Tailscale ACL Policy for Just-in-Time Service Access

Tailscale's ACL policy is a declarative HuJSON document evaluated by the coordination server on every connection attempt; it replaces per-node firewall rules with identity-based allow rules. Each rule has an action (accept), a src list of users/groups/tags, and a dst list of hosts with optional port ranges. The tailnet's nodes are identified by their tailnet name, and the policy is enforced at the WireGuard layer: if no rule matches, the packet is dropped before it leaves the source node, because the source does not receive the destination's public key.

Use this to implement zero trust for developer and operator access: define groups by SSO identity (e.g., group:oncall-sre), tag production hosts with tag:prod, and write rules that grant tag:prod:22 only to group:oncall-sre. Because Tailscale integrates with your IdP, removing a user from the group revokes access within seconds, no SSH key rotation needed. You can also grant temporary access via Tailscale's just-in-time approval flows or short-lived auth keys generated by a CI system.

Security implications: the ACL file is the single source of truth, so commit it to Git with review. A wildcard src ("*") is almost always a mistake; scope to groups. Tag ownership matters: anyone who can authenticate a node with tag:prod inherits prod access, so restrict tag ownership in the tailnet policy and use OAuth clients with scoped tags for CI nodes. Performance is unaffected (the decision is metadata, not data path), but misconfigured DNS or MagicDNS names can make rules appear broken when the real issue is name resolution.

> System.Execute()

// tailnet policy (HuJSON) - apply via Tailscale admin console or Terraform
{
  "tagOwners": {
    "tag:prod": ["group:platform-admins"],
    "tag:db":   ["group:platform-admins"]
  },
  "groups": {
    "group:platform-admins": ["alice@corp.example", "bob@corp.example"],
    "group:oncall-sre":      ["carol@corp.example", "dave@corp.example"]
  },
  "acls": [
    {
      "action": "accept",
      "src":    ["group:oncall-sre"],
      "dst":    ["tag:prod:22", "tag:prod:443"]
    },
    {
      "action": "accept",
      "src":    ["tag:prod"],
      "dst":    ["tag:db:5432"]
    },
    {
      "action": "accept",
      "src":    ["group:platform-admins"],
      "dst":    ["tag:prod:*", "tag:db:*"]
    }
  ]
}

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-915C0B31939F