyIPycPz8TuHdKiDe5U5gZ6m2ih3Po2fffbSR9kdDp/1 +d/uDvZ0Bf/b7A65H2ekPt58NdrYG2/29rb3drWf9wdbe3vCZ6H/+qbxfCpPLTIhnO3v+Dzp+UF9j +zN9RWRMTJUMTyFgJcCK4F44jAhmGc7F+c3a9Ib5tNVi/kVHMX1lgZB7doTbQOgujROY62+isddbE +jU51rMdzD9+FqPuIII5Ukhvh/JcdwRsOt+mhHsB72X/ZZxLnWhwkxV1k8DJT3hNETKrkvTi5ubns +bWEKSZ7pWKSZznWg402R6Bwv35xtgpjRQopL/YMIJjKOVTJWYqaLOBR3GdHIJ2rqipNqEt8YcXB5 +KkyRjWSgBKYwm8gcZKqRJ1H+SuTomosoF3F0r4RM5kKDTma7quwhCpTLK7k4PToU4EaUEKlQxWos +cxWKXIuUdC93olCA1PPLi8PXxzenR/7RxZuD03NXXKlxZHLQlPXgNNdMiVGUGcwh0OmcasqXPgh9 +W303KsgUJphgHFclD26nk8gpOFkzu9N50HExVcbriKbWCWUuq5o0lklTw3u29ATGj6Kx1+mUazb1 +K/oiRDSVYwxqa56/Ozw4Ovqbf3PwF8/ZcmScRol65Ha0gRJPmW9nyR34TaZIQXNPFEmsjHFMrtNU +hfwu1Vlu7EBCOKL7sg8J6jbPkC+SsapmrVXXK8K0y3UsQtsk9mFkJAQ6xFB5FItD1oL/uT09BFsz +9aAyo3xI2Nt5Se+psibAtEBNdBxi5+6KMe36KHoLqut/da6UjJ3TSywXfMfWZboYTz5KTU3THLKV +QIinpKEQu6nZIOFwVEKzFTHEKXOZSGtDLQfcHi9iFEG3eioPeszXVmWm67at7e3R/0svyp3u2U9+ +CbGKMp1MIW/VkCfHB0fXhwdnx6UUe6L7/N1y5WO1IQeHb479Y1SdcbvmsWwRqlQlofF1UtFvTEXN +NUwojPIIbSrF89Eqzid2m+z3YKKC+6pPDpHyxN+7h2+OupuiOxurnD6dny8c+pzkeer1enBCbh// +Bt5Wf/Bdue5e98eSCDQLo8nYE9t9UxGOpkoXoL1T1UAHswg7IrbLChZmP1VZpENPDNC1896qSqWp +a3vN+zYzWY367tZLt/+0EjWq/ilFgjxOZRJaDlbNZQjGx3MPtq6wdfk0HbWkq/cgs15WJL3FgZ6Q +Qss8dy6nsZXDZm3tVy1pdHvwIVEwdyfFPwz2dqnX4stWvyVDxlOMo7ulKX5aKOr25QOaf5Gth036 +fIXpnVSGW/z7n/8SM3Unbk/FSGcNazbtNsP/zUsjB//Tk+E0SlxyYA5vOxPLZXxvyFeRm2mAAHm5 +WZRP4FfvFZBCosURA0mYKfJp5H/FRJu88swbLpNrbTbZxbGCsLI3xEyg7LGeu2YiRpmelk7r8zOo +9msLujaeBJkb6V5eqZttYtXt8uzgvFQ3MrYm/7C6cbdPqtsTGlJ3XlISrvuQkiz56AVhb2by/7Wi +vzVEXZUvWGoo8AXH+ET8t7W9tdPEf9RuMBgMd1fx39coa6KWgEUnYaNBG8McFLl2ImMKgFYpzlSO +GOk4CbJ5CgOvspx7Pl+GeYiKwgo3O4Sb4Q1BDM5k0oq1CH4jiEKgA0tKQJeDQPeJiC9TPxcRop98 +EhEd9VYGOTsZMr9CYxwmdo1Q553Fp1PQEO+et3Bl5xEv35vpoyg7JIEOlfjF5KEY/xKlHa5tu9TS +ncbRA7Gi8ZqX0hj2kQiKJxWwh+lHxIlwMyzprNeG2XpggwDSqHiEhhQtWGIA98dYyxzLTMZCxYZj +0BbLSmLLMa8NAb5nGnYall750XthkQ82BTwtm72r7f9CfNNykttQUG702Gn3/1jHJpRvNavcDrxl +kYomEnpHaNulrYW/xOdU58qlTX1c6LomznQydojvIbBFZFRvBlkYFzILa06U0dErbM+IQ2W4vpEs +4nyJVEQriKMponfDyAbgQyff5MAj6KazBI+zxF3oNYoLM/Er5CecwcLbPJOJoWhU0HKWlm25BDRd +YkQB7Dd9r8Usi3JVN1lu0XDjcWE3mKOt8a6BOYPcuanm41yroADluehO5VsHWGd/e7CzvYtdfQUc +G8RFqK6LuyMNVUlMt6bzV+cQTIXaOTfzVDkXKUEDQ2+6iTZJNBo1ba/USGWZypxLBuWtWXeNnY7O +onGUOLOJSpwg00BDtqahgXlCH7L22mI9bi0MTEnBF2gmvtW1sDtTySDT6BLak4r/1kb1D1RayPKL +jfGp/O/29qDy/4O9rW3y/8PdVf73q5R2/rcdnTmOsKkFBgCXrZxWru8VTMH67eXl8ZV/fX7w+hjG +S1JwA4sC01lQVoo9mgk0wqANITNFadjizuRRXlC8B6W18R4Hzk+Ef2S9YWgJcYAoB4MIMclIG0XJ +WEracm5YhPADQR7Py0BLzHXxDaqzIknIgTbLg+EwUahKx8CDmyCL0ty16UtyTRmCejLhxuv1fH8Z +J/h+xyIVH5gp80SfE0R9m7aeUrwfGP/JFt/1v+t3MO3x1eWhsF7OqdwWgmmsrco9MivYa72qkU9h +7KwhqkkIjwdCP9Xr+kkcnp2CSfXa6riUKnM0c8VtQhkeSiB/C9xEJz0iGhGnQGkmUW2nJCyaoXlm +afD0Snb6w+F21ULGsZ7BKxryMgiBRxJwpdNhB02xZZpFD4iY/Xs19wmSeOL9hEyPW/tlUxdNO500 +U5Qz5Qj5YUjJkr67O6TxewOCIw+7GCvck95gsBN4cqD6ntcbvsQbmlEgq0AWqCLJIxkT64+Ory49 +ZmUNLQE/U0hrFPBLMZUpsNf0ToUhNoKrrFwQ4+dG6NEIgIFYpkrAkCibydeIsMXt0WVve7j3sqQZ +z90OdCClNVgyXgkyeaMrZgkBoStTAU4te6Vs2IxAXs3XxS72iCZm2muwDXHWeOLvlJ+SgOpAWCFx +vR6pTOCV1SNGW0kw98TWcNLpUO7gTtoNy+HtwbifY4ARmjd/sZP74P6Fd27docIxkl77cOGt7OFM +xj5Nj9NuqQaW4o2FXlA7NIkBJaF/UTKiFIf17eiv3ua0fweHZ8Km/TaBDSRtEVsKKU6K/76+OBcc +w6wbpcRCdnBTTHWR5GydbCKrs9boCNB2YyEgHGZBOuiwBoimK4PYdMsZ2bOl7hgQKzddt2MHo/lP +ETx4PI1Oza6PpC1pUW/kmKTv/JpDKNJe2uxE5a6gLfFDBmbiTlUnBjACxQi6we0TDEiSje4UA8Eo +K3fsilimuU5d379ByHN+fFNbrw1IZMKyNqVxfXqo9qc1nCfe74oWFGFlMDI+aVhsO1cyzMOzkJei +PI71nYybDNfA5X+tZ86t189bu/1db7jX79v/oNiDj7wEeuCXJoXceeLdI+uYzIJJuYRKHSA7mfTh +IHQW2rrySM6rj+JIZSZkJqzZqJKdzeGc9RVkPZfO5BI1s8d75eEcxV11L06PZsp6J3F7dWpPQz/m +XHo6CumIJo7vEHp36IkYSNlY3yaPo5FPtX5kfPkAQSH9rneQA/Ss7b+WjhR5F+uzQtplmr0P93F8 +fuOjWeu9PT9cbnN9fHgFoaB28O2pqswW2b8oLB8QCZY6QE8chHMe9/L14TFHq2CIFWXiPCKBX5jx +Dsfe6q0NmWGIrfWyjKTW11s7uzaLXB/jwudOdEhgZSrvSTUytbR57f2BrGoEsMbORHOEl94Hasku +1wbLUveaga+UDWjEbKJFIBPsbyUOrIttR6sR5ENFp0BANo3NvlKFPoyMVZI15o+ERVDfq7dymloD +v9B4nOkibbWuXYHDrtosNK5Ev269TPVEz2A6AYrsdEu31pJ/wh8KlgXwCSOgnlIPZd4FMOJmgkf8 +SaYWFpnVGJoQMPQ62UVJXhRGFav0gTSibO6TlfYZNdYmhBIf9cYyMd4nbgSzi+hb2M6CYkbeEZe1 +mergNV72SdieHKOySb81sP6DlAWP9IXG+ET8t721V+d/t4fDHbr/09/bWsV/X6P0eu1jvRpiiXUL +qjzB0IpVFU1L42Y4tQvPGsUUYvHpsQG46PXwJ07fXF5c3Ryc33gfg1YvLLZ6UQ1YpnJgyhkF6dRh +OEgES/gls0zOqcH5xQ03qjCYMHOgubdN4Njkjm2as8wPuTy7nC0YuQJrzCmkhctpdSI/TgGveUVQ +D14BiFOKbi7HFzNAxq6YQmhgKImcpJXB9pFb6X7f3eCWbLW9F91N8gC2J56qqWMsgsHcqOLZ/8IN +EDhvzG88J9bCugLgUIvWqV3FMgbSYrmsWV7zgS2dwFJ0aOPzzNIJQtEz2UMDS8Wf/oR4ho9vy3uA +1ella0x2NGmKOHudcO4+ufiNcvY3TaoVC4AzIhZjvCkgSfQAUM4eysH/4M9sEgWTeg/aeW1QulMT ++RDpIrMil+gKy4ubaDxBNEqOozDEGhvqsjzCbZWuzric+wel6xzOKbC7Y72oK94oBHeZoXyEdThw +RXB8ecTQmYCKsUJU4wc+t2aulZtq3W6Xbgq857npqsCdvluo+nGzU/WlXu8eNzuW4g+AEFPIs+Wp +ZQrkhA/bQ8V3qVzB8mYqeSuFbXNRwCy5SsbWlyWMpK7ZxUz9g9EXxwndupE3Zc50W8slemYCToW8 +2IXV20VV+rC4rnOVz3R2L2QQUDYmK2JiLt9Yw3pzrHIGEq8qeXGwA+XduVlkFE/A6jtGZRQGmgck +PkLVpyKEw1lDSwzBopHZsTZ5bV7VVYh3RI9wCih2aVYp3/YxWfDUwkQ3NDm/eAF2/igeN381pRfU +vZ39rig1rGyT/DXUnprMjxWnG4N1fX0i1jXn6GX8irFdKTRZkYifatAoWByMmfxEh0xWSr16x1Ff +Mp2fPzDD5rWoJiuelI+mlV2EWODEchtGxVataqFMdJJpzVzhz5IB3AndV3n+z1A4s1oarC81xifw +33BrZ9ic/+/tUf5/Z297hf++RlkTh3yL2N4SZlwHzx4LOtRewgRpFNwb2wx2hNR0Si4WXn3uUlrl +3//6p/0TlzapWp3Nm+bV7/kPS/gzIYP6SgFdazMAWVO1QXFo1r4BNyMm3ZFDlWgRtu4rtG6KA3cm +lP3hvu0LCsu5n/2JcdvBOmgc8+UFyvIt3rewKYcy8u5VYTJwajQqM1jAQM2Nh302yd8vEee0o0N5 +w6VsomkfJNSpyMpVsLulC/4LycF9ateePmFge/mP8jSh6NqEZNcyDdCS9AwiB0plqnKZAqDa7fUN +8TeMRiNwL8ktMFtmnNv5xFwWBZNB33qD7v4wgnnylExqPsLJnkxVbhJUDIW0gQCtG1RshhDMLWow +Rm9ttbi9Omv/JCGEvOaR4Xsu6NtzZyqOnftEz5KezfeVd8LLNJDbWUo37lMCaXkvrloZs4+kTyHw +NnS7Pf1UJvWJ++VLidQ1ClDoTgwGtmEDqNmDIfv7ErezmAjd77yf9NxflKTmStB6eSeovg30O5Aq +TPUv9d1a2AkLv610vBKxktC/O8z+3poie8H18OLi9elxvdzy2ldAP3Spzlpah6mLRMU68fX2tPzx +jAX/Gx8c6uTaRzP/9fHfaJyLErl67R/LVJfRLJMfItkIRzsNLzDdi/OjSsL/g0z8U/Jjb0wtS9GZ +XQyCFbsi8pp0nlhP067eoSvR5S9+ygPY1tKXJe3pN0/K3CndVbZB4m8uYf+hXC78emG/vGGwcMd6 +316x7tQ/Fdqvfim0gvursiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiq/svwfUE85lwBQ +AAA= diff --git a/deployments/headscale/policy.hujson b/deployments/headscale/policy.hujson index 75fd8b8..0a43ee0 100644 --- a/deployments/headscale/policy.hujson +++ b/deployments/headscale/policy.hujson @@ -1,49 +1,39 @@ // headscale ACL policy (HuJSON: JSON with // comments and trailing commas). // // IMPORTANT: headscale uses Tailscale's *legacy* policy format -- the top-level -// "acls" array -- NOT the newer "grants" syntax from the Tailscale admin -// console. This file is the grants-style default translated into "acls". +// "acls" array -- NOT the "grants" syntax from the Tailscale admin console. +// It is also stricter than Tailscale in places; notably, a "tagOwner" must be +// a user (has "@"), a "group:*", or a "tag:*" -- NOT an autogroup. // -// Edit, then: -// headscale policy check # validate (uses the wrapper) -// docker compose restart headscale # apply (policy mode = file) +// Validate before relying on it: +// headscale policy check # uses the host CLI wrapper +// cd /srv/headscale && docker compose restart headscale # apply (mode=file) // -// A few features here (autogroup:self, the ssh block) are newer/experimental -// in headscale and may depend on your version. If headscale rejects this -// policy at start, switch to the permissive fallback at the bottom. +// The default below is permissive (allow-all), which is also headscale's +// behaviour with no policy. Tighten it using the commented examples. { - // Static user groups, e.g. "group:admins": ["alice@example.com"]. + // Static user groups. Members are OIDC identities (emails from pocket-id). + // "group:admins": ["alice@example.com", "bob@example.com"], "groups": {}, - // Who may apply which tags to devices. - "tagOwners": { - // tag:shared -- a device any member is allowed to reach. - "tag:shared": ["autogroup:member"], - }, + // Who may apply which tags to devices. Owners must be a user, "group:*", or + // "tag:*" (NOT an autogroup -- headscale rejects e.g. "autogroup:member"). + // "tag:shared": ["group:admins"], + "tagOwners": {}, // Network access rules (first match wins; default-deny otherwise). "acls": [ - // Each user can reach their own devices, on all ports. - { "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:*"] }, - - // Anyone can reach devices tagged tag:shared, on all ports. - { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] }, + // Allow everything. Replace with tighter rules, e.g.: + // { "action": "accept", "src": ["group:admins"], "dst": ["*:*"] }, + // { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] }, + { "action": "accept", "src": ["*"], "dst": ["*:*"] }, ], - // Tailscale SSH rules (nodes must run `tailscale up --ssh`). - "ssh": [ - // SSH into your own devices. "check" = periodic browser re-auth (the - // Tailscale default). Use "accept" if your headscale lacks check mode. - { - "action": "check", - "src": ["autogroup:member"], - "dst": ["autogroup:self"], - "users": ["autogroup:nonroot", "root"], - }, - ], - - // ---- Permissive fallback ---------------------------------------------- - // Replace the "acls" above with this (and drop "ssh") if the rules are - // rejected, to allow everything while you iterate: - // "acls": [ { "action": "accept", "src": ["*"], "dst": ["*:*"] } ], + // Tailscale SSH (optional; nodes must run `tailscale up --ssh`). Example: + // "ssh": [ + // { "action": "accept", + // "src": ["group:admins"], + // "dst": ["tag:shared"], + // "users": ["autogroup:nonroot", "root"] }, + // ], }