tailscale-policy: split SSH rule because autogroup:self is illegal with tag src #142

New issue

Closed

opened 2026-05-26 19:38:14 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-26 19:38:14 +00:00

Owner

Problem

terraform apply rejected with two cascading errors:

Error: Failed to update ACL
"tag:physical" is not allowed in src for autogroup:self (400)

Error: Failed to update device tags
requested tags [...] are invalid or not permitted (400)  (×4)

autogroup:self is the "this user's own devices" selector and is only legal when src is a user. Tagged devices have no user (their owner is the meta-user tagged-devices), so the rule

{src: [autogroup:member, tag:physical], dst: [autogroup:self, tag:server], ...}

added in coilysiren/infrastructure#139 is rejected by the API. The device-tag failures cascade from this: the rejected ACL means the new tag:physical / per-host tagOwners never landed, so the tailscale_device_tags API can't recognize them either.

Change

Split the combined SSH rule in terraform/tailscale-policy/main.tf back into two:

autogroup:member → [autogroup:self, tag:server] (unchanged from pre-IaC)
tag:physical → [tag:server] only (no autogroup:self - illegal for tag-src)

Tagged client physicals lose SSH-out to other client physicals' own-user devices but keep SSH-out to kai-server, which is the practical case.

Filed by Claude.

**Problem** `terraform apply` rejected with two cascading errors: ``` Error: Failed to update ACL "tag:physical" is not allowed in src for autogroup:self (400) Error: Failed to update device tags requested tags [...] are invalid or not permitted (400) (×4) ``` `autogroup:self` is the "this user's own devices" selector and is only legal when src is a user. Tagged devices have no user (their owner is the meta-user `tagged-devices`), so the rule ```hujson {src: [autogroup:member, tag:physical], dst: [autogroup:self, tag:server], ...} ``` added in coilysiren/infrastructure#139 is rejected by the API. The device-tag failures cascade from this: the rejected ACL means the new `tag:physical` / per-host `tagOwners` never landed, so the `tailscale_device_tags` API can't recognize them either. **Change** Split the combined SSH rule in `terraform/tailscale-policy/main.tf` back into two: - `autogroup:member` → `[autogroup:self, tag:server]` (unchanged from pre-IaC) - `tag:physical` → `[tag:server]` only (no autogroup:self - illegal for tag-src) Tagged client physicals lose SSH-out to *other* client physicals' own-user devices but keep SSH-out to kai-server, which is the practical case. Filed by Claude.

coilysiren referenced this issue from a commit

2026-05-26 19:47:20 +00:00

fix: split tailscale-policy SSH rule for tag-src compatibility

coilysiren closed this issue

2026-05-26 19:47:20 +00:00