summaryrefslogtreecommitdiff
path: root/playbooks/roles/outbound/templates/headscale/config/acl.json
blob: 410de11d80645efd353c5d700662a5f91eb33f25 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "groups": {
    "group:vpn_admins": [
{% for user in vpn_admins %}
      "{{ user }}@{{ oauth_user_suffix }}"{{ ", " if not loop.last else "" }}
{% endfor %}
    ]
  },
  "acls": [
{% for user in vpn_users %}
    {
      "action": "accept",
      "src": ["{{ user }}@{{ oauth_user_suffix }}"],
      "dst": ["{{ user }}@{{ oauth_user_suffix }}:*"]
    },
{% endfor %}
    {
      "action": "accept",
      "src": ["{{ auth_key_user }}@"],
      "dst": ["{{ auth_key_user }}@:*", "{{ loadbalancer_ip }}/32:*"]
    },
{% for user, m in mesh.items() %}
    {
      "action": "accept",
      "src": ["{{ user }}@{{ oauth_user_suffix }}"],
      "dst": ["{{ m.gateway }}/32:*"]
    },
{% endfor %}
    {
      "action": "accept",
      "src": ["group:vpn_admins"],
      "dst": [{% for user, m in mesh.items() %} "{{ m.gateway }}/32:*", {% endfor %} "{{ loadbalancer_ip }}/32:*"]
    }
  ]
}