policy.hujson

// This tailnet's ACLs are maintained in https://github.com/cetacean/tailscale-acls, do not edit in the admin panel

{
  "groups": {
    "group:admins": [ "xe@github", "victorvalenca@github" ],
    "group:low-trust": [ "twi@github" ],
    "group:within": [ "xe@github", "victorvalenca@github", "heartmender@github" ],
  },
  "hosts": {
    "vm-subnet": "10.77.0.0/17",
  },
  "tagOwners": {
    "tag:nixos": [ "group:admins" ],
    "tag:hypervisor": [ "group:admins" ],
    "tag:hetzner": [ "group:admins" ],
    "tag:ci": [ "group:admins" ],
    "tag:alpine": [ "group:admins" ],
    "tag:vm": [ "group:admins" ],    
    "tag:alrest": [ "group:admins" ],
    "tag:sensitive": [ "group:admins" ],
    "tag:games": [ "group:admins" ],
    "tag:xe": [ "xe@github" ],
    "tag:service": [ "group:admins" ],
    "tag:test": [ "xe@github" ],
  },
  // Access control lists.
  "acls": [
    // { "action": "accept", "src": ["*"], "dst": ["vm-subnet:*"] },
    { "action": "accept", "src": ["*"], "dst": ["autogroup:self:*"] },
    { "action": "accept", "src": ["group:admins"], "dst": ["*:*"] },
    { "action": "accept", "src": ["*"], "dst": ["*:*"] },
  ],
  "ssh": [
    {
      "action": "accept",
      "src": ["tag:alrest", "tag:nixos"],
      "dst": ["tag:alrest"],
      "users": ["root", "autogroup:nonroot"],
    },
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["tag:games"],
      "users": ["autogroup:nonroot", "root"]
    },
    {
      "action": "accept",
      "src": ["group:admins", "tag:alrest"],
      "dst": ["tag:ci"],
      "users": ["autogroup:nonroot", "root"]
    },
    {
      "action": "accept",
      "src": ["tag:ci"],
      "dst": ["tag:ci"],
      "users": ["autogroup:nonroot", "root"]
    },
    {
      "action": "accept",
      "src": ["xe@github", "tag:alrest"],
      "dst": ["tag:xe"],
      "users": ["autogroup:nonroot", "root"]
    },
    {
      "action": "accept",
      "src": ["group:admins", "tag:alrest"],
      "dst": ["tag:vm"],
      "users": ["autogroup:nonroot", "root"]
    },
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["tag:alrest"],
      "users": ["autogroup:nonroot"]
    },
    {
      "action": "check",
      "src": ["group:admins"],
      "dst": ["tag:alrest"],
      "users": ["root"],
    },
  ],
  "nodeAttrs": [
    {
      "target": ["group:admins"],
      "attr": ["funnel"],
    },
    {
      "target": ["tag:service"],
      "attr": ["funnel"],
    },
    {
      "target": ["tag:alrest"],
      "attr": ["funnel"],
    }
  ],
}