feat(headscale): allow-all default ACL with lockdown template

Ship allow-everything as the active default (first acl rule), with the
Tailscale default policy translated to headscale's acls format included but
commented for when you lock down. Pre-fix the headscale gotchas: tag:shared
owned by group:admins (not an autogroup), autogroup:self/ssh-check flagged
experimental. Rebuild embedded archive.
This commit is contained in:
2026-06-12 16:32:41 -05:00
parent 6a3fc68b75
commit 73cf299417
2 changed files with 116 additions and 105 deletions
+80 -78
View File
@@ -414,81 +414,83 @@ EOF
# __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64).
exit 0
__ARCHIVE_BELOW__
H4sIAAAAAAAAA+1b/W7bOLbv334Kwil2kk4k24mTdFTkYrJJsMltmuTm484uFgMNI9G2NrKoEaW4
niLAPsQ+4T7J/Z1DfdlN28HetjMDmA1qiyIPycPz8TuHdKiDe5U5gZ6m2ih3Po2fffbSR9kdDp/1
d/uDvZ0Bf/b7A65H2ekPt58NdrYG2/29rb3drWf9wdbe3vCZ6H/+qbxfCpPLTIhnO3v+Dzp+UF9j
zN9RWRMTJUMTyFgJcCK4F44jAhmGc7F+c3a9Ib5tNVi/kVHMX1lgZB7doTbQOgujROY62+isddbE
jU51rMdzD9+FqPuIII5Ukhvh/JcdwRsOt+mhHsB72X/ZZxLnWhwkxV1k8DJT3hNETKrkvTi5ubns
bWEKSZ7pWKSZznWg402R6Bwv35xtgpjRQopL/YMIJjKOVTJWYqaLOBR3GdHIJ2rqipNqEt8YcXB5
KkyRjWSgBKYwm8gcZKqRJ1H+SuTomosoF3F0r4RM5kKDTma7quwhCpTLK7k4PToU4EaUEKlQxWos
cxWKXIuUdC93olCA1PPLi8PXxzenR/7RxZuD03NXXKlxZHLQlPXgNNdMiVGUGcwh0OmcasqXPgh9
W303KsgUJphgHFclD26nk8gpOFkzu9N50HExVcbriKbWCWUuq5o0lklTw3u29ATGj6Kx1+mUazb1
K/oiRDSVYwxqa56/Ozw4Ovqbf3PwF8/ZcmScRol65Ha0gRJPmW9nyR34TaZIQXNPFEmsjHFMrtNU
hfwu1Vlu7EBCOKL7sg8J6jbPkC+SsapmrVXXK8K0y3UsQtsk9mFkJAQ6xFB5FItD1oL/uT09BFsz
9aAyo3xI2Nt5Se+psibAtEBNdBxi5+6KMe36KHoLqut/da6UjJ3TSywXfMfWZboYTz5KTU3THLKV
QIinpKEQu6nZIOFwVEKzFTHEKXOZSGtDLQfcHi9iFEG3eioPeszXVmWm67at7e3R/0svyp3u2U9+
CbGKMp1MIW/VkCfHB0fXhwdnx6UUe6L7/N1y5WO1IQeHb479Y1SdcbvmsWwRqlQlofF1UtFvTEXN
NUwojPIIbSrF89Eqzid2m+z3YKKC+6pPDpHyxN+7h2+OupuiOxurnD6dny8c+pzkeer1enBCbh//
Bt5Wf/Bdue5e98eSCDQLo8nYE9t9UxGOpkoXoL1T1UAHswg7IrbLChZmP1VZpENPDNC1896qSqWp
a3vN+zYzWY367tZLt/+0EjWq/ilFgjxOZRJaDlbNZQjGx3MPtq6wdfk0HbWkq/cgs15WJL3FgZ6Q
Qss8dy6nsZXDZm3tVy1pdHvwIVEwdyfFPwz2dqnX4stWvyVDxlOMo7ulKX5aKOr25QOaf5Gth036
fIXpnVSGW/z7n/8SM3Unbk/FSGcNazbtNsP/zUsjB//Tk+E0SlxyYA5vOxPLZXxvyFeRm2mAAHm5
WZRP4FfvFZBCosURA0mYKfJp5H/FRJu88swbLpNrbTbZxbGCsLI3xEyg7LGeu2YiRpmelk7r8zOo
9msLujaeBJkb6V5eqZttYtXt8uzgvFQ3MrYm/7C6cbdPqtsTGlJ3XlISrvuQkiz56AVhb2by/7Wi
vzVEXZUvWGoo8AXH+ET8t7W9tdPEf9RuMBgMd1fx39coa6KWgEUnYaNBG8McFLl2ImMKgFYpzlSO
GOk4CbJ5CgOvspx7Pl+GeYiKwgo3O4Sb4Q1BDM5k0oq1CH4jiEKgA0tKQJeDQPeJiC9TPxcRop98
EhEd9VYGOTsZMr9CYxwmdo1Q553Fp1PQEO+et3Bl5xEv35vpoyg7JIEOlfjF5KEY/xKlHa5tu9TS
ncbRA7Gi8ZqX0hj2kQiKJxWwh+lHxIlwMyzprNeG2XpggwDSqHiEhhQtWGIA98dYyxzLTMZCxYZj
0BbLSmLLMa8NAb5nGnYall750XthkQ82BTwtm72r7f9CfNNykttQUG702Gn3/1jHJpRvNavcDrxl
kYomEnpHaNulrYW/xOdU58qlTX1c6LomznQydojvIbBFZFRvBlkYFzILa06U0dErbM+IQ2W4vpEs
4nyJVEQriKMponfDyAbgQyff5MAj6KazBI+zxF3oNYoLM/Er5CecwcLbPJOJoWhU0HKWlm25BDRd
YkQB7Dd9r8Usi3JVN1lu0XDjcWE3mKOt8a6BOYPcuanm41yroADluehO5VsHWGd/e7CzvYtdfQUc
G8RFqK6LuyMNVUlMt6bzV+cQTIXaOTfzVDkXKUEDQ2+6iTZJNBo1ba/USGWZypxLBuWtWXeNnY7O
onGUOLOJSpwg00BDtqahgXlCH7L22mI9bi0MTEnBF2gmvtW1sDtTySDT6BLak4r/1kb1D1RayPKL
jfGp/O/29qDy/4O9rW3y/8PdVf73q5R2/rcdnTmOsKkFBgCXrZxWru8VTMH67eXl8ZV/fX7w+hjG
S1JwA4sC01lQVoo9mgk0wqANITNFadjizuRRXlC8B6W18R4Hzk+Ef2S9YWgJcYAoB4MIMclIG0XJ
WEracm5YhPADQR7Py0BLzHXxDaqzIknIgTbLg+EwUahKx8CDmyCL0ty16UtyTRmCejLhxuv1fH8Z
J/h+xyIVH5gp80SfE0R9m7aeUrwfGP/JFt/1v+t3MO3x1eWhsF7OqdwWgmmsrco9MivYa72qkU9h
7KwhqkkIjwdCP9Xr+kkcnp2CSfXa6riUKnM0c8VtQhkeSiB/C9xEJz0iGhGnQGkmUW2nJCyaoXlm
afD0Snb6w+F21ULGsZ7BKxryMgiBRxJwpdNhB02xZZpFD4iY/Xs19wmSeOL9hEyPW/tlUxdNO500
U5Qz5Qj5YUjJkr67O6TxewOCIw+7GCvck95gsBN4cqD6ntcbvsQbmlEgq0AWqCLJIxkT64+Ory49
ZmUNLQE/U0hrFPBLMZUpsNf0ToUhNoKrrFwQ4+dG6NEIgIFYpkrAkCibydeIsMXt0WVve7j3sqQZ
z90OdCClNVgyXgkyeaMrZgkBoStTAU4te6Vs2IxAXs3XxS72iCZm2muwDXHWeOLvlJ+SgOpAWCFx
vR6pTOCV1SNGW0kw98TWcNLpUO7gTtoNy+HtwbifY4ARmjd/sZP74P6Fd27docIxkl77cOGt7OFM
xj5Nj9NuqQaW4o2FXlA7NIkBJaF/UTKiFIf17eiv3ua0fweHZ8Km/TaBDSRtEVsKKU6K/76+OBcc
w6wbpcRCdnBTTHWR5GydbCKrs9boCNB2YyEgHGZBOuiwBoimK4PYdMsZ2bOl7hgQKzddt2MHo/lP
ETx4PI1Oza6PpC1pUW/kmKTv/JpDKNJe2uxE5a6gLfFDBmbiTlUnBjACxQi6we0TDEiSje4UA8Eo
K3fsilimuU5d379ByHN+fFNbrw1IZMKyNqVxfXqo9qc1nCfe74oWFGFlMDI+aVhsO1cyzMOzkJei
PI71nYybDNfA5X+tZ86t189bu/1db7jX79v/oNiDj7wEeuCXJoXceeLdI+uYzIJJuYRKHSA7mfTh
IHQW2rrySM6rj+JIZSZkJqzZqJKdzeGc9RVkPZfO5BI1s8d75eEcxV11L06PZsp6J3F7dWpPQz/m
XHo6CumIJo7vEHp36IkYSNlY3yaPo5FPtX5kfPkAQSH9rneQA/Ss7b+WjhR5F+uzQtplmr0P93F8
fuOjWeu9PT9cbnN9fHgFoaB28O2pqswW2b8oLB8QCZY6QE8chHMe9/L14TFHq2CIFWXiPCKBX5jx
Dsfe6q0NmWGIrfWyjKTW11s7uzaLXB/jwudOdEhgZSrvSTUytbR57f2BrGoEsMbORHOEl94Hasku
1wbLUveaga+UDWjEbKJFIBPsbyUOrIttR6sR5ENFp0BANo3NvlKFPoyMVZI15o+ERVDfq7dymloD
v9B4nOkibbWuXYHDrtosNK5Ev269TPVEz2A6AYrsdEu31pJ/wh8KlgXwCSOgnlIPZd4FMOJmgkf8
SaYWFpnVGJoQMPQ62UVJXhRGFav0gTSibO6TlfYZNdYmhBIf9cYyMd4nbgSzi+hb2M6CYkbeEZe1
mergNV72SdieHKOySb81sP6DlAWP9IXG+ET8t721V+d/t4fDHbr/09/bWsV/X6P0eu1jvRpiiXUL
qjzB0IpVFU1L42Y4tQvPGsUUYvHpsQG46PXwJ07fXF5c3Ryc33gfg1YvLLZ6UQ1YpnJgyhkF6dRh
OEgES/gls0zOqcH5xQ03qjCYMHOgubdN4Njkjm2as8wPuTy7nC0YuQJrzCmkhctpdSI/TgGveUVQ
D14BiFOKbi7HFzNAxq6YQmhgKImcpJXB9pFb6X7f3eCWbLW9F91N8gC2J56qqWMsgsHcqOLZ/8IN
EDhvzG88J9bCugLgUIvWqV3FMgbSYrmsWV7zgS2dwFJ0aOPzzNIJQtEz2UMDS8Wf/oR4ho9vy3uA
1ella0x2NGmKOHudcO4+ufiNcvY3TaoVC4AzIhZjvCkgSfQAUM4eysH/4M9sEgWTeg/aeW1QulMT
+RDpIrMil+gKy4ubaDxBNEqOozDEGhvqsjzCbZWuzric+wel6xzOKbC7Y72oK94oBHeZoXyEdThw
RXB8ecTQmYCKsUJU4wc+t2aulZtq3W6Xbgq857npqsCdvluo+nGzU/WlXu8eNzuW4g+AEFPIs+Wp
ZQrkhA/bQ8V3qVzB8mYqeSuFbXNRwCy5SsbWlyWMpK7ZxUz9g9EXxwndupE3Zc50W8slemYCToW8
2IXV20VV+rC4rnOVz3R2L2QQUDYmK2JiLt9Yw3pzrHIGEq8qeXGwA+XduVlkFE/A6jtGZRQGmgck
PkLVpyKEw1lDSwzBopHZsTZ5bV7VVYh3RI9wCih2aVYp3/YxWfDUwkQ3NDm/eAF2/igeN381pRfU
vZ39rig1rGyT/DXUnprMjxWnG4N1fX0i1jXn6GX8irFdKTRZkYifatAoWByMmfxEh0xWSr16x1Ff
Mp2fPzDD5rWoJiuelI+mlV2EWODEchtGxVataqFMdJJpzVzhz5IB3AndV3n+z1A4s1oarC81xifw
33BrZ9ic/+/tUf5/Z297hf++RlkTh3yL2N4SZlwHzx4LOtRewgRpFNwb2wx2hNR0Si4WXn3uUlrl
3//6p/0TlzapWp3Nm+bV7/kPS/gzIYP6SgFdazMAWVO1QXFo1r4BNyMm3ZFDlWgRtu4rtG6KA3cm
lP3hvu0LCsu5n/2JcdvBOmgc8+UFyvIt3rewKYcy8u5VYTJwajQqM1jAQM2Nh302yd8vEee0o0N5
w6VsomkfJNSpyMpVsLulC/4LycF9ateePmFge/mP8jSh6NqEZNcyDdCS9AwiB0plqnKZAqDa7fUN
8TeMRiNwL8ktMFtmnNv5xFwWBZNB33qD7v4wgnnylExqPsLJnkxVbhJUDIW0gQCtG1RshhDMLWow
Rm9ttbi9Omv/JCGEvOaR4Xsu6NtzZyqOnftEz5KezfeVd8LLNJDbWUo37lMCaXkvrloZs4+kTyHw
NnS7Pf1UJvWJ++VLidQ1ClDoTgwGtmEDqNmDIfv7ErezmAjd77yf9NxflKTmStB6eSeovg30O5Aq
TPUv9d1a2AkLv610vBKxktC/O8z+3poie8H18OLi9elxvdzy2ldAP3Spzlpah6mLRMU68fX2tPzx
jAX/Gx8c6uTaRzP/9fHfaJyLErl67R/LVJfRLJMfItkIRzsNLzDdi/OjSsL/g0z8U/Jjb0wtS9GZ
XQyCFbsi8pp0nlhP067eoSvR5S9+ygPY1tKXJe3pN0/K3CndVbZB4m8uYf+hXC78emG/vGGwcMd6
316x7tQ/Fdqvfim0gvursiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiq/svwfUE85lwBQ
AAA=
H4sIAAAAAAAAA+1b63LbOJbObz0FSk5N290mJfmaZspb7bW1Y28c2+tLzXRNdTEQCUlcUwSboKyo
U6mah5gnnCfZ7xzwJlkdz+520p0qISlLBIED4OBcvnMAhTp4UJkT6EmqjXLnk/jFb166KAd7ey+6
B93e4X6PP7vdHtej7Hf3dl/09nd6u93DncODnRfd3s7h4d4L0f3tp/K0TE0uMyFe7B/6f9Hxo/oS
Y/6ByoYYKxmaQMZKgBPBg3AcEcgwnIvNu4vbLfFdo8HmnYxi/soCI/NogNpA6yyMEpnrbKu10doQ
dzrVsR7NPXwXouojgjhSSW6E8292BG9vb5ceqgG8V91XXSZxqcVxMh1EBi8z5a0gYlIlH8TZ3d11
ZwdTSPJMxyLNdK4DHW+LROd4+fZiG8SMFlJc67+IYCzjWCUjJWZ6GodikBGNfKwmrjgrJ/GNEcfX
58JMs6EMlMAUZmOZg0w58jjKX4scXXMR5SKOHpSQyVxo0MlsV5U9RoFyeSVX56cnAtyIEiIVqliN
ZK5CkWuRku7lThQKkHp5fXXypn93fuqfXr09Pr90xY0aRSYHTVkNTnPNlBhGmcEcAp3OqaZ46YPQ
d+V3o4JMYYIJxnFV8ui2WomcgJMVs1utRx1PJ8p4LVHXOqHMZVmTxjKpa3jPlp7A+GE08lqtYs2m
ekVfhIgmcoRBbc3LDyfHp6c/+nfHf/acHUfGaZSoj9yONlDiKfPtLLkDv8kUKWjuiWkSK2Mck+s0
VSG/S3WWGzuQEI5ov+pCgtr1M+SLZKys2WjUdaZh2uY6FqFdEvswMhICHWKoPIrFCWvBf92fn4Ct
mXpUmVE+JOz9vKC3qmwIMC1QYx2H2LnBdES7Pozeg+rmX50bJWPn/BrLBd+xdZmejsafpKYmaQ7Z
SiDEE9JQiN3EbJFwOCqh2YoY4pS5TKSxoZYDbocXMYygWx2VBx3ma6My01XbxvZ26O/Si2KnO/aT
X0KsokwnE8hbOeRZ//j09uT4ol9IsSfaLz8sV34sN+T45G3f76PqgtvVj0WLUKUqCY2vk5J+bSoq
rmFCYZRHaFMqno9WcT6222S/B2MVPJR9coiUJ/7WPnl72t4W7dlI5fTp/Hzl0Oc4z1Ov04ETcrv4
1/N2ur3vi3V32j8VRKBZGE3GntjtmpJwNFF6Ctr7ZQ10MIuwI2K3qGBh9lOVRTr0RA9dW09WVShN
Vdup3zeZyWrUdXdeud3VSlSr+nOKBHmcyCS0HCybyxCMj+cebN3U1uWTdNiQrs6jzDrZNOksDrRC
Ci3z3LmcxFYO67U1XzWk0e3Ah0TB3B1P/9tgb5d6Lb5s9FsyZDzFOBosTfF5oajaFw9o/lm2Hjbp
tytM76w03OKff/+HmKmBuD8XQ53VrNm22wz/Ny+MHPxPR4aTKHHJgTm87Uwsl/GDIV9FbqYGAuTl
ZlE+hl99UEAKiRanDCRhpsinkf8VY23y0jNvuUyusdlkF0cKwsreEDOBssd67pqxGGZ6Ujit355B
lV9b0LXROMjcSHfyUt1sE6tu1xfHl4W6kbE1+a+rG3d7Vt1WaEjVeUlJuO7XlGTJRy8Iez2T/68V
/b0h6rp8xlJBgc84xjPx387uzn4d/1G7Xq+3d7CO/75E2RCVBCw6CRsN2hjmeJprJzJmCtAqxYXK
ESP1kyCbpzDwKsu558tlmIeoKCxxs0O4Gd4QxOBMxo1Yi+A3gigEOrCkBHQ5CHRXRHyZ+nkaIfrJ
xxHRUe9lkLOTIfMrNMZhYrcIdT5YfDoBDfHhZQNXtj7i5ZOZfhRFhyTQoRK/mDwUo1+itMW1TZda
uNM4eiRW1F7zWhrDPhJB8bgE9jD9iDgRboYFnc3KMFsPbBBAGhUP0ZCiBUsM4L6PtcyxzGQkVGw4
Bm2wrCC2HPPaEOAHpmGnYekVH51vLfLBpoCnRbMPlf1fiG8aTnIXCsqNPraa/T/VsQ7lG81KtwNv
OU1FHQl9ILTt0tbCX+JzonPl0qZ+XOi6IS50MnKI7yGwRWRUZwZZGE1lFlacKKKj19ieIYfKcH1D
OY3zJVIRrSCOJojeDSMbgA+dfJMDj6CbzhI8zhJ3odcwnpqxXyI/4fQW3uaZTAxFo4KWs7RsyyWg
6QIjCmC/yZMWsyzKVdVkuUXNjY8Lu8EcbYx3C8wZ5M5dOR/nVgVTUJ6L9kS+d4B1jnZ7+7sH2NXX
wLFBPA3V7XRwqqEqiWlXdP7qnICpUDvnbp4q5yolaGDoTTvRJomGw7rtjRqqLFOZc82gvDHrtrHT
0Vk0ihJnNlaJE2QaaMjW1DQwT+hD1lxbrEeNhYEpKfgCzcS3qhZ2ZyIZZBpdQHtS8d/bqH5FpYEs
P9sYz+V/d3d7pf/vHe7skv/fO1jnf79IaeZ/m9GZ4wibWmAAcN3IaeX6QcEUbN5fX/dv/NvL4zd9
GC9JwQ0sCkznlLJS7NFMoBEGbQmZKUrDTgcmj/IpxXtQWhvvceC8Ivwj6w1DS4gDRDkYRIhJRtoo
SsZS0pZzwyKEHwjyeF4EWmKup9+gOpsmCTnQenkwHCYKVeEYeHATZFGauzZ9Sa4pQ1BPJtx4nY7v
L+ME329ZpOIDM2We6HKCqGvT1hOK9wPjr2zxfff7bgvTHt1cnwjr5ZzSbSGYxtrK3COzgr3W6wr5
TI2dNUQ1CeHxQOhdta534uTiHEyq1lbFpVSZo5kr7hPK8FAC+TvgJjrpEdGQOAVKM4lqOyVh0QzN
M0uD1SvZ7+7t7ZYtZBzrGbyiIS+DEHgoAVdaLXbQFFumWfSIiNl/UHOfIIknniZkOtzaL5q6aNpq
pZminClHyI97lCzpugd7NH6nR3Dk8QBjhYfS6/X2A0/2VNfzOnuv8IZmFMgykAWqSPJIxsT60/7N
tcesrKAl4GcKaY0CfikmMgX2mgxUGGIjuMrKBTF+boQeDgEYiGWqAAyJspl8jQhb3J9ed3b3Dl8V
NOO524IOpLQGS8YrQCZvdMksISB0RSrAqWSvkA2bEcjL+brYxQ7RxEw7NbYhzhpP/I3yUxJQHQgr
JK5XIxUJvKJ6yGgrCeae2Nkbt1qUOxhIu2E5vD0Y93MMMELz5i92cr+6f+HArTqUOEbSax8uvJE9
nMnYp+lx2i3VwFK8sdALaocmMaAk9C9KhpTisL4d/dX7nPbv+ORC2LTfNrCBpC1iSyHF2fQ/b68u
Bccwm0YpsZAd3BYTPU1ytk42kdXaqHUEaLu2EBAOsyAddFgDRNOWQWzaxYzs2VJ7BIiVm7bbsoPR
/CcIHjyeRqti1yfSlrSot3JE0nd5yyEUaS9tdqJyV9CW+CEDMzFQ5YkBjMB0CN3g9gkGJMlGd4qB
YJSVO3JFLNNcp67v3yHkuezfVdZrCxKZsKxNaFyfHsr9aQzniadd0YIirAxGxicNi23nUoZ5eBby
QpRHsR7IuM5w9Vz+13jm3Hr1vHPQPfD2Drtd+weK3fvES6AHfmlSyJ0nPnxkHZNZMC6WUKoDZCeT
PhyEzkJbVxzJedVRHKnMmMyENRtlsrM+nLO+gqzn0plcomb2eK84nKO4q+rF6dFMWe8k7m/O7Wno
p5xLR0chHdHE8QChd4ueiIGUjfVt8jga+lTrR8aXjxAU0u9qBzlAz5r+a+lIkXexOiukXabZ+3Af
/cs7H80a7+354XKb2/7JDYSC2sG3p6o0W2T/orB4QCRY6AA9cRDOedzrNyd9jlbBECvKxHlEAr8w
4x2OvdV7GzLDEFvrZRlJrW939g9sFrk6xoXPHeuQwMpEPpBqZGpp85r7A1nVCGCNnYnmCC99CNSS
Xa4MlqXu1QPfKBvQiNlYi0Am2N9SHFgXm45WI8iHik6AgGwam32lCn0YGaskG8wfCYugflDv5SS1
Bn6h8SjT07TRunIFDrtqs9C4FP2q9TLVMz2D6QQostMt3FpD/gl/KFgWwCeMgHpKPRR5F8CIuzEe
8V8ytXCaWY2hCQFDb5JdlORFYVSxSh9II8rmPllpn1FjZUIo8VFtLBPjfeJGMLuIvoXtLChm5B1x
WZupDl7jVZeEbeUYpU36vYH1V1IWPNJnGuOZ+G+v1zss47/9XY7/droHu+v470uUTqd5rFdBLLFp
QZUnGFqxqqJpYdwMp3bhWaOYQiw+PTYAF51Oa4Hev4SnxObl1R1b7RJTCTMHOntPtKpYsE4H28xl
kfLZ4pnAJFnDTO5PinYuR1czgLu2mGB7YdJgsUCMLK/YJAfQ/qG9tU0t2b5637a3yVbbnngih5JQ
XhPUGVFzs3J9p/3/OL6/uBNH1vAKVWdrN2mqfDtHYIkYGO9hDO80zG7wwGnFbVF5iGlO5PKxtN4C
vFSWsQQDo9GYHEs2jQnXIVTLGjwosP+2TTzSoWS4xbTIC5KRdWkvDQXe4Bcd7D3Sqa+GOSWQzPN2
8Jc4h1jLMHohi5yYcgZEzl5pslMgUgSYc2IOyARjezWKbyDNKeI2cqgIPcVKPioGQ5Q1KLl2PKTl
HF/+KICJMHME9xGFI6XDkWkaz8FDjxo3jihLgeSowb4LQtEx2WONq8Wf/gTe8vlzcZGxPH5t3IGg
XCLNg8WHnbDYZK/DCMVYUauAA1+xsX6PAVgRLxcooXBbzPGRZ8aSm5HI2T2nMJLu7fDdHzo2eMp2
GdCmkFezQmjaXpHuBNVCLq2Pb9O1hCcwge4lDPRgoeqnbRD4uN2yU7uTIzsnI97e396xGlgd6NSC
T98Lobf+uyHwfGgPQjWowQvFMsEGoTlJIQeQO+uuiU+VvPMKS4VcXGTNO17iwpobS7HWAi3KjkdU
SjX0nmihK05qDePTIqtaeUMLXUuEKX6gEQjIYAx8C1TK14FMFvC0vsVcRDs0uX0Cp34qJtaYzI/P
6qfYtDsOaQqWREEPh1uN+YBoX0K9eKssyqRH8D3KGBqFiq/agWK5Ux6fIoEU4JDKIlq8jEtiEPda
U6C8lebxJr5brWnvtryy/zP8qScxUZMBjG6TXYszLHlXED5O5mT36iWWC4NgjCixUuvWJmVaTBEg
W1myEvcvT3NxG2vS9Zx+qhWn3Mfb2zNSCwKs7EmyaSLeVRhcTFPw05jxuy13QUns9lpiRIITD2zC
G9vnijZzug1HYi8FRYEYZHpG217Ab1YeDNCU/oV1WgoVR0W5XrF6YxrtLCfEkz1abMV2cmknE51k
WjNz+bNm3/rk5asrnFkvfMjnGuM5/L+zv1ff/zg8pPOf/cM1/v8iZQPOkm6R21viDP6GEbkluMgl
SJVGwYOxzWD4yB4AvUeUrpq7lFb75z/+bv+La5tUL+9mmPrVH/k/lvDvhHKrKyV0rdHAwk4QZsz4
rKn2lTNi0kBZx8W5kdIrNH4pgCAloewf921eUFnO/R2NjdtM1oBGny+vUJZ38b6NTTkVmZdOmSYB
dIuGRQbTuK36xssR46kflohz2tmhvPFSNtk0D5KqVHTf9vYYMdAPPBaSw0fUrjl9iqzs5U/K04Wi
bRPSbcs0IHPSM4gcKBWp6mUKboVYw2g4BPfgVhmfLzPObT0zl0XBZLy/WYP8r0Ywz1bJpB5aULEq
Vb1N8DEU0mImWjeo2AwxmEtYBsprUWVRLe5vLpo/SQkhr3lk+J4T+nbcmYpj5yEBhOnYfG/xm4Ai
Dei2ltLNR4xglvbippEx/UT6HAJv4/z78+cy6St+X7CUSIfAUliSSgxsT0hBzR4M2t8Xua3FRPhR
62nS+2hRkuorYZvFnbDqNtgfQKow1T9Xd6thJ2xKwkrH6yJAH2D2D9YU2QvOJ1dXb8771XKLa38B
/dCpPGtrHKYvErWZj/vz4sdTBL+N2frVoc5ufTTz3/R/pHHs7SK6T9/4sVR5GdEy+TGStXA0j2EE
pnt1eVpK+P/hJGaV/Ngbc8tSdGEXo0GOV0Rek86Tq2na1Tt0Jb74xVdxAN9Y+rKkrX6zUubO6a46
xT9fiUNdIZcLv145Km6YLNyxP7JX7FvVT8WOyl+KrYOLdVmXdVmXdVmXdVmXdVmXdVmXdVmXdVmX
dVmXdVmX/0X5H8de64YAUAAA
+36 -27
View File
@@ -1,39 +1,48 @@
// headscale ACL policy (HuJSON: JSON with // comments and trailing commas).
//
// IMPORTANT: headscale uses Tailscale's *legacy* policy format -- the top-level
// "acls" array -- NOT the "grants" syntax from the Tailscale admin console.
// It is also stricter than Tailscale in places; notably, a "tagOwner" must be
// a user (has "@"), a "group:*", or a "tag:*" -- NOT an autogroup.
// headscale uses Tailscale's legacy "acls" format (NOT the "grants" syntax
// from the Tailscale admin console) and is stricter: a "tagOwner" must be a
// user (has "@"), a "group:*", or a "tag:*" -- never an autogroup.
//
// Validate before relying on it:
// headscale policy check # uses the host CLI wrapper
// cd /srv/headscale && docker compose restart headscale # apply (mode=file)
// DEFAULT = allow everything (the first acl below). To lock down, comment out
// that one line and the tighter rules (your Tailscale default, translated)
// take over. ACLs are additive, so while allow-all is present it wins and the
// other rules are inert -- which is why they're safe to leave in place.
//
// The default below is permissive (allow-all), which is also headscale's
// behaviour with no policy. Tighten it using the commented examples.
// After ANY edit, validate before applying:
// headscale policy check
// cd /srv/headscale && docker compose restart headscale
{
// Static user groups. Members are OIDC identities (emails from pocket-id).
// "group:admins": ["alice@example.com", "bob@example.com"],
"groups": {},
// Admin users (OIDC emails from pocket-id). Required only if you enable the
// tag:shared owner below. Empty is fine while allow-all is active.
"groups": {
// "group:admins": ["alice@example.com", "bob@example.com"],
},
// Who may apply which tags to devices. Owners must be a user, "group:*", or
// "tag:*" (NOT an autogroup -- headscale rejects e.g. "autogroup:member").
// "tag:shared": ["group:admins"],
"tagOwners": {},
// Tag owners MUST be a user / "group:*" / "tag:*" (not an autogroup).
// Uncomment together with group:admins above when you lock down.
"tagOwners": {
// "tag:shared": ["group:admins"],
},
// Network access rules (first match wins; default-deny otherwise).
"acls": [
// Allow everything. Replace with tighter rules, e.g.:
// { "action": "accept", "src": ["group:admins"], "dst": ["*:*"] },
// { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] },
// ===== DEFAULT: allow everything. Comment out this line to lock down. =====
{ "action": "accept", "src": ["*"], "dst": ["*:*"] },
// ===== Your Tailscale default, translated (active once allow-all is off) =====
// Each user can reach their own devices (autogroup:self is experimental
// in headscale -- validate with `headscale policy check`):
// { "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:*"] },
// Anyone can reach devices tagged tag:shared (needs the tagOwner above):
// { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] },
],
// Tailscale SSH (optional; nodes must run `tailscale up --ssh`). Example:
// "ssh": [
// { "action": "accept",
// "src": ["group:admins"],
// "dst": ["tag:shared"],
// "users": ["autogroup:nonroot", "root"] },
// ],
// Tailscale SSH (nodes must run `tailscale up --ssh`). Uncomment to allow
// SSH into your own devices. "check" = periodic browser re-auth.
"ssh": [
// { "action": "check",
// "src": ["autogroup:member"],
// "dst": ["autogroup:self"],
// "users": ["autogroup:nonroot", "root"] },
],
}