tailscale-policy: preserve outbound for tagged client physicals via tag:physical #139

New issue

Closed

opened 2026-05-26 18:11:36 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-26 18:11:36 +00:00

Owner

Problem

The current tailnet policy grants outbound traffic via one rule:

{action: accept, src: [autogroup:member], dst: [*:*]}

Once tailscale_device_tags.physical assigns tags to a device, Tailscale reassigns its owner from coilysiren@ to the meta-user tagged-devices. Tagged devices fall out of autogroup:member, so they lose this universal outbound permit.

That's fine for kai-server, which is already tagged and only ever a destination (k3s NodePorts, forgejo, etc.). It's a regression for the three client physicals (kais-macbook-pro, kai-windows-laptop, kai-desktop-tower), which initiate connections constantly: SSH into kai-server, reach k3s services, etc.

Same gotcha applies to SSH: the existing SSH rule has src: [autogroup:member], so tagged clients would lose SSH-out too.

Change

terraform/tailscale-policy/main.tf adds two parallel rules:

ACL: new {action: accept, src: [tag:physical], dst: [*:*]} rule mirroring the autogroup:member outbound permit.
SSH: append tag:physical to the src list of the existing autogroup:member → tag:server SSH rule.

tag:physical is the cross-cutting bucket carried by every physical device, so this lights up the moment apply lands. Per-host tags remain available for future ACL granularity (e.g. "only kai-server reaches the database").

Filed by Claude.

**Problem** The current tailnet policy grants outbound traffic via one rule: ``` {action: accept, src: [autogroup:member], dst: [*:*]} ``` Once `tailscale_device_tags.physical` assigns tags to a device, Tailscale reassigns its owner from `coilysiren@` to the meta-user `tagged-devices`. Tagged devices fall out of `autogroup:member`, so they lose this universal outbound permit. That's fine for `kai-server`, which is already tagged and only ever a destination (k3s NodePorts, forgejo, etc.). It's a regression for the three *client* physicals (`kais-macbook-pro`, `kai-windows-laptop`, `kai-desktop-tower`), which initiate connections constantly: SSH into kai-server, reach k3s services, etc. Same gotcha applies to SSH: the existing SSH rule has `src: [autogroup:member]`, so tagged clients would lose SSH-out too. **Change** `terraform/tailscale-policy/main.tf` adds two parallel rules: 1. ACL: new `{action: accept, src: [tag:physical], dst: [*:*]}` rule mirroring the autogroup:member outbound permit. 2. SSH: append `tag:physical` to the `src` list of the existing autogroup:member → tag:server SSH rule. `tag:physical` is the cross-cutting bucket carried by every physical device, so this lights up the moment apply lands. Per-host tags remain available for future ACL granularity (e.g. "only kai-server reaches the database"). Filed by Claude.

coilysiren referenced this issue from a commit

2026-05-26 18:13:03 +00:00

feat: preserve outbound for tagged client physicals

coilysiren closed this issue

2026-05-26 18:13:03 +00:00

coilysiren referenced this issue

2026-05-26 19:38:14 +00:00

tailscale-policy: split SSH rule because autogroup:self is illegal with tag src #142