kyle
01018fcbda
Phase 0 findings: password auth confirmed on (straylight, dixie), ACL default allow-all, funnel-for-all, titan stale public funnel, gitea public edge on nginx 1.18.0. Plan: 6 pillars, 6 phases, decisions and assumptions register inline.
29 lines
792 B
Plaintext
29 lines
792 B
Plaintext
// Baseline tailnet policy, exported from Tailscale admin console 2026-11-01
|
|
// by Kyle. Unmodified default policy — allow-all ACL, funnel enabled for all
|
|
// members, default Tailscale SSH rule. Phase 2 of docs/security-plan.md
|
|
// replaces this; keep as the pre-segmentation baseline.
|
|
{
|
|
"acls": [
|
|
// Allow all connections.
|
|
{"action": "accept", "src": ["*"], "dst": ["*:*"]},
|
|
],
|
|
|
|
// Default Tailscale SSH: every member may SSH to their own devices,
|
|
// as nonroot or root.
|
|
"ssh": [
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:members"],
|
|
"dst": ["autogroup:self"],
|
|
"users": ["autogroup:nonroot", "root"],
|
|
},
|
|
],
|
|
"nodeAttrs": [
|
|
{
|
|
// Any tailnet member can open a public Funnel endpoint.
|
|
"target": ["autogroup:members"],
|
|
"attr": ["funnel"],
|
|
},
|
|
],
|
|
}
|