Update Tailscale ACL; Terraform fmt

pedorich-n · pedorich-n · commit 8bac3179f70e · 2025-09-15T11:13:55.000+09:00
diff --git a/terraform/tailscale/acl.tf b/terraform/tailscale/acl.tf
@@ -4,20 +4,30 @@ resource "tailscale_acl" "acl" {
       "tagOwners": {
         "${local.tags.server}": [], // Not used for any ACL yet
         "${local.tags.initrd}": [],
-        "${local.tags.ssh}": []
+        "${local.tags.ssh}": [],
+        "${local.tags.router}": [],
+        "${local.tags.subnet}": []
       },
-      "acls": [
+      "grants": [
         {
           // Allow all members to connect to any node
-          "action": "accept", 
-          "src": [ 
-            "autogroup:member"
-          ], 
-          "dst": [
-            "*:*"
-          ] 
+          "src": [ "autogroup:member" ], 
+          "dst": [ "*" ],
+          "ip": [ "*" ]
         }, 
+        {
+          // Allow routers to connect to any node
+          "src": [ "${local.tags.router}" ], 
+          "dst": [ "*" ],
+          "ip": [ "*" ]
+        }
       ],
+      "autoApprovers": {
+        "exitNode": [ "tag:router" ],
+        "routes": {
+          "192.168.0.0/16": [ "tag:subnet" ]
+        }
+      },
       "ssh": [
         {
           "action": "accept", 
@@ -50,7 +60,17 @@ resource "tailscale_acl" "acl" {
             "${local.tags.initrd}:2222", 
             "100.113.5.10:80"
           ] 
-        }
+        },
+        {
+          // A router also should be able to access any node
+          "src": "${local.tags.router}", 
+          "allow": [
+            "${local.tags.initrd}:2222", 
+            "${local.tags.ssh}:22",
+            "${local.tags.router}:443",
+            "100.113.5.10:80"
+          ]
+        },
       ],
       "sshTests": [
         {
diff --git a/terraform/tailscale/backend.tf b/terraform/tailscale/backend.tf
@@ -2,4 +2,4 @@ terraform {
   backend "s3" {
     key = "homelab/tailscale/terraform.tfstate"
   }
-}
+}
diff --git a/terraform/tailscale/data.tf b/terraform/tailscale/data.tf
@@ -1,3 +1,3 @@
 data "tailscale_device" "server" {
   hostname = var.server_hostname
-}
+}
diff --git a/terraform/tailscale/keys.tf b/terraform/tailscale/keys.tf
@@ -53,4 +53,4 @@ resource "onepassword_item" "tailscale_oauth_clients" {
       }
     }
   }
-}
+}
diff --git a/terraform/tailscale/locals.tf b/terraform/tailscale/locals.tf
@@ -1,7 +1,9 @@
 locals {
   tags = {
     ssh    = "tag:ssh",
+    initrd = "tag:initramfs",
     server = "tag:server",
-    initrd = "tag:initramfs"
+    router = "tag:router",
+    subnet = "tag:subnet"
   }
-}
+}

Original file line number	Diff line number	Diff line change
`@@ -2,4 +2,4 @@ terraform {`
`2`	`2`	`backend "s3" {`
`3`	`3`	`key = "homelab/tailscale/terraform.tfstate"`
`4`	`4`	`}`
`5`		`-}`
	`5`	`+}`
-Original file line number
+Diff line change
@@ @@ -1,3 +1,3 @@ @@
 data "tailscale_device" "server" {
   hostname = var.server_hostname
 -}
 +}
Original file line number	Diff line number	Diff line change
`@@ -53,4 +53,4 @@ resource "onepassword_item" "tailscale_oauth_clients" {`
`53`	`53`	`}`
`54`	`54`	`}`
`55`	`55`	`}`
`56`		`-}`
	`56`	`+}`