// Baseline tailnet policy, exported from Tailscale admin console 2026-11-01
// by Kyle. Unmodified default policy — allow-all ACL, funnel enabled for all
// members, default Tailscale SSH rule. Phase 2 of docs/security-plan.md
// replaces this; keep as the pre-segmentation baseline.
{
	"acls": [
		// Allow all connections.
		{"action": "accept", "src": ["*"], "dst": ["*:*"]},
	],

	// Default Tailscale SSH: every member may SSH to their own devices,
	// as nonroot or root.
	"ssh": [
		{
			"action": "accept",
			"src":    ["autogroup:members"],
			"dst":    ["autogroup:self"],
			"users":  ["autogroup:nonroot", "root"],
		},
	],
	"nodeAttrs": [
		{
			// Any tailnet member can open a public Funnel endpoint.
			"target": ["autogroup:members"],
			"attr":   ["funnel"],
		},
	],
}