policy.hujson

// This tailnet's ACLs are maintained in https://github.com/dr460nf1r3/dr460nixed
{
	// Define access control lists for users, groups, autogroups, tags,
	// Tailscale IP addresses, and subnet ranges
	"acls": [
		// All tagged devices can access each other
		{
			"action": "accept",
			"src":    ["tag:dragons", "tag:others"],
			"dst":    ["tag:dragons:*", "tag:others:*"],
		},
		// All invited members can access devices tagged tag:others
		{
			"action": "accept",
			"src":    ["autogroup:shared"],
			"dst":    ["tag:others:*"],
		},
		// Admin and clients can use exit nodes
		{
			"action": "accept",
			"src":    ["dr460nf1r3@github", "autogroup:member"],
			"dst":    ["autogroup:internet:*"],
		},
		// The Tailscale admin can access everything
		{
			"action": "accept",
			"src":    ["dr460nf1r3@github"],
			"dst":    ["*:*"],
		},
		// Allow scraping metrics via node_exporter
		{
			"action": "accept",
			"src":    ["100.86.102.115"],
			"dst":    ["100.97.58.140:3021"],
		},
	],

	// Allow the usage of Tailscale SSH - enabling VSCode extension
	"ssh": [
		{
			"action": "accept",
			"src":    ["dr460nf1r3@github"],
			"dst":    ["dr460nf1r3@github", "tag:dragons", "tag:others", "tag:connector"],
			"users":  ["nico"],
		},
	],

	// Allow my personal devices to use Mullvad exit nodes
	"nodeAttrs": [{
		"target": ["dr460nf1r3@github", "tag:dragons"],
		"attr":   ["mullvad"],
	}, {"target": ["*"], "app": {"tailscale.com/app-connectors": [
		{
			"name":       "reddit",
			"connectors": ["tag:connector"],
			"domains":    ["reddit.com", "*.reddit.com"],
		},
		{
			"name":       "netflix",
			"connectors": ["tag:dragons"],
			"domains":    ["netflix.com", "*.netflix.com"],
		},
	]}}, {
		// Funnel policy, allowing the use this feature
		"target": ["autogroup:member", "tag:dragons", "tag:others"],
		"attr":   ["funnel"],
	}],

	// Auto approver for connector nodes
	"autoApprovers": {
		"routes": {
			"0.0.0.0/0": ["tag:connector"],
			"::/0":      ["tag:connector"],
		},
	},

	// Define tagOwners via autogroups
	"tagOwners": {
		// Tag for connector nodes
		"tag:connector": ["dr460nf1r3@github"],
		// Admins own devices with tag:dragons
		"tag:dragons": ["dr460nf1r3@github"],
		// Admins own devices with tag:others
		"tag:others": ["dr460nf1r3@github"],
	},
}