# Tailscale ACL Policy

## Overview

Tailscale connects all Kaburu infrastructure nodes in a mesh VPN. The ACL policy restricts what each node can reach, limiting blast radius if any node is compromised.

**Key concern:** kaburusvr is public-facing (22 WordPress sites). If compromised, it must not be able to pivot to LAN nodes.

## Tags

| Tag | Nodes | Purpose |
|-----|-------|---------|
| `tag:server-hetzner` | ubuntu-16gb-nbg1-1 (kaburusvr), **kabururd** (added 2026-08-05) | Public-facing servers — restricted egress |
| `tag:server-lan` | kaburuaibox, ubuntu-svr, truenas-scale, firewall | Trusted LAN nodes — can reach kaburusvr for monitoring |
| `tag:nas` | truenas-scale | NAS — receives backup rsync from kaburusvr |
| `tag:workstation` | kaburu-um790-main, kaburu-835, kaburu-430, kaburu-017 | Admin workstations — full mesh access |
| `tag:mobile` | pixel-9 | Phone — full mesh access |

## ACL Rules

```json
{
  "tagOwners": {
    "tag:server-hetzner": ["autogroup:owner"],
    "tag:server-lan":     ["autogroup:owner"],
    "tag:nas":            ["autogroup:owner"],
    "tag:workstation":    ["autogroup:owner"],
    "tag:mobile":         ["autogroup:owner"]
  },
  "hosts": {
    "kaburusvr":   "100.112.54.2",
    "kaburuaibox": "100.120.18.44",
    "truenas":     "100.74.178.14",
    "ubuntu-svr":  "100.101.7.86",
    "firewall":    "100.127.64.74"
  },
  "acls": [
    {"action": "accept", "src": ["tag:server-hetzner"], "dst": ["tag:nas:22"]},
    {"action": "accept", "src": ["tag:server-hetzner"], "dst": ["tag:server-lan:162"]},
    {"action": "accept", "src": ["tag:server-lan"],     "dst": ["tag:server-hetzner:22,161"]},
    {"action": "accept", "src": ["tag:server-lan"],     "dst": ["tag:server-lan:*"]},
    {"action": "accept", "src": ["tag:workstation"],    "dst": ["*:*"]},
    {"action": "accept", "src": ["tag:mobile"],         "dst": ["*:*"]},
    {"action": "accept", "src": ["autogroup:owner"],    "dst": ["*:*"]}
  ]
}
```

## What kaburusvr can reach (post-ACL)

| Destination | Port | Purpose |
|-------------|------|---------|
| truenas-scale (100.74.178.14) | TCP 22 | Daily rsync backup via `/root/backup.sh` |
| kaburuaibox (100.120.18.44) | UDP 162 | SNMP traps (`trap2sink` in snmpd.conf) |

**Cannot reach:** kaburuaibox SSH, ubuntu-svr, firewall, or any other LAN node.

## What can reach kaburusvr

| Source | Port | Purpose |
|--------|------|---------|
| kaburuaibox | TCP 22 | Hermes SSH (hetzner MCP, monitoring) |
| kaburuaibox | UDP 161 | Hermes SNMP poll |
| tag:workstation | any | Admin access |
| tag:mobile | any | Admin access |
| autogroup:owner | any | Owner fallback |

## API token

- Stored: `/root/.secrets/tailscale` on kaburusvr
- Expires: **2026-09-04** (90-day token issued 2026-06-06)
- Renew at: https://login.tailscale.com/admin/settings/keys

## Applied

- Policy pushed via API: 2026-06-06
- Tags assigned via API: 2026-06-06
- Verified: SSH kaburuaibox→kaburusvr ✅, backup path kaburusvr→truenas ✅