tailscale-policy: scaffold terraform module + coily verb #136

New issue

Closed

opened 2026-05-26 17:53:55 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-26 17:53:55 +00:00

Owner

Problem

Bootstrap the new terraform/tailscale-policy/ module (scoped sub-task of coilysiren/infrastructure#134). Just the scaffolding - module files, runner script, coily verb. The actual terraform import + apply happens in a follow-up commit once Kai reviews the planned diff.

Change

terraform/tailscale-policy/main.tf - tailscale_acl.policy body (currently a verbatim transcription of the dumped state, so the post-import diff is additive only) + tailscale_device_tags.physical for_each over devices.yaml.
terraform/tailscale-policy/devices.yaml - four physical hosts, each with tag:server (preserved), tag:physical, per-host tag.
terraform/tailscale-policy/README.md - bootstrap sequence + tag model docs.
scripts/k8s/terraform_tailscale_policy.py - standard terraform_run wrapper plus an import-acl action that runs terraform import tailscale_acl.policy - to adopt current state on first run.
Makefile + .coily/coily.yaml - new terraform-tailscale-policy verb.

Reuses tailscale_admin_oauth_env() from scripts/_lib.py.

Next

coilysiren/infrastructure#134 itself stays open until terraform apply lands and the tag assignments are verified in the admin console.
Separate follow-up will extend terraform/tailscale-devices/ to mint keys with per-service + host tags.

Filed by Claude.

**Problem** Bootstrap the new `terraform/tailscale-policy/` module (scoped sub-task of coilysiren/infrastructure#134). Just the scaffolding - module files, runner script, coily verb. The actual `terraform import` + `apply` happens in a follow-up commit once Kai reviews the planned diff. **Change** - `terraform/tailscale-policy/main.tf` - `tailscale_acl.policy` body (currently a verbatim transcription of the dumped state, so the post-import diff is additive only) + `tailscale_device_tags.physical` for_each over `devices.yaml`. - `terraform/tailscale-policy/devices.yaml` - four physical hosts, each with `tag:server` (preserved), `tag:physical`, per-host tag. - `terraform/tailscale-policy/README.md` - bootstrap sequence + tag model docs. - `scripts/k8s/terraform_tailscale_policy.py` - standard `terraform_run` wrapper plus an `import-acl` action that runs `terraform import tailscale_acl.policy -` to adopt current state on first run. - `Makefile` + `.coily/coily.yaml` - new `terraform-tailscale-policy` verb. Reuses `tailscale_admin_oauth_env()` from `scripts/_lib.py`. **Next** - coilysiren/infrastructure#134 itself stays open until `terraform apply` lands and the tag assignments are verified in the admin console. - Separate follow-up will extend `terraform/tailscale-devices/` to mint keys with per-service + host tags. Filed by Claude.

coilysiren referenced this issue from a commit

2026-05-26 17:55:25 +00:00

feat: scaffold terraform/tailscale-policy module

coilysiren closed this issue

2026-05-26 17:55:25 +00:00

coilysiren referenced this issue

2026-06-18 02:52:56 +00:00

feat(ansible): full-auto Goose job to converge fleet agentic-os pre-commit pins #372