# Tailscale ACL Policy

## Overview

Tailscale connects all Kaburu infrastructure nodes in a mesh VPN. The ACL policy restricts what each node can reach, limiting blast radius if any node is compromised.

Key concern: kaburusvr is public-facing (22 WordPress sites). If compromised, it must not be able to pivot to LAN nodes.

## Tags

Tag Nodes Purpose
—–——-———
`tag:server-hetzner` ubuntu-16gb-nbg1-1 (kaburusvr), kabururd (added 2026-08-05) Public-facing servers — restricted egress
`tag:server-lan` kaburuaibox, ubuntu-svr, truenas-scale, firewall Trusted LAN nodes — can reach kaburusvr for monitoring
`tag:nas` truenas-scale NAS — receives backup rsync from kaburusvr
`tag:workstation` kaburu-um790-main, kaburu-835, kaburu-430, kaburu-017 Admin workstations — full mesh access
`tag:mobile` pixel-9 Phone — full mesh access

## ACL Rules

```json { 

"tagOwners": {
  "tag:server-hetzner": ["autogroup:owner"],
  "tag:server-lan":     ["autogroup:owner"],
  "tag:nas":            ["autogroup:owner"],
  "tag:workstation":    ["autogroup:owner"],
  "tag:mobile":         ["autogroup:owner"]
},
"hosts": {
  "kaburusvr":   "100.112.54.2",
  "kaburuaibox": "100.120.18.44",
  "truenas":     "100.74.178.14",
  "ubuntu-svr":  "100.101.7.86",
  "firewall":    "100.127.64.74"
},
"acls": [
  {"action": "accept", "src": ["tag:server-hetzner"], "dst": ["tag:nas:22"]},
  {"action": "accept", "src": ["tag:server-hetzner"], "dst": ["tag:server-lan:162"]},
  {"action": "accept", "src": ["tag:server-lan"],     "dst": ["tag:server-hetzner:22,161"]},
  {"action": "accept", "src": ["tag:server-lan"],     "dst": ["tag:server-lan:*"]},
  {"action": "accept", "src": ["tag:workstation"],    "dst": ["*:*"]},
  {"action": "accept", "src": ["tag:mobile"],         "dst": ["*:*"]},
  {"action": "accept", "src": ["autogroup:owner"],    "dst": ["*:*"]}
]

} ```

## What kaburusvr can reach (post-ACL)

Destination Port Purpose
————-—————
truenas-scale (100.74.178.14) TCP 22 Daily rsync backup via `/root/backup.sh`
kaburuaibox (100.120.18.44) UDP 162 SNMP traps (`trap2sink` in snmpd.conf)

Cannot reach: kaburuaibox SSH, ubuntu-svr, firewall, or any other LAN node.

## What can reach kaburusvr

Source Port Purpose
——–—————
kaburuaibox TCP 22 Hermes SSH (hetzner MCP, monitoring)
kaburuaibox UDP 161 Hermes SNMP poll
tag:workstation any Admin access
tag:mobile any Admin access
autogroup:owner any Owner fallback

## API token

- Stored: `/root/.secrets/tailscale` on kaburusvr - Expires: 2026-09-04 (90-day token issued 2026-06-06) - Renew at: https://login.tailscale.com/admin/settings/keys

## Applied

- Policy pushed via API: 2026-06-06 - Tags assigned via API: 2026-06-06 - Verified: SSH kaburuaibox→kaburusvr ✅, backup path kaburusvr→truenas ✅