policy.hujson

// This tailnet's ACLs are maintained in https://github.com/kingozone/unraid

// Example/default ACLs for unrestricted connections.
{
	// Declare static groups of users. Use autogroups for all users or users with a specific role.
	"groups": {
		"group:admin": ["taurence.salter@gmail.com", "wakandahomezone@gmail.com"],
	},

	// Define the tags which can be applied to devices and by which users.
	"tagOwners": {
		"tag:router":    ["autogroup:admin"],
		"tag:server":    ["autogroup:admin"],
		"tag:computer":  ["autogroup:admin"],
		"tag:mobile":    ["autogroup:admin"],
		"tag:media":     ["autogroup:admin"],
		"tag:ssh":       ["autogroup:admin"],
		"tag:connector": ["autogroup:admin"],
	},

	// Define access control lists for users, groups, autogroups, tags,
	// Tailscale IP addresses, and subnet ranges.
	"acls": [
		// Allow all connections.
		// Comment this section out if you want to define specific restrictions.
		{"action": "accept", "src": ["tag:ssh"], "dst": ["tag:ssh:*"]},
		{"action": "accept", "src": ["autogroup:admin"], "dst": ["tag:server:*"]},
		{"action": "accept", "src": ["autogroup:admin"], "dst": ["tag:router:*"]},
		{"action": "accept", "src": ["autogroup:admin"], "dst": ["*:*"]},
	],

	// Define users and devices that can use Tailscale SSH.
	"ssh": [
		// Allow all users to SSH into their own devices in check mode.
		// Comment this section out if you want to define specific restrictions.
		{
			"action": "accept",
			"src":    ["autogroup:admin"],
			"dst":    ["tag:ssh"],
			"users":  ["autogroup:admin", "root"],
		},
	],
	"nodeAttrs": [
		{
			// Funnel policy, which lets tailnet members control Funnel
			// for their own devices.
			// Learn more at https://tailscale.com/kb/1223/tailscale-funnel/
			"target": ["autogroup:member"],
			"attr":   ["funnel", "nextdns:no-device-info"],
		},
		{"target": ["100.125.111.25"], "attr": ["funnel"]},
		{"target": ["*"], "app": {"tailscale.com/app-connectors": [{
			"name":        "github",
			"connectors":  ["tag:computer", "tag:mobile", "tag:server"],
			"presetAppID": "github",
		}, {
			"name":        "google-workspace",
			"connectors":  ["tag:computer", "tag:mobile", "tag:server"],
			"presetAppID": "google-workspace",
		}, {
			"name":        "confluence",
			"connectors":  ["tag:computer", "tag:mobile", "tag:server"],
			"presetAppID": "confluence",
		   {
			"name":        "server",
			"connectors":  ["tag:computer", "tag:mobile", "tag:server", "tag:ssh"],
			"presetAppID": "servers",
		}
		}]}},
	],

	// Test access rules every time they're saved.
	// "tests": [
	//  	{
	//  		"src": "alice@example.com",
	//  		"accept": ["tag:example"],
	//  		"deny": ["100.101.102.103:443"],
	//  	},
	// ],
}