Permit tagged client physicals to SSH into user-owned devices #150

New issue

Closed

opened 2026-05-27 00:24:41 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-27 00:24:41 +00:00

Owner

Problem

Kai SSHing from her Mac to kai-desktop-tower-wsl fails:

tailnet policy does not permit you to SSH to this node

Root cause: the Mac is tagged tag:physical, which drops it out of autogroup:member. The existing ssh rule src=autogroup:member, dst=autogroup:self therefore never matches when the Mac is the source. The tag:physical→tag:server rule covers Mac→kai-server but not Mac→any-other-user-owned-device. WSL itself is fine: untagged, owned by coilysiren@gmail.com.

Fix

Add one ssh rule to terraform/tailscale/main.tf:

{
  action = "accept"
  src    = ["tag:physical"]
  dst    = ["autogroup:member"]
  users  = ["autogroup:nonroot", "root"]
},

Tagged client physicals (Mac, tower, laptop) can then SSH into any user-owned device on the tailnet. Safe scope: autogroup:member is all human-account-owned devices, and Kai is the only user account on the tailnet.

Out of scope

The longer-term 2FA gate (TOTP via PAM, then YubiKey FIDO2) tracked by the prior SSH-jump session. That bootstrap depends on getting into WSL first, which is what this fix unblocks.

**Problem** Kai SSHing from her Mac to `kai-desktop-tower-wsl` fails: ``` tailnet policy does not permit you to SSH to this node ``` Root cause: the Mac is tagged `tag:physical`, which drops it out of `autogroup:member`. The existing ssh rule `src=autogroup:member, dst=autogroup:self` therefore never matches when the Mac is the source. The `tag:physical→tag:server` rule covers Mac→kai-server but not Mac→any-other-user-owned-device. WSL itself is fine: untagged, owned by `coilysiren@gmail.com`. **Fix** Add one ssh rule to `terraform/tailscale/main.tf`: ```hcl { action = "accept" src = ["tag:physical"] dst = ["autogroup:member"] users = ["autogroup:nonroot", "root"] }, ``` Tagged client physicals (Mac, tower, laptop) can then SSH into any user-owned device on the tailnet. Safe scope: `autogroup:member` is all human-account-owned devices, and Kai is the only user account on the tailnet. **Out of scope** The longer-term 2FA gate (TOTP via PAM, then YubiKey FIDO2) tracked by the prior SSH-jump session. That bootstrap depends on getting into WSL first, which is what this fix unblocks.

coilysiren referenced this issue from a commit

2026-05-27 00:25:22 +00:00

feat: permit tagged client physicals to SSH into user-owned devices

coilysiren closed this issue

2026-05-27 00:25:22 +00:00

coilysiren referenced this issue from a commit

2026-05-27 00:27:37 +00:00

fix: tag WSL as tag:physical and permit ssh between tagged physicals

coilysiren referenced this issue

2026-06-04 06:40:49 +00:00

Forgejo PR merge intermittently 500s on a broken sparse-checkout merge workdir #202