// MeeSumee Grants/ACLs for tailnet
// There no personal info here so its placed in Greenery Repo
// Maybe don't hard-code your ACLs based on user lmao

{
  // Declare static groups of users. Use autogroups for all users or users with a specific role.
  // "groups": {
  //   "group:example": ["alice@example.com", "bob@example.com"],
  // },

  // Define the tags which can be applied to devices and by which users.
  // "tagOwners": {
  //   "tag:example": ["autogroup:admin"],
  // },

  // Define grants that govern access for users, groups, autogroups, tags,
  // Tailscale IP addresses, and subnet ranges.
  "grants": [
    // Allow access to oneself
    {
      "src": ["autogroup:member"],
      "dst": ["autogroup:self"],
      "ip":  ["*"],
    },
    // Exit node access
    {
      "src": ["autogroup:member"],
      "dst": ["autogroup:internet"],
      "ip":  ["*"],
    },
    // Owner & Tagged has access to SSH & DNS
    {
      "src": ["autogroup:owner", "autogroup:tagged"],
      "dst": ["*"],
      "ip":  ["tcp:22", "udp:53"],
    },
    // Access to exposed services via http/https
    {
      "src": ["autogroup:member"],
      "dst": ["*"],
      "ip":  ["tcp:80", "tcp:443"],
    },
    // Allow sharing of MC server to friends
    {
      "src": ["*"],
      "dst": ["*"],
      "ip":  ["tcp:25565"],
    },
    // Sunshine Ports
    {
      "src": ["autogroup:member"],
      "dst": ["autogroup:member"],

      "ip": [
        "tcp:47984",
        "tcp:47989",
        "tcp:47990",
        "tcp:48010",
        "udp:47998",
        "udp:47999",
        "udp:48000",
        "udp:48002",
        "udp:48010",
      ],
    },
    // UPS-daemon
    {
      "src": ["autogroup:member"],
      "dst": ["autogroup:member"],
      "ip": ["tcp:3493"],
    },
  ],

  // Define users and devices that can use Tailscale SSH.
  "ssh": [
    // Allow all users to SSH into their own devices in check mode.
    // Comment this section out if you want to define specific restrictions.
    {
      "action": "check",
      "src":    ["autogroup:member"],
      "dst":    ["autogroup:self"],
      "users":  ["autogroup:nonroot", "root"],
    },
  ],

  "tagOwners": {
    // Deployments of self-hosted services
    "tag:Services": ["autogroup:owner"],

    // Exit Node Tag
    "tag:Exit-Node": ["autogroup:owner"],
  },

  // Test access rules every time they're saved.
  // "tests": [
  //   {
  //     "src": "alice@example.com",
  //     "accept": ["tag:example"],
  //     "deny": ["100.101.102.103:443"],
  //   },
  // ],
}