56 lines
1.3 KiB
Plaintext
56 lines
1.3 KiB
Plaintext
// NODE.DC tailnet policy: user devices retain self-access while the public
|
|
// Robot2B Device Edge VPS receives one purpose-bound egress grant.
|
|
{
|
|
"tagOwners": {
|
|
"tag:device-edge-vps": ["autogroup:admin"],
|
|
},
|
|
|
|
"hosts": {
|
|
"device-plane-backhaul": "100.109.216.21",
|
|
"nodedc-admin-macbook": "100.114.248.4",
|
|
"nodedc-device-edge": "100.64.19.31",
|
|
},
|
|
|
|
"grants": [
|
|
// Preserve unrestricted connectivity only between devices owned by the
|
|
// same authenticated tailnet member. Tagged service nodes are excluded.
|
|
{
|
|
"src": ["autogroup:member"],
|
|
"dst": ["autogroup:self"],
|
|
"ip": ["*"],
|
|
},
|
|
|
|
// The public VPS can reach exactly the private SSH forwarding target.
|
|
{
|
|
"src": ["tag:device-edge-vps"],
|
|
"dst": ["device-plane-backhaul"],
|
|
"ip": ["tcp:2222"],
|
|
},
|
|
],
|
|
|
|
// Preserve the existing Tailscale SSH policy for user-owned devices.
|
|
"ssh": [
|
|
{
|
|
"action": "check",
|
|
"src": ["autogroup:member"],
|
|
"dst": ["autogroup:self"],
|
|
"users": ["autogroup:nonroot", "root"],
|
|
},
|
|
],
|
|
|
|
// These assertions are evaluated by Tailscale before every policy save.
|
|
"tests": [
|
|
{
|
|
"src": "tag:device-edge-vps",
|
|
"proto": "tcp",
|
|
"accept": ["device-plane-backhaul:2222"],
|
|
"deny": [
|
|
"device-plane-backhaul:22",
|
|
"device-plane-backhaul:5001",
|
|
"nodedc-admin-macbook:22",
|
|
"nodedc-device-edge:22",
|
|
],
|
|
},
|
|
],
|
|
}
|