feat(headscale): allow-all default ACL with lockdown template
Ship allow-everything as the active default (first acl rule), with the Tailscale default policy translated to headscale's acls format included but commented for when you lock down. Pre-fix the headscale gotchas: tag:shared owned by group:admins (not an autogroup), autogroup:self/ssh-check flagged experimental. Rebuild embedded archive.
This commit is contained in:
@@ -414,81 +414,83 @@ EOF
|
||||
# __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64).
|
||||
exit 0
|
||||
__ARCHIVE_BELOW__
|
||||
H4sIAAAAAAAAA+1b/W7bOLbv334Kwil2kk4k24mTdFTkYrJJsMltmuTm484uFgMNI9G2NrKoEaW4
|
||||
niLAPsQ+4T7J/Z1DfdlN28HetjMDmA1qiyIPycPz8TuHdKiDe5U5gZ6m2ih3Po2fffbSR9kdDp/1
|
||||
d/uDvZ0Bf/b7A65H2ekPt58NdrYG2/29rb3drWf9wdbe3vCZ6H/+qbxfCpPLTIhnO3v+Dzp+UF9j
|
||||
zN9RWRMTJUMTyFgJcCK4F44jAhmGc7F+c3a9Ib5tNVi/kVHMX1lgZB7doTbQOgujROY62+isddbE
|
||||
jU51rMdzD9+FqPuIII5Ukhvh/JcdwRsOt+mhHsB72X/ZZxLnWhwkxV1k8DJT3hNETKrkvTi5ubns
|
||||
bWEKSZ7pWKSZznWg402R6Bwv35xtgpjRQopL/YMIJjKOVTJWYqaLOBR3GdHIJ2rqipNqEt8YcXB5
|
||||
KkyRjWSgBKYwm8gcZKqRJ1H+SuTomosoF3F0r4RM5kKDTma7quwhCpTLK7k4PToU4EaUEKlQxWos
|
||||
cxWKXIuUdC93olCA1PPLi8PXxzenR/7RxZuD03NXXKlxZHLQlPXgNNdMiVGUGcwh0OmcasqXPgh9
|
||||
W303KsgUJphgHFclD26nk8gpOFkzu9N50HExVcbriKbWCWUuq5o0lklTw3u29ATGj6Kx1+mUazb1
|
||||
K/oiRDSVYwxqa56/Ozw4Ovqbf3PwF8/ZcmScRol65Ha0gRJPmW9nyR34TaZIQXNPFEmsjHFMrtNU
|
||||
hfwu1Vlu7EBCOKL7sg8J6jbPkC+SsapmrVXXK8K0y3UsQtsk9mFkJAQ6xFB5FItD1oL/uT09BFsz
|
||||
9aAyo3xI2Nt5Se+psibAtEBNdBxi5+6KMe36KHoLqut/da6UjJ3TSywXfMfWZboYTz5KTU3THLKV
|
||||
QIinpKEQu6nZIOFwVEKzFTHEKXOZSGtDLQfcHi9iFEG3eioPeszXVmWm67at7e3R/0svyp3u2U9+
|
||||
CbGKMp1MIW/VkCfHB0fXhwdnx6UUe6L7/N1y5WO1IQeHb479Y1SdcbvmsWwRqlQlofF1UtFvTEXN
|
||||
NUwojPIIbSrF89Eqzid2m+z3YKKC+6pPDpHyxN+7h2+OupuiOxurnD6dny8c+pzkeer1enBCbh//
|
||||
Bt5Wf/Bdue5e98eSCDQLo8nYE9t9UxGOpkoXoL1T1UAHswg7IrbLChZmP1VZpENPDNC1896qSqWp
|
||||
a3vN+zYzWY367tZLt/+0EjWq/ilFgjxOZRJaDlbNZQjGx3MPtq6wdfk0HbWkq/cgs15WJL3FgZ6Q
|
||||
Qss8dy6nsZXDZm3tVy1pdHvwIVEwdyfFPwz2dqnX4stWvyVDxlOMo7ulKX5aKOr25QOaf5Gth036
|
||||
fIXpnVSGW/z7n/8SM3Unbk/FSGcNazbtNsP/zUsjB//Tk+E0SlxyYA5vOxPLZXxvyFeRm2mAAHm5
|
||||
WZRP4FfvFZBCosURA0mYKfJp5H/FRJu88swbLpNrbTbZxbGCsLI3xEyg7LGeu2YiRpmelk7r8zOo
|
||||
9msLujaeBJkb6V5eqZttYtXt8uzgvFQ3MrYm/7C6cbdPqtsTGlJ3XlISrvuQkiz56AVhb2by/7Wi
|
||||
vzVEXZUvWGoo8AXH+ET8t7W9tdPEf9RuMBgMd1fx39coa6KWgEUnYaNBG8McFLl2ImMKgFYpzlSO
|
||||
GOk4CbJ5CgOvspx7Pl+GeYiKwgo3O4Sb4Q1BDM5k0oq1CH4jiEKgA0tKQJeDQPeJiC9TPxcRop98
|
||||
EhEd9VYGOTsZMr9CYxwmdo1Q553Fp1PQEO+et3Bl5xEv35vpoyg7JIEOlfjF5KEY/xKlHa5tu9TS
|
||||
ncbRA7Gi8ZqX0hj2kQiKJxWwh+lHxIlwMyzprNeG2XpggwDSqHiEhhQtWGIA98dYyxzLTMZCxYZj
|
||||
0BbLSmLLMa8NAb5nGnYall750XthkQ82BTwtm72r7f9CfNNykttQUG702Gn3/1jHJpRvNavcDrxl
|
||||
kYomEnpHaNulrYW/xOdU58qlTX1c6LomznQydojvIbBFZFRvBlkYFzILa06U0dErbM+IQ2W4vpEs
|
||||
4nyJVEQriKMponfDyAbgQyff5MAj6KazBI+zxF3oNYoLM/Er5CecwcLbPJOJoWhU0HKWlm25BDRd
|
||||
YkQB7Dd9r8Usi3JVN1lu0XDjcWE3mKOt8a6BOYPcuanm41yroADluehO5VsHWGd/e7CzvYtdfQUc
|
||||
G8RFqK6LuyMNVUlMt6bzV+cQTIXaOTfzVDkXKUEDQ2+6iTZJNBo1ba/USGWZypxLBuWtWXeNnY7O
|
||||
onGUOLOJSpwg00BDtqahgXlCH7L22mI9bi0MTEnBF2gmvtW1sDtTySDT6BLak4r/1kb1D1RayPKL
|
||||
jfGp/O/29qDy/4O9rW3y/8PdVf73q5R2/rcdnTmOsKkFBgCXrZxWru8VTMH67eXl8ZV/fX7w+hjG
|
||||
S1JwA4sC01lQVoo9mgk0wqANITNFadjizuRRXlC8B6W18R4Hzk+Ef2S9YWgJcYAoB4MIMclIG0XJ
|
||||
WEracm5YhPADQR7Py0BLzHXxDaqzIknIgTbLg+EwUahKx8CDmyCL0ty16UtyTRmCejLhxuv1fH8Z
|
||||
J/h+xyIVH5gp80SfE0R9m7aeUrwfGP/JFt/1v+t3MO3x1eWhsF7OqdwWgmmsrco9MivYa72qkU9h
|
||||
7KwhqkkIjwdCP9Xr+kkcnp2CSfXa6riUKnM0c8VtQhkeSiB/C9xEJz0iGhGnQGkmUW2nJCyaoXlm
|
||||
afD0Snb6w+F21ULGsZ7BKxryMgiBRxJwpdNhB02xZZpFD4iY/Xs19wmSeOL9hEyPW/tlUxdNO500
|
||||
U5Qz5Qj5YUjJkr67O6TxewOCIw+7GCvck95gsBN4cqD6ntcbvsQbmlEgq0AWqCLJIxkT64+Ory49
|
||||
ZmUNLQE/U0hrFPBLMZUpsNf0ToUhNoKrrFwQ4+dG6NEIgIFYpkrAkCibydeIsMXt0WVve7j3sqQZ
|
||||
z90OdCClNVgyXgkyeaMrZgkBoStTAU4te6Vs2IxAXs3XxS72iCZm2muwDXHWeOLvlJ+SgOpAWCFx
|
||||
vR6pTOCV1SNGW0kw98TWcNLpUO7gTtoNy+HtwbifY4ARmjd/sZP74P6Fd27docIxkl77cOGt7OFM
|
||||
xj5Nj9NuqQaW4o2FXlA7NIkBJaF/UTKiFIf17eiv3ua0fweHZ8Km/TaBDSRtEVsKKU6K/76+OBcc
|
||||
w6wbpcRCdnBTTHWR5GydbCKrs9boCNB2YyEgHGZBOuiwBoimK4PYdMsZ2bOl7hgQKzddt2MHo/lP
|
||||
ETx4PI1Oza6PpC1pUW/kmKTv/JpDKNJe2uxE5a6gLfFDBmbiTlUnBjACxQi6we0TDEiSje4UA8Eo
|
||||
K3fsilimuU5d379ByHN+fFNbrw1IZMKyNqVxfXqo9qc1nCfe74oWFGFlMDI+aVhsO1cyzMOzkJei
|
||||
PI71nYybDNfA5X+tZ86t189bu/1db7jX79v/oNiDj7wEeuCXJoXceeLdI+uYzIJJuYRKHSA7mfTh
|
||||
IHQW2rrySM6rj+JIZSZkJqzZqJKdzeGc9RVkPZfO5BI1s8d75eEcxV11L06PZsp6J3F7dWpPQz/m
|
||||
XHo6CumIJo7vEHp36IkYSNlY3yaPo5FPtX5kfPkAQSH9rneQA/Ss7b+WjhR5F+uzQtplmr0P93F8
|
||||
fuOjWeu9PT9cbnN9fHgFoaB28O2pqswW2b8oLB8QCZY6QE8chHMe9/L14TFHq2CIFWXiPCKBX5jx
|
||||
Dsfe6q0NmWGIrfWyjKTW11s7uzaLXB/jwudOdEhgZSrvSTUytbR57f2BrGoEsMbORHOEl94Hasku
|
||||
1wbLUveaga+UDWjEbKJFIBPsbyUOrIttR6sR5ENFp0BANo3NvlKFPoyMVZI15o+ERVDfq7dymloD
|
||||
v9B4nOkibbWuXYHDrtosNK5Ev269TPVEz2A6AYrsdEu31pJ/wh8KlgXwCSOgnlIPZd4FMOJmgkf8
|
||||
SaYWFpnVGJoQMPQ62UVJXhRGFav0gTSibO6TlfYZNdYmhBIf9cYyMd4nbgSzi+hb2M6CYkbeEZe1
|
||||
mergNV72SdieHKOySb81sP6DlAWP9IXG+ET8t721V+d/t4fDHbr/09/bWsV/X6P0eu1jvRpiiXUL
|
||||
qjzB0IpVFU1L42Y4tQvPGsUUYvHpsQG46PXwJ07fXF5c3Ryc33gfg1YvLLZ6UQ1YpnJgyhkF6dRh
|
||||
OEgES/gls0zOqcH5xQ03qjCYMHOgubdN4Njkjm2as8wPuTy7nC0YuQJrzCmkhctpdSI/TgGveUVQ
|
||||
D14BiFOKbi7HFzNAxq6YQmhgKImcpJXB9pFb6X7f3eCWbLW9F91N8gC2J56qqWMsgsHcqOLZ/8IN
|
||||
EDhvzG88J9bCugLgUIvWqV3FMgbSYrmsWV7zgS2dwFJ0aOPzzNIJQtEz2UMDS8Wf/oR4ho9vy3uA
|
||||
1ella0x2NGmKOHudcO4+ufiNcvY3TaoVC4AzIhZjvCkgSfQAUM4eysH/4M9sEgWTeg/aeW1QulMT
|
||||
+RDpIrMil+gKy4ubaDxBNEqOozDEGhvqsjzCbZWuzric+wel6xzOKbC7Y72oK94oBHeZoXyEdThw
|
||||
RXB8ecTQmYCKsUJU4wc+t2aulZtq3W6Xbgq857npqsCdvluo+nGzU/WlXu8eNzuW4g+AEFPIs+Wp
|
||||
ZQrkhA/bQ8V3qVzB8mYqeSuFbXNRwCy5SsbWlyWMpK7ZxUz9g9EXxwndupE3Zc50W8slemYCToW8
|
||||
2IXV20VV+rC4rnOVz3R2L2QQUDYmK2JiLt9Yw3pzrHIGEq8qeXGwA+XduVlkFE/A6jtGZRQGmgck
|
||||
PkLVpyKEw1lDSwzBopHZsTZ5bV7VVYh3RI9wCih2aVYp3/YxWfDUwkQ3NDm/eAF2/igeN381pRfU
|
||||
vZ39rig1rGyT/DXUnprMjxWnG4N1fX0i1jXn6GX8irFdKTRZkYifatAoWByMmfxEh0xWSr16x1Ff
|
||||
Mp2fPzDD5rWoJiuelI+mlV2EWODEchtGxVataqFMdJJpzVzhz5IB3AndV3n+z1A4s1oarC81xifw
|
||||
33BrZ9ic/+/tUf5/Z297hf++RlkTh3yL2N4SZlwHzx4LOtRewgRpFNwb2wx2hNR0Si4WXn3uUlrl
|
||||
3//6p/0TlzapWp3Nm+bV7/kPS/gzIYP6SgFdazMAWVO1QXFo1r4BNyMm3ZFDlWgRtu4rtG6KA3cm
|
||||
lP3hvu0LCsu5n/2JcdvBOmgc8+UFyvIt3rewKYcy8u5VYTJwajQqM1jAQM2Nh302yd8vEee0o0N5
|
||||
w6VsomkfJNSpyMpVsLulC/4LycF9ateePmFge/mP8jSh6NqEZNcyDdCS9AwiB0plqnKZAqDa7fUN
|
||||
8TeMRiNwL8ktMFtmnNv5xFwWBZNB33qD7v4wgnnylExqPsLJnkxVbhJUDIW0gQCtG1RshhDMLWow
|
||||
Rm9ttbi9Omv/JCGEvOaR4Xsu6NtzZyqOnftEz5KezfeVd8LLNJDbWUo37lMCaXkvrloZs4+kTyHw
|
||||
NnS7Pf1UJvWJ++VLidQ1ClDoTgwGtmEDqNmDIfv7ErezmAjd77yf9NxflKTmStB6eSeovg30O5Aq
|
||||
TPUv9d1a2AkLv610vBKxktC/O8z+3poie8H18OLi9elxvdzy2ldAP3Spzlpah6mLRMU68fX2tPzx
|
||||
jAX/Gx8c6uTaRzP/9fHfaJyLErl67R/LVJfRLJMfItkIRzsNLzDdi/OjSsL/g0z8U/Jjb0wtS9GZ
|
||||
XQyCFbsi8pp0nlhP067eoSvR5S9+ygPY1tKXJe3pN0/K3CndVbZB4m8uYf+hXC78emG/vGGwcMd6
|
||||
316x7tQ/Fdqvfim0gvursiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiq/svwfUE85lwBQ
|
||||
AAA=
|
||||
H4sIAAAAAAAAA+1b63LbOJbObz0FSk5N290mJfmaZspb7bW1Y28c2+tLzXRNdTEQCUlcUwSboKyo
|
||||
U6mah5gnnCfZ7xzwJlkdz+520p0qISlLBIED4OBcvnMAhTp4UJkT6EmqjXLnk/jFb166KAd7ey+6
|
||||
B93e4X6PP7vdHtej7Hf3dl/09nd6u93DncODnRfd3s7h4d4L0f3tp/K0TE0uMyFe7B/6f9Hxo/oS
|
||||
Y/6ByoYYKxmaQMZKgBPBg3AcEcgwnIvNu4vbLfFdo8HmnYxi/soCI/NogNpA6yyMEpnrbKu10doQ
|
||||
dzrVsR7NPXwXouojgjhSSW6E8292BG9vb5ceqgG8V91XXSZxqcVxMh1EBi8z5a0gYlIlH8TZ3d11
|
||||
ZwdTSPJMxyLNdK4DHW+LROd4+fZiG8SMFlJc67+IYCzjWCUjJWZ6GodikBGNfKwmrjgrJ/GNEcfX
|
||||
58JMs6EMlMAUZmOZg0w58jjKX4scXXMR5SKOHpSQyVxo0MlsV5U9RoFyeSVX56cnAtyIEiIVqliN
|
||||
ZK5CkWuRku7lThQKkHp5fXXypn93fuqfXr09Pr90xY0aRSYHTVkNTnPNlBhGmcEcAp3OqaZ46YPQ
|
||||
d+V3o4JMYYIJxnFV8ui2WomcgJMVs1utRx1PJ8p4LVHXOqHMZVmTxjKpa3jPlp7A+GE08lqtYs2m
|
||||
ekVfhIgmcoRBbc3LDyfHp6c/+nfHf/acHUfGaZSoj9yONlDiKfPtLLkDv8kUKWjuiWkSK2Mck+s0
|
||||
VSG/S3WWGzuQEI5ov+pCgtr1M+SLZKys2WjUdaZh2uY6FqFdEvswMhICHWKoPIrFCWvBf92fn4Ct
|
||||
mXpUmVE+JOz9vKC3qmwIMC1QYx2H2LnBdES7Pozeg+rmX50bJWPn/BrLBd+xdZmejsafpKYmaQ7Z
|
||||
SiDEE9JQiN3EbJFwOCqh2YoY4pS5TKSxoZYDbocXMYygWx2VBx3ma6My01XbxvZ26O/Si2KnO/aT
|
||||
X0KsokwnE8hbOeRZ//j09uT4ol9IsSfaLz8sV34sN+T45G3f76PqgtvVj0WLUKUqCY2vk5J+bSoq
|
||||
rmFCYZRHaFMqno9WcT6222S/B2MVPJR9coiUJ/7WPnl72t4W7dlI5fTp/Hzl0Oc4z1Ov04ETcrv4
|
||||
1/N2ur3vi3V32j8VRKBZGE3GntjtmpJwNFF6Ctr7ZQ10MIuwI2K3qGBh9lOVRTr0RA9dW09WVShN
|
||||
Vdup3zeZyWrUdXdeud3VSlSr+nOKBHmcyCS0HCybyxCMj+cebN3U1uWTdNiQrs6jzDrZNOksDrRC
|
||||
Ci3z3LmcxFYO67U1XzWk0e3Ah0TB3B1P/9tgb5d6Lb5s9FsyZDzFOBosTfF5oajaFw9o/lm2Hjbp
|
||||
tytM76w03OKff/+HmKmBuD8XQ53VrNm22wz/Ny+MHPxPR4aTKHHJgTm87Uwsl/GDIV9FbqYGAuTl
|
||||
ZlE+hl99UEAKiRanDCRhpsinkf8VY23y0jNvuUyusdlkF0cKwsreEDOBssd67pqxGGZ6Ujit355B
|
||||
lV9b0LXROMjcSHfyUt1sE6tu1xfHl4W6kbE1+a+rG3d7Vt1WaEjVeUlJuO7XlGTJRy8Iez2T/68V
|
||||
/b0h6rp8xlJBgc84xjPx387uzn4d/1G7Xq+3d7CO/75E2RCVBCw6CRsN2hjmeJprJzJmCtAqxYXK
|
||||
ESP1kyCbpzDwKsu558tlmIeoKCxxs0O4Gd4QxOBMxo1Yi+A3gigEOrCkBHQ5CHRXRHyZ+nkaIfrJ
|
||||
xxHRUe9lkLOTIfMrNMZhYrcIdT5YfDoBDfHhZQNXtj7i5ZOZfhRFhyTQoRK/mDwUo1+itMW1TZda
|
||||
uNM4eiRW1F7zWhrDPhJB8bgE9jD9iDgRboYFnc3KMFsPbBBAGhUP0ZCiBUsM4L6PtcyxzGQkVGw4
|
||||
Bm2wrCC2HPPaEOAHpmGnYekVH51vLfLBpoCnRbMPlf1fiG8aTnIXCsqNPraa/T/VsQ7lG81KtwNv
|
||||
OU1FHQl9ILTt0tbCX+JzonPl0qZ+XOi6IS50MnKI7yGwRWRUZwZZGE1lFlacKKKj19ieIYfKcH1D
|
||||
OY3zJVIRrSCOJojeDSMbgA+dfJMDj6CbzhI8zhJ3odcwnpqxXyI/4fQW3uaZTAxFo4KWs7RsyyWg
|
||||
6QIjCmC/yZMWsyzKVdVkuUXNjY8Lu8EcbYx3C8wZ5M5dOR/nVgVTUJ6L9kS+d4B1jnZ7+7sH2NXX
|
||||
wLFBPA3V7XRwqqEqiWlXdP7qnICpUDvnbp4q5yolaGDoTTvRJomGw7rtjRqqLFOZc82gvDHrtrHT
|
||||
0Vk0ihJnNlaJE2QaaMjW1DQwT+hD1lxbrEeNhYEpKfgCzcS3qhZ2ZyIZZBpdQHtS8d/bqH5FpYEs
|
||||
P9sYz+V/d3d7pf/vHe7skv/fO1jnf79IaeZ/m9GZ4wibWmAAcN3IaeX6QcEUbN5fX/dv/NvL4zd9
|
||||
GC9JwQ0sCkznlLJS7NFMoBEGbQmZKUrDTgcmj/IpxXtQWhvvceC8Ivwj6w1DS4gDRDkYRIhJRtoo
|
||||
SsZS0pZzwyKEHwjyeF4EWmKup9+gOpsmCTnQenkwHCYKVeEYeHATZFGauzZ9Sa4pQ1BPJtx4nY7v
|
||||
L+ME329ZpOIDM2We6HKCqGvT1hOK9wPjr2zxfff7bgvTHt1cnwjr5ZzSbSGYxtrK3COzgr3W6wr5
|
||||
TI2dNUQ1CeHxQOhdta534uTiHEyq1lbFpVSZo5kr7hPK8FAC+TvgJjrpEdGQOAVKM4lqOyVh0QzN
|
||||
M0uD1SvZ7+7t7ZYtZBzrGbyiIS+DEHgoAVdaLXbQFFumWfSIiNl/UHOfIIknniZkOtzaL5q6aNpq
|
||||
pZminClHyI97lCzpugd7NH6nR3Dk8QBjhYfS6/X2A0/2VNfzOnuv8IZmFMgykAWqSPJIxsT60/7N
|
||||
tcesrKAl4GcKaY0CfikmMgX2mgxUGGIjuMrKBTF+boQeDgEYiGWqAAyJspl8jQhb3J9ed3b3Dl8V
|
||||
NOO524IOpLQGS8YrQCZvdMksISB0RSrAqWSvkA2bEcjL+brYxQ7RxEw7NbYhzhpP/I3yUxJQHQgr
|
||||
JK5XIxUJvKJ6yGgrCeae2Nkbt1qUOxhIu2E5vD0Y93MMMELz5i92cr+6f+HArTqUOEbSax8uvJE9
|
||||
nMnYp+lx2i3VwFK8sdALaocmMaAk9C9KhpTisL4d/dX7nPbv+ORC2LTfNrCBpC1iSyHF2fQ/b68u
|
||||
Bccwm0YpsZAd3BYTPU1ytk42kdXaqHUEaLu2EBAOsyAddFgDRNOWQWzaxYzs2VJ7BIiVm7bbsoPR
|
||||
/CcIHjyeRqti1yfSlrSot3JE0nd5yyEUaS9tdqJyV9CW+CEDMzFQ5YkBjMB0CN3g9gkGJMlGd4qB
|
||||
YJSVO3JFLNNcp67v3yHkuezfVdZrCxKZsKxNaFyfHsr9aQzniadd0YIirAxGxicNi23nUoZ5eBby
|
||||
QpRHsR7IuM5w9Vz+13jm3Hr1vHPQPfD2Drtd+weK3fvES6AHfmlSyJ0nPnxkHZNZMC6WUKoDZCeT
|
||||
PhyEzkJbVxzJedVRHKnMmMyENRtlsrM+nLO+gqzn0plcomb2eK84nKO4q+rF6dFMWe8k7m/O7Wno
|
||||
p5xLR0chHdHE8QChd4ueiIGUjfVt8jga+lTrR8aXjxAU0u9qBzlAz5r+a+lIkXexOiukXabZ+3Af
|
||||
/cs7H80a7+354XKb2/7JDYSC2sG3p6o0W2T/orB4QCRY6AA9cRDOedzrNyd9jlbBECvKxHlEAr8w
|
||||
4x2OvdV7GzLDEFvrZRlJrW939g9sFrk6xoXPHeuQwMpEPpBqZGpp85r7A1nVCGCNnYnmCC99CNSS
|
||||
Xa4MlqXu1QPfKBvQiNlYi0Am2N9SHFgXm45WI8iHik6AgGwam32lCn0YGaskG8wfCYugflDv5SS1
|
||||
Bn6h8SjT07TRunIFDrtqs9C4FP2q9TLVMz2D6QQostMt3FpD/gl/KFgWwCeMgHpKPRR5F8CIuzEe
|
||||
8V8ytXCaWY2hCQFDb5JdlORFYVSxSh9II8rmPllpn1FjZUIo8VFtLBPjfeJGMLuIvoXtLChm5B1x
|
||||
WZupDl7jVZeEbeUYpU36vYH1V1IWPNJnGuOZ+G+v1zss47/9XY7/droHu+v470uUTqd5rFdBLLFp
|
||||
QZUnGFqxqqJpYdwMp3bhWaOYQiw+PTYAF51Oa4Hev4SnxObl1R1b7RJTCTMHOntPtKpYsE4H28xl
|
||||
kfLZ4pnAJFnDTO5PinYuR1czgLu2mGB7YdJgsUCMLK/YJAfQ/qG9tU0t2b5637a3yVbbnngih5JQ
|
||||
XhPUGVFzs3J9p/3/OL6/uBNH1vAKVWdrN2mqfDtHYIkYGO9hDO80zG7wwGnFbVF5iGlO5PKxtN4C
|
||||
vFSWsQQDo9GYHEs2jQnXIVTLGjwosP+2TTzSoWS4xbTIC5KRdWkvDQXe4Bcd7D3Sqa+GOSWQzPN2
|
||||
8Jc4h1jLMHohi5yYcgZEzl5pslMgUgSYc2IOyARjezWKbyDNKeI2cqgIPcVKPioGQ5Q1KLl2PKTl
|
||||
HF/+KICJMHME9xGFI6XDkWkaz8FDjxo3jihLgeSowb4LQtEx2WONq8Wf/gTe8vlzcZGxPH5t3IGg
|
||||
XCLNg8WHnbDYZK/DCMVYUauAA1+xsX6PAVgRLxcooXBbzPGRZ8aSm5HI2T2nMJLu7fDdHzo2eMp2
|
||||
GdCmkFezQmjaXpHuBNVCLq2Pb9O1hCcwge4lDPRgoeqnbRD4uN2yU7uTIzsnI97e396xGlgd6NSC
|
||||
T98Lobf+uyHwfGgPQjWowQvFMsEGoTlJIQeQO+uuiU+VvPMKS4VcXGTNO17iwpobS7HWAi3KjkdU
|
||||
SjX0nmihK05qDePTIqtaeUMLXUuEKX6gEQjIYAx8C1TK14FMFvC0vsVcRDs0uX0Cp34qJtaYzI/P
|
||||
6qfYtDsOaQqWREEPh1uN+YBoX0K9eKssyqRH8D3KGBqFiq/agWK5Ux6fIoEU4JDKIlq8jEtiEPda
|
||||
U6C8lebxJr5brWnvtryy/zP8qScxUZMBjG6TXYszLHlXED5O5mT36iWWC4NgjCixUuvWJmVaTBEg
|
||||
W1myEvcvT3NxG2vS9Zx+qhWn3Mfb2zNSCwKs7EmyaSLeVRhcTFPw05jxuy13QUns9lpiRIITD2zC
|
||||
G9vnijZzug1HYi8FRYEYZHpG217Ab1YeDNCU/oV1WgoVR0W5XrF6YxrtLCfEkz1abMV2cmknE51k
|
||||
WjNz+bNm3/rk5asrnFkvfMjnGuM5/L+zv1ff/zg8pPOf/cM1/v8iZQPOkm6R21viDP6GEbkluMgl
|
||||
SJVGwYOxzWD4yB4AvUeUrpq7lFb75z/+bv+La5tUL+9mmPrVH/k/lvDvhHKrKyV0rdHAwk4QZsz4
|
||||
rKn2lTNi0kBZx8W5kdIrNH4pgCAloewf921eUFnO/R2NjdtM1oBGny+vUJZ38b6NTTkVmZdOmSYB
|
||||
dIuGRQbTuK36xssR46kflohz2tmhvPFSNtk0D5KqVHTf9vYYMdAPPBaSw0fUrjl9iqzs5U/K04Wi
|
||||
bRPSbcs0IHPSM4gcKBWp6mUKboVYw2g4BPfgVhmfLzPObT0zl0XBZLy/WYP8r0Ywz1bJpB5aULEq
|
||||
Vb1N8DEU0mImWjeo2AwxmEtYBsprUWVRLe5vLpo/SQkhr3lk+J4T+nbcmYpj5yEBhOnYfG/xm4Ai
|
||||
Dei2ltLNR4xglvbippEx/UT6HAJv4/z78+cy6St+X7CUSIfAUliSSgxsT0hBzR4M2t8Xua3FRPhR
|
||||
62nS+2hRkuorYZvFnbDqNtgfQKow1T9Xd6thJ2xKwkrH6yJAH2D2D9YU2QvOJ1dXb8771XKLa38B
|
||||
/dCpPGtrHKYvErWZj/vz4sdTBL+N2frVoc5ufTTz3/R/pHHs7SK6T9/4sVR5GdEy+TGStXA0j2EE
|
||||
pnt1eVpK+P/hJGaV/Ngbc8tSdGEXo0GOV0Rek86Tq2na1Tt0Jb74xVdxAN9Y+rKkrX6zUubO6a46
|
||||
xT9fiUNdIZcLv145Km6YLNyxP7JX7FvVT8WOyl+KrYOLdVmXdVmXdVmXdVmXdVmXdVmXdVmXdVmX
|
||||
dVmXdVmX/0X5H8de64YAUAAA
|
||||
|
||||
@@ -1,39 +1,48 @@
|
||||
// headscale ACL policy (HuJSON: JSON with // comments and trailing commas).
|
||||
//
|
||||
// IMPORTANT: headscale uses Tailscale's *legacy* policy format -- the top-level
|
||||
// "acls" array -- NOT the "grants" syntax from the Tailscale admin console.
|
||||
// It is also stricter than Tailscale in places; notably, a "tagOwner" must be
|
||||
// a user (has "@"), a "group:*", or a "tag:*" -- NOT an autogroup.
|
||||
// headscale uses Tailscale's legacy "acls" format (NOT the "grants" syntax
|
||||
// from the Tailscale admin console) and is stricter: a "tagOwner" must be a
|
||||
// user (has "@"), a "group:*", or a "tag:*" -- never an autogroup.
|
||||
//
|
||||
// Validate before relying on it:
|
||||
// headscale policy check # uses the host CLI wrapper
|
||||
// cd /srv/headscale && docker compose restart headscale # apply (mode=file)
|
||||
// DEFAULT = allow everything (the first acl below). To lock down, comment out
|
||||
// that one line and the tighter rules (your Tailscale default, translated)
|
||||
// take over. ACLs are additive, so while allow-all is present it wins and the
|
||||
// other rules are inert -- which is why they're safe to leave in place.
|
||||
//
|
||||
// The default below is permissive (allow-all), which is also headscale's
|
||||
// behaviour with no policy. Tighten it using the commented examples.
|
||||
// After ANY edit, validate before applying:
|
||||
// headscale policy check
|
||||
// cd /srv/headscale && docker compose restart headscale
|
||||
{
|
||||
// Static user groups. Members are OIDC identities (emails from pocket-id).
|
||||
// "group:admins": ["alice@example.com", "bob@example.com"],
|
||||
"groups": {},
|
||||
// Admin users (OIDC emails from pocket-id). Required only if you enable the
|
||||
// tag:shared owner below. Empty is fine while allow-all is active.
|
||||
"groups": {
|
||||
// "group:admins": ["alice@example.com", "bob@example.com"],
|
||||
},
|
||||
|
||||
// Who may apply which tags to devices. Owners must be a user, "group:*", or
|
||||
// "tag:*" (NOT an autogroup -- headscale rejects e.g. "autogroup:member").
|
||||
// "tag:shared": ["group:admins"],
|
||||
"tagOwners": {},
|
||||
// Tag owners MUST be a user / "group:*" / "tag:*" (not an autogroup).
|
||||
// Uncomment together with group:admins above when you lock down.
|
||||
"tagOwners": {
|
||||
// "tag:shared": ["group:admins"],
|
||||
},
|
||||
|
||||
// Network access rules (first match wins; default-deny otherwise).
|
||||
"acls": [
|
||||
// Allow everything. Replace with tighter rules, e.g.:
|
||||
// { "action": "accept", "src": ["group:admins"], "dst": ["*:*"] },
|
||||
// { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] },
|
||||
// ===== DEFAULT: allow everything. Comment out this line to lock down. =====
|
||||
{ "action": "accept", "src": ["*"], "dst": ["*:*"] },
|
||||
|
||||
// ===== Your Tailscale default, translated (active once allow-all is off) =====
|
||||
// Each user can reach their own devices (autogroup:self is experimental
|
||||
// in headscale -- validate with `headscale policy check`):
|
||||
// { "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:*"] },
|
||||
// Anyone can reach devices tagged tag:shared (needs the tagOwner above):
|
||||
// { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] },
|
||||
],
|
||||
|
||||
// Tailscale SSH (optional; nodes must run `tailscale up --ssh`). Example:
|
||||
// "ssh": [
|
||||
// { "action": "accept",
|
||||
// "src": ["group:admins"],
|
||||
// "dst": ["tag:shared"],
|
||||
// "users": ["autogroup:nonroot", "root"] },
|
||||
// ],
|
||||
// Tailscale SSH (nodes must run `tailscale up --ssh`). Uncomment to allow
|
||||
// SSH into your own devices. "check" = periodic browser re-auth.
|
||||
"ssh": [
|
||||
// { "action": "check",
|
||||
// "src": ["autogroup:member"],
|
||||
// "dst": ["autogroup:self"],
|
||||
// "users": ["autogroup:nonroot", "root"] },
|
||||
],
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user