Tailscale Host-based ACLs

tailscale.json

{
	// Declare static groups of users beyond those in the identity service.
	"groups": {
		"group:admins": ["myadmin@site"],
	},
	// Declare convenient hostname aliases to use in place of IP addresses.
	"hosts": {
		"rproxy_ext":         "100.100.99.68",
		"apps_int":           "100.100.99.69",
		"supabase":           "100.100.99.70",
		"media":              "100.100.99.71",
	},
	// Define tags and who owns them, restricting access to tag:admin to network owner.
	/*
		home = general home machines
		app = internal infrastructure
		pub = external infrastructure
		fam = family systems
		admin = administrative systems
	*/
	"tagOwners": {
		
		"tag:home": ["group:admins"],
		"tag:app":  ["group:admins"],
		"tag:pub":  ["group:admins"],
		"tag:fam":  ["group:admins"],
		"tag:admin":  ["myadmin@site"],
	},
	// Access control lists.
	"acls": [
		// tag:admin (owner devices) can talk to all devices/ports.
		{
			"action": "accept",
			"src":    ["tag:admin"],
			"dst":    ["*:*"],
		},
		// tag:home can access tag:home and internal infra on any port.
		{
			"action": "accept",
			"src":    ["tag:home"],
			"dst":    [
				"tag:home:*",
				"tag:app:*",
			],
		},
		// external reverse proxy can access tag:app on specific ports
		{
			"action": "accept",
			"src":    ["rproxy_ext"],
			"dst": [
				"tag:app:*",
			],
		},
		// allow apps (server) to reverse proxy nginx proxy manager (LOL)
		{
			"action": "accept",
			"src":    ["apps_int"],
			"dst":    ["rproxy_ext:81"],
		},
		// Restrict fam device access to specific device:port.
		{
			"action": "accept",
			"src":    ["tag:fam"],
			"dst": [
				"media:32400", // plex
				"media:8096",  // jellyfin
			],
		},
	],
}

My use of use-case for Tailscale is a single authenticated user and multiple systems of specific purpose. While I want my laptop/desktop (tag:admin) devices to be able to connect to everything, I do want to restrict what other devices can see and connect to.

I run a bit of infrastructure internally, some of that is reverse proxied by rproxy_ext, but the apps_int server also hosts a reverse proxy, so there are two rules to define their communication.

In the future I plan on adding family systems into the mix, and I don't want them communicating with each other or any unauthorized system on the rest of the network; I also don't want to be concerned about family such as grandparents having/maintaining access to say a Google account to auth Tailscale as I'll be setting it and forgetting it, so tagging family devices with tag:fam will allow me to continue using a single authenticated user.