Model CRS310 Tailscale sidecar tags and subnet routes in Dhall ACL

[Jesssullivan]

Context

CRS310 has a RouterOS-hosted Tailscale sidecar. The crs repo currently tracks live drift in tinyland-inc/crs310-8g-2s-in issue #45, and the sidecar runtime work is being tracked in the MikroTik sidecar repo.

The tailnet ACL repo should own the policy-level decision about which tags, subnet routes, and capabilities the CRS310 sidecar is allowed to use.

Problem

The 2026-04-24 audit found drift between live sidecar behavior and repo intent:

• advertised route set was stale,
• route acceptance/import behavior did not match intended posture,
• auth material needs rotation after live RouterOS env readback exposed it to operators.

Without a Dhall-side contract, the sidecar can become an unreviewed route/import path instead of a controlled subnet-router component.

Proposed Work

• Model CRS310 sidecar identity/tags in Dhall.
• Define the allowed subnet route set for CRS310 sidecar advertisement.
• Define whether route approval should be automatic or manual.
• Explicitly model whether CRS310 may accept/import remote subnet routes; current crs intent is that it should not import them by default.
• Add generated policy/test coverage that makes CRS310 route/tag drift visible before deployment.
• Link this issue to the sidecar runtime issues and crs issue #45.

Acceptance

• Dhall policy has a named CRS310 sidecar entry or reusable typed fragment.
• Generated ACL output includes the intended tags/routes/grants for CRS310.
• Tests fail if CRS310 route advertisement or route-import posture drifts.
• crs issue #45 can reference this repo as the ACL source of truth.

[Jesssullivan]

Related sidecar/runtime and deployment issues:

• CRS deployment/live drift anchor: https://github.com/tinyland-inc/crs310-8g-2s-in/issues/45
• Sidecar ownership boundary: https://github.com/Jesssullivan/tiny-tailscale-mikrotik/issues/5
• Sidecar CRS310 route/flag contract: https://github.com/Jesssullivan/tiny-tailscale-mikrotik/issues/3
• Sidecar auth/log hardening: https://github.com/Jesssullivan/tiny-tailscale-mikrotik/issues/4
• Sidecar bastion operator flow: https://github.com/Jesssullivan/tiny-tailscale-mikrotik/issues/2

This ACL issue should stay focused on Dhall policy: tags, route authorization, route-import posture, and generated-policy tests. CRS repo remains the deployment/live-readback source of truth.

[Jesssullivan]

Correction to the sidecar tracker map:

tinyland-inc/tiny-tailscale-mikrotik is now issue-enabled and should be treated as the sidecar authority candidate. GitHub would not transfer the temporary Jesssullivan/tiny-tailscale-mikrotik issues across owners, so they were recreated in the org repo and the temporary Jess issues were closed as superseded.

Current related issues:

• CRS deployment/live drift anchor: https://github.com/tinyland-inc/crs310-8g-2s-in/issues/45
• Sidecar ownership boundary: https://github.com/tinyland-inc/tiny-tailscale-mikrotik/issues/9
• Sidecar CRS310 route/flag contract: https://github.com/tinyland-inc/tiny-tailscale-mikrotik/issues/10
• Sidecar auth/log hardening: https://github.com/tinyland-inc/tiny-tailscale-mikrotik/issues/7
• Sidecar bastion operator flow: https://github.com/tinyland-inc/tiny-tailscale-mikrotik/issues/8
• Sidecar README authority PR: https://github.com/tinyland-inc/tiny-tailscale-mikrotik/pull/12

This ACL issue should stay focused on Dhall policy: tags, route authorization, route-import posture, and generated-policy tests. CRS repo remains the deployment/live-readback source of truth.