Harald Hoyer
67b7c3a9fd
Introduces a headscale ACL policy (file-mode) plus matching client config:
- New systems/x86_64-linux/attic/headscale-policy.hujson:
* tag:llm restricts a node to talking only to halo:8000
* all other harald@ nodes have full mesh access to each other
* harald@ nodes can route internet traffic via approved exit nodes
* autoApprovers.exitNode = [tag:llm] auto-approves the exit route
advertised by any tag:llm node (currently mx)
- attic headscale.nix: wire policy.mode = "file" / policy.path to
the .hujson above.
- mx default.nix: enable useRoutingFeatures = "server" (needed for IP
forwarding) and add extraSetFlags = ["--advertise-exit-node"] so the
flag is reapplied on every activation, not just initial login.
Operational steps after deploy:
headscale nodes tag -i 10 -t tag:llm
28 lines
478 B
Text
28 lines
478 B
Text
{
|
|
"tagOwners": {
|
|
"tag:llm": ["harald@"],
|
|
},
|
|
"hosts": {
|
|
"halo": "100.64.0.3",
|
|
},
|
|
"autoApprovers": {
|
|
"exitNode": ["tag:llm"],
|
|
},
|
|
"acls": [
|
|
{
|
|
"action": "accept",
|
|
"src": ["tag:llm"],
|
|
"dst": ["halo:8000"],
|
|
},
|
|
{
|
|
"action": "accept",
|
|
"src": ["harald@"],
|
|
"dst": ["harald@:*"],
|
|
},
|
|
{
|
|
"action": "accept",
|
|
"src": ["harald@"],
|
|
"dst": ["autogroup:internet:*"],
|
|
},
|
|
],
|
|
}
|