// NODE.DC tailnet policy: user devices retain self-access while the public
// Robot2B Device Edge VPS receives one purpose-bound egress grant.
{
	"tagOwners": {
		"tag:device-edge-vps": ["autogroup:admin"],
	},

	"hosts": {
		"device-plane-backhaul": "100.109.216.21",
		"nodedc-admin-macbook":  "100.114.248.4",
		"nodedc-device-edge":    "100.64.19.31",
	},

	"grants": [
		// Preserve unrestricted connectivity only between devices owned by the
		// same authenticated tailnet member. Tagged service nodes are excluded.
		{
			"src": ["autogroup:member"],
			"dst": ["autogroup:self"],
			"ip":  ["*"],
		},

		// The public VPS can reach exactly the private SSH forwarding target.
		{
			"src": ["tag:device-edge-vps"],
			"dst": ["device-plane-backhaul"],
			"ip":  ["tcp:2222"],
		},
	],

	// Preserve the existing Tailscale SSH policy for user-owned devices.
	"ssh": [
		{
			"action": "check",
			"src":    ["autogroup:member"],
			"dst":    ["autogroup:self"],
			"users":  ["autogroup:nonroot", "root"],
		},
	],

	// These assertions are evaluated by Tailscale before every policy save.
	"tests": [
		{
			"src":    "tag:device-edge-vps",
			"proto":  "tcp",
			"accept": ["device-plane-backhaul:2222"],
			"deny": [
				"device-plane-backhaul:22",
				"device-plane-backhaul:5001",
				"nodedc-admin-macbook:22",
				"nodedc-device-edge:22",
			],
		},
	],
}