From 89effe34e8449f4894900e0edd32146b118b184b Mon Sep 17 00:00:00 2001 From: Jess Sullivan Date: Mon, 27 Jul 2026 17:48:47 -0400 Subject: [PATCH 1/3] feat(acl): add tag:tag-authority as reconciler owner tag (TIN-2639) The TIN-2639 scoped OAuth client failed its Phase-4 bounded write (HTTP 400: cannot write tag:dollhouse) because no policy-defined tag owns the tags the lab reconciler manages. Per the rotation runbook's tag-authority gate, define tag:tag-authority (admin-owned) and grant it ownership of the exact 14-tag union the reconciler can write after the 2026-07-27 inventory-to-live trim: dollhouse, dev, k8s, k8s-operator, qa, rj-gateway, services, setec, staging, tsidp, subnet-router, switch, tinyland-lab-moonlight, tinyland-lab-sunshine. Ceremony follow-up (operator): re-mint the OAuth client with tag:tag-authority (client tags are fixed at creation), re-run Phase-3 proof, one idempotent bumble write ([dollhouse] -> [dollhouse]) with audit-log verification, then Phase-5 revoke of the legacy tskey-api-* before 2026-07-31. --- constants.dhall | 1 + fragments/core.dhall | 31 +++++++++++++++++-------------- 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/constants.dhall b/constants.dhall index d6e9ade..da63c61 100644 --- a/constants.dhall +++ b/constants.dhall @@ -46,6 +46,7 @@ let tag = , setec = "tag:setec" , ci_agent = "tag:ci-agent" , kvm_proxy = "tag:kvm-proxy" + , tag_authority = "tag:tag-authority" } let host = diff --git a/fragments/core.dhall b/fragments/core.dhall index 744fe36..4dc12c1 100644 --- a/fragments/core.dhall +++ b/fragments/core.dhall @@ -20,52 +20,52 @@ let groups let tagOwners : List T.TagOwner = [ { mapKey = C.tag.dollhouse - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.services - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.k8s , mapValue = - [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] + [ C.tag.tag_authority, C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.k8s_operator , mapValue = - [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] + [ C.tag.tag_authority, C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.mcp_proxy , mapValue = [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tsidp - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.dev - , mapValue = [ C.autogroup.admin, C.group.developers ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] } , { mapKey = C.tag.staging - , mapValue = [ C.autogroup.admin, C.group.developers ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] } , { mapKey = C.tag.qa - , mapValue = [ C.autogroup.admin, C.group.developers ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] } , { mapKey = C.tag.exit_node , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.switch - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.subnet_router - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_common , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_sunshine - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_moonlight - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_crush , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] @@ -83,10 +83,10 @@ let tagOwners , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.rj_gateway - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.setec - , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.ci_agent , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] @@ -94,6 +94,9 @@ let tagOwners , { mapKey = C.tag.kvm_proxy , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] } + , { mapKey = C.tag.tag_authority + , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] + } ] let acls From 874fa8d6a329e0a1f6312817cdf62a438c61be84 Mon Sep 17 00:00:00 2001 From: Jess Sullivan Date: Mon, 27 Jul 2026 18:11:46 -0400 Subject: [PATCH 2/3] style: dhall format pass --- fragments/core.dhall | 48 ++- generated/policy.json | 900 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 934 insertions(+), 14 deletions(-) create mode 100644 generated/policy.json diff --git a/fragments/core.dhall b/fragments/core.dhall index 4dc12c1..7c4ee06 100644 --- a/fragments/core.dhall +++ b/fragments/core.dhall @@ -20,52 +20,70 @@ let groups let tagOwners : List T.TagOwner = [ { mapKey = C.tag.dollhouse - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.services - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.k8s , mapValue = - [ C.tag.tag_authority, C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] + [ C.tag.tag_authority + , C.tag.k8s_operator + , C.autogroup.admin + , C.group.dollhouse_admins + ] } , { mapKey = C.tag.k8s_operator , mapValue = - [ C.tag.tag_authority, C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] + [ C.tag.tag_authority + , C.tag.k8s_operator + , C.autogroup.admin + , C.group.dollhouse_admins + ] } , { mapKey = C.tag.mcp_proxy , mapValue = [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tsidp - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.dev - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] } , { mapKey = C.tag.staging - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] } , { mapKey = C.tag.qa - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ] } , { mapKey = C.tag.exit_node , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.switch - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.subnet_router - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_common , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_sunshine - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_moonlight - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.tinyland_lab_crush , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] @@ -83,10 +101,12 @@ let tagOwners , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.rj_gateway - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.setec - , mapValue = [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] + , mapValue = + [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ] } , { mapKey = C.tag.ci_agent , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ] diff --git a/generated/policy.json b/generated/policy.json new file mode 100644 index 0000000..ec7b04e --- /dev/null +++ b/generated/policy.json @@ -0,0 +1,900 @@ +{ + "groups": { + "group:developers": [ + "jsullivan2@gmail.com", + "jess@sulliwood.org" + ], + "group:dollhouse-admins": [ + "jsullivan2@gmail.com", + "jess@sulliwood.org" + ], + "group:dollhouse-users": [ + "jsullivan2@gmail.com", + "jess@sulliwood.org" + ] + }, + "tagOwners": { + "tag:ci-agent": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:dev": [ + "tag:tag-authority", + "autogroup:admin", + "group:developers" + ], + "tag:dollhouse": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:exit-node": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:k8s": [ + "tag:tag-authority", + "tag:k8s-operator", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:k8s-operator": [ + "tag:tag-authority", + "tag:k8s-operator", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:kvm-proxy": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:mcp-proxy": [ + "tag:k8s-operator", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:qa": [ + "tag:tag-authority", + "autogroup:admin", + "group:developers" + ], + "tag:rj-gateway": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:services": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:setec": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:staging": [ + "tag:tag-authority", + "autogroup:admin", + "group:developers" + ], + "tag:subnet-router": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:switch": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tag-authority": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tinyland-lab-ci-ephemeral": [ + "tag:tinyland-lab-deploy", + "autogroup:admin" + ], + "tag:tinyland-lab-common": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tinyland-lab-crush": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tinyland-lab-deploy": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tinyland-lab-moonlight": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tinyland-lab-nix-target": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tinyland-lab-runner": [ + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tinyland-lab-sunshine": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ], + "tag:tsidp": [ + "tag:tag-authority", + "autogroup:admin", + "group:dollhouse-admins" + ] + }, + "acls": [ + { + "action": "accept", + "src": [ + "group:dollhouse-users", + "group:dollhouse-admins" + ], + "dst": [ + "tag:dev:*", + "tag:dollhouse:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:dev" + ], + "dst": [ + "tag:dollhouse:*", + "tag:services:*", + "tag:k8s:*", + "tag:tsidp:*", + "autogroup:internet:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:dev" + ], + "dst": [ + "tag:dev:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins" + ], + "dst": [ + "tag:dollhouse:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-users" + ], + "dst": [ + "tag:dollhouse:8100", + "tag:dollhouse:6631", + "tag:dollhouse:8080", + "tag:dollhouse:80", + "tag:dollhouse:443", + "tag:dollhouse:3000", + "tag:dollhouse:40000" + ] + }, + { + "action": "accept", + "src": [ + "jsullivan2@gmail.com" + ], + "dst": [ + "tag:dollhouse:22" + ] + }, + { + "action": "accept", + "src": [ + "tag:dollhouse" + ], + "dst": [ + "tag:dollhouse:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:services" + ], + "dst": [ + "tag:services:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:k8s" + ], + "dst": [ + "tag:k8s:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:k8s-operator" + ], + "dst": [ + "tag:k8s:*", + "tag:dollhouse:*", + "tag:services:*", + "tag:dev:*", + "tag:staging:*", + "tag:qa:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:switch", + "tag:subnet-router" + ], + "dst": [ + "tag:dollhouse:*", + "tag:dev:*", + "autogroup:internet:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins" + ], + "dst": [ + "tag:switch:*", + "tag:subnet-router:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-users" + ], + "dst": [ + "tag:switch:80", + "tag:switch:443" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "group:dollhouse-users", + "tag:dollhouse", + "tag:dev" + ], + "dst": [ + "192.168.0.0/16:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins" + ], + "dst": [ + "tag:kvm-proxy:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:exit-node" + ], + "dst": [ + "autogroup:internet:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "tag:dollhouse" + ], + "dst": [ + "tag:k8s:6443", + "tag:k8s:9345", + "tag:k8s:30443", + "tag:k8s:10250", + "tag:k8s:2379-2380" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "tag:k8s" + ], + "dst": [ + "tag:tsidp:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "group:dollhouse-users" + ], + "dst": [ + "tag:k8s-operator:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "group:dollhouse-users" + ], + "dst": [ + "tag:k8s:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-common", + "tag:dollhouse", + "group:dollhouse-admins" + ], + "dst": [ + "tag:k8s:4222", + "tag:k8s:8333", + "tag:k8s:8888", + "tag:k8s:9333" + ] + }, + { + "action": "accept", + "src": [ + "tinyland-honey", + "tinyland-bumble", + "tinyland-sting" + ], + "dst": [ + "tinyland-loki-observability:3100" + ] + }, + { + "action": "accept", + "src": [ + "tinyland-honey" + ], + "dst": [ + "tinyland-grafana-observability:3000" + ] + }, + { + "action": "accept", + "src": [ + "group:developers" + ], + "dst": [ + "tag:dev:*" + ] + }, + { + "action": "accept", + "src": [ + "group:developers" + ], + "dst": [ + "tag:staging:*" + ] + }, + { + "action": "accept", + "src": [ + "group:developers" + ], + "dst": [ + "tag:qa:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins" + ], + "dst": [ + "tag:dev:*", + "tag:staging:*", + "tag:qa:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-common", + "tag:tinyland-lab-runner" + ], + "dst": [ + "tag:tinyland-lab-common:22", + "tag:tinyland-lab-runner:22" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-moonlight", + "tag:tinyland-lab-sunshine" + ], + "dst": [ + "tag:tinyland-lab-sunshine:47984-47990", + "tag:tinyland-lab-sunshine:47998-48010" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-sunshine", + "tag:tinyland-lab-moonlight" + ], + "dst": [ + "tag:tinyland-lab-sunshine:*", + "tag:tinyland-lab-moonlight:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins" + ], + "dst": [ + "tag:tinyland-lab-common:*", + "tag:tinyland-lab-sunshine:*", + "tag:tinyland-lab-moonlight:*", + "tag:tinyland-lab-crush:*", + "tag:tinyland-lab-runner:*", + "tag:tinyland-lab-nix-target:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-crush" + ], + "dst": [ + "autogroup:internet:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-ci-ephemeral", + "tag:tinyland-lab-deploy" + ], + "dst": [ + "tag:dev:22", + "tag:tinyland-lab-common:22" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-ci-ephemeral" + ], + "dst": [ + "tag:dev:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-nix-target" + ], + "dst": [ + "autogroup:internet:443", + "autogroup:internet:80" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-users", + "group:dollhouse-admins" + ], + "dst": [ + "autogroup:internet:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:rj-gateway" + ], + "dst": [ + "tag:setec:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:ci-agent" + ], + "dst": [ + "tag:dev:*", + "tag:k8s:*", + "tag:rj-gateway:*" + ] + }, + { + "action": "accept", + "src": [ + "tag:ci-agent" + ], + "dst": [ + "autogroup:internet:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "group:dollhouse-users", + "tag:dev", + "tag:dollhouse", + "tag:rj-gateway", + "tag:ci-agent", + "tag:k8s-operator", + "tag:k8s" + ], + "dst": [ + "ai:*" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins" + ], + "dst": [ + "tag:rj-gateway:*", + "tag:setec:*" + ] + } + ], + "grants": [ + { + "src": [ + "tag:tsidp" + ], + "dst": [ + "group:dollhouse-admins" + ], + "app": { + "tailscale.com/cap/tsidp": [ + { + "admin": [ + "group:dollhouse-admins" + ] + } + ] + } + }, + { + "src": [ + "tag:k8s-operator" + ], + "dst": [ + "group:dollhouse-admins" + ], + "app": { + "tailscale.com/cap/kubernetes": [ + { + "impersonate": { + "groups": [ + "system:masters" + ] + } + } + ] + } + }, + { + "src": [ + "autogroup:member" + ], + "dst": [ + "tag:rj-gateway" + ], + "app": { + "tinyland.dev/cap/rj-gateway": [ + { + "role": "reader" + } + ] + } + }, + { + "src": [ + "autogroup:admin" + ], + "dst": [ + "tag:rj-gateway" + ], + "app": { + "tinyland.dev/cap/rj-gateway": [ + { + "role": "admin" + } + ] + } + }, + { + "src": [ + "tag:ci-agent" + ], + "dst": [ + "tag:rj-gateway" + ], + "app": { + "tinyland.dev/cap/rj-gateway": [ + { + "role": "reader", + "secrets": [ + "github-token", + "gitlab-token", + "neon-database-url" + ] + } + ] + } + }, + { + "src": [ + "tag:rj-gateway" + ], + "dst": [ + "tag:setec" + ], + "app": { + "tailscale.com/cap/secrets": [ + { + "action": [ + "get", + "info", + "put", + "activate", + "delete" + ], + "secret": [ + "*" + ] + } + ] + } + }, + { + "src": [ + "autogroup:admin" + ], + "dst": [ + "tag:setec" + ], + "app": { + "tailscale.com/cap/secrets": [ + { + "action": [ + "get", + "info", + "put", + "activate", + "delete" + ], + "secret": [ + "*" + ] + } + ] + } + }, + { + "src": [ + "tinyland-honey" + ], + "dst": [ + "tag:mcp-proxy" + ], + "ip": [ + "tcp:8080" + ] + }, + { + "src": [ + "tag:dollhouse" + ], + "dst": [ + "tag:dollhouse" + ], + "app": { + "tailscale.com/cap/relay": [ + {} + ] + } + } + ], + "ssh": [ + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "autogroup:admin" + ], + "dst": [ + "tag:dollhouse", + "tag:dev" + ], + "users": [ + "jess", + "jsullivan2", + "root", + "autogroup:nonroot" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-users" + ], + "dst": [ + "tag:dollhouse", + "tag:dev" + ], + "users": [ + "jess", + "jsullivan2", + "autogroup:nonroot" + ] + }, + { + "action": "accept", + "src": [ + "tag:dev", + "tag:dollhouse" + ], + "dst": [ + "tag:dev", + "tag:dollhouse" + ], + "users": [ + "jess", + "jsullivan2", + "root", + "autogroup:nonroot" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins" + ], + "dst": [ + "tag:tinyland-lab-common", + "tag:tinyland-lab-sunshine", + "tag:tinyland-lab-moonlight", + "tag:tinyland-lab-crush", + "tag:tinyland-lab-runner", + "tag:tinyland-lab-nix-target" + ], + "users": [ + "jess", + "jsullivan2", + "root", + "autogroup:nonroot" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-common", + "tag:tinyland-lab-runner" + ], + "dst": [ + "tag:tinyland-lab-common", + "tag:tinyland-lab-sunshine", + "tag:tinyland-lab-moonlight" + ], + "users": [ + "jess", + "jsullivan2", + "autogroup:nonroot" + ] + }, + { + "action": "accept", + "src": [ + "tag:tinyland-lab-ci-ephemeral", + "tag:tinyland-lab-deploy" + ], + "dst": [ + "tag:dev", + "tag:tinyland-lab-common" + ], + "users": [ + "jsullivan2", + "jess", + "autogroup:nonroot" + ] + }, + { + "action": "accept", + "src": [ + "group:dollhouse-admins", + "tag:dev", + "tag:dollhouse" + ], + "dst": [ + "tag:switch" + ], + "users": [ + "admin" + ] + }, + { + "action": "accept", + "src": [ + "tag:switch" + ], + "dst": [ + "tag:dollhouse", + "tag:dev" + ], + "users": [ + "admin", + "root", + "jess", + "jsullivan2" + ] + } + ], + "nodeAttrs": [ + { + "attr": [ + "funnel" + ], + "target": [ + "tag:dollhouse" + ] + } + ], + "autoApprovers": { + "exitNode": [ + "tag:exit-node" + ], + "routes": { + "10.0.0.0/8": [ + "tag:dollhouse", + "tag:k8s" + ], + "192.168.0.0/16": [ + "tag:subnet-router", + "tag:dollhouse" + ] + } + }, + "hosts": { + "ai": "100.108.97.127", + "tinyland-bumble": "100.88.101.107", + "tinyland-grafana-observability": "100.74.127.80", + "tinyland-honey": "100.113.89.12", + "tinyland-loki-observability": "100.64.15.87", + "tinyland-sting": "100.85.46.118" + } +} From 0099206fb9d684f016741bf7f11c85ca8c95a81a Mon Sep 17 00:00:00 2001 From: Jess Sullivan Date: Mon, 27 Jul 2026 18:12:25 -0400 Subject: [PATCH 3/3] chore: drop untracked build output from the branch --- generated/policy.json | 900 ------------------------------------------ 1 file changed, 900 deletions(-) delete mode 100644 generated/policy.json diff --git a/generated/policy.json b/generated/policy.json deleted file mode 100644 index ec7b04e..0000000 --- a/generated/policy.json +++ /dev/null @@ -1,900 +0,0 @@ -{ - "groups": { - "group:developers": [ - "jsullivan2@gmail.com", - "jess@sulliwood.org" - ], - "group:dollhouse-admins": [ - "jsullivan2@gmail.com", - "jess@sulliwood.org" - ], - "group:dollhouse-users": [ - "jsullivan2@gmail.com", - "jess@sulliwood.org" - ] - }, - "tagOwners": { - "tag:ci-agent": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:dev": [ - "tag:tag-authority", - "autogroup:admin", - "group:developers" - ], - "tag:dollhouse": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:exit-node": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:k8s": [ - "tag:tag-authority", - "tag:k8s-operator", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:k8s-operator": [ - "tag:tag-authority", - "tag:k8s-operator", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:kvm-proxy": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:mcp-proxy": [ - "tag:k8s-operator", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:qa": [ - "tag:tag-authority", - "autogroup:admin", - "group:developers" - ], - "tag:rj-gateway": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:services": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:setec": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:staging": [ - "tag:tag-authority", - "autogroup:admin", - "group:developers" - ], - "tag:subnet-router": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:switch": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tag-authority": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tinyland-lab-ci-ephemeral": [ - "tag:tinyland-lab-deploy", - "autogroup:admin" - ], - "tag:tinyland-lab-common": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tinyland-lab-crush": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tinyland-lab-deploy": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tinyland-lab-moonlight": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tinyland-lab-nix-target": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tinyland-lab-runner": [ - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tinyland-lab-sunshine": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ], - "tag:tsidp": [ - "tag:tag-authority", - "autogroup:admin", - "group:dollhouse-admins" - ] - }, - "acls": [ - { - "action": "accept", - "src": [ - "group:dollhouse-users", - "group:dollhouse-admins" - ], - "dst": [ - "tag:dev:*", - "tag:dollhouse:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:dev" - ], - "dst": [ - "tag:dollhouse:*", - "tag:services:*", - "tag:k8s:*", - "tag:tsidp:*", - "autogroup:internet:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:dev" - ], - "dst": [ - "tag:dev:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins" - ], - "dst": [ - "tag:dollhouse:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-users" - ], - "dst": [ - "tag:dollhouse:8100", - "tag:dollhouse:6631", - "tag:dollhouse:8080", - "tag:dollhouse:80", - "tag:dollhouse:443", - "tag:dollhouse:3000", - "tag:dollhouse:40000" - ] - }, - { - "action": "accept", - "src": [ - "jsullivan2@gmail.com" - ], - "dst": [ - "tag:dollhouse:22" - ] - }, - { - "action": "accept", - "src": [ - "tag:dollhouse" - ], - "dst": [ - "tag:dollhouse:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:services" - ], - "dst": [ - "tag:services:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:k8s" - ], - "dst": [ - "tag:k8s:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:k8s-operator" - ], - "dst": [ - "tag:k8s:*", - "tag:dollhouse:*", - "tag:services:*", - "tag:dev:*", - "tag:staging:*", - "tag:qa:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:switch", - "tag:subnet-router" - ], - "dst": [ - "tag:dollhouse:*", - "tag:dev:*", - "autogroup:internet:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins" - ], - "dst": [ - "tag:switch:*", - "tag:subnet-router:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-users" - ], - "dst": [ - "tag:switch:80", - "tag:switch:443" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "group:dollhouse-users", - "tag:dollhouse", - "tag:dev" - ], - "dst": [ - "192.168.0.0/16:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins" - ], - "dst": [ - "tag:kvm-proxy:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:exit-node" - ], - "dst": [ - "autogroup:internet:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "tag:dollhouse" - ], - "dst": [ - "tag:k8s:6443", - "tag:k8s:9345", - "tag:k8s:30443", - "tag:k8s:10250", - "tag:k8s:2379-2380" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "tag:k8s" - ], - "dst": [ - "tag:tsidp:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "group:dollhouse-users" - ], - "dst": [ - "tag:k8s-operator:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "group:dollhouse-users" - ], - "dst": [ - "tag:k8s:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-common", - "tag:dollhouse", - "group:dollhouse-admins" - ], - "dst": [ - "tag:k8s:4222", - "tag:k8s:8333", - "tag:k8s:8888", - "tag:k8s:9333" - ] - }, - { - "action": "accept", - "src": [ - "tinyland-honey", - "tinyland-bumble", - "tinyland-sting" - ], - "dst": [ - "tinyland-loki-observability:3100" - ] - }, - { - "action": "accept", - "src": [ - "tinyland-honey" - ], - "dst": [ - "tinyland-grafana-observability:3000" - ] - }, - { - "action": "accept", - "src": [ - "group:developers" - ], - "dst": [ - "tag:dev:*" - ] - }, - { - "action": "accept", - "src": [ - "group:developers" - ], - "dst": [ - "tag:staging:*" - ] - }, - { - "action": "accept", - "src": [ - "group:developers" - ], - "dst": [ - "tag:qa:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins" - ], - "dst": [ - "tag:dev:*", - "tag:staging:*", - "tag:qa:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-common", - "tag:tinyland-lab-runner" - ], - "dst": [ - "tag:tinyland-lab-common:22", - "tag:tinyland-lab-runner:22" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-moonlight", - "tag:tinyland-lab-sunshine" - ], - "dst": [ - "tag:tinyland-lab-sunshine:47984-47990", - "tag:tinyland-lab-sunshine:47998-48010" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-sunshine", - "tag:tinyland-lab-moonlight" - ], - "dst": [ - "tag:tinyland-lab-sunshine:*", - "tag:tinyland-lab-moonlight:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins" - ], - "dst": [ - "tag:tinyland-lab-common:*", - "tag:tinyland-lab-sunshine:*", - "tag:tinyland-lab-moonlight:*", - "tag:tinyland-lab-crush:*", - "tag:tinyland-lab-runner:*", - "tag:tinyland-lab-nix-target:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-crush" - ], - "dst": [ - "autogroup:internet:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-ci-ephemeral", - "tag:tinyland-lab-deploy" - ], - "dst": [ - "tag:dev:22", - "tag:tinyland-lab-common:22" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-ci-ephemeral" - ], - "dst": [ - "tag:dev:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-nix-target" - ], - "dst": [ - "autogroup:internet:443", - "autogroup:internet:80" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-users", - "group:dollhouse-admins" - ], - "dst": [ - "autogroup:internet:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:rj-gateway" - ], - "dst": [ - "tag:setec:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:ci-agent" - ], - "dst": [ - "tag:dev:*", - "tag:k8s:*", - "tag:rj-gateway:*" - ] - }, - { - "action": "accept", - "src": [ - "tag:ci-agent" - ], - "dst": [ - "autogroup:internet:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "group:dollhouse-users", - "tag:dev", - "tag:dollhouse", - "tag:rj-gateway", - "tag:ci-agent", - "tag:k8s-operator", - "tag:k8s" - ], - "dst": [ - "ai:*" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins" - ], - "dst": [ - "tag:rj-gateway:*", - "tag:setec:*" - ] - } - ], - "grants": [ - { - "src": [ - "tag:tsidp" - ], - "dst": [ - "group:dollhouse-admins" - ], - "app": { - "tailscale.com/cap/tsidp": [ - { - "admin": [ - "group:dollhouse-admins" - ] - } - ] - } - }, - { - "src": [ - "tag:k8s-operator" - ], - "dst": [ - "group:dollhouse-admins" - ], - "app": { - "tailscale.com/cap/kubernetes": [ - { - "impersonate": { - "groups": [ - "system:masters" - ] - } - } - ] - } - }, - { - "src": [ - "autogroup:member" - ], - "dst": [ - "tag:rj-gateway" - ], - "app": { - "tinyland.dev/cap/rj-gateway": [ - { - "role": "reader" - } - ] - } - }, - { - "src": [ - "autogroup:admin" - ], - "dst": [ - "tag:rj-gateway" - ], - "app": { - "tinyland.dev/cap/rj-gateway": [ - { - "role": "admin" - } - ] - } - }, - { - "src": [ - "tag:ci-agent" - ], - "dst": [ - "tag:rj-gateway" - ], - "app": { - "tinyland.dev/cap/rj-gateway": [ - { - "role": "reader", - "secrets": [ - "github-token", - "gitlab-token", - "neon-database-url" - ] - } - ] - } - }, - { - "src": [ - "tag:rj-gateway" - ], - "dst": [ - "tag:setec" - ], - "app": { - "tailscale.com/cap/secrets": [ - { - "action": [ - "get", - "info", - "put", - "activate", - "delete" - ], - "secret": [ - "*" - ] - } - ] - } - }, - { - "src": [ - "autogroup:admin" - ], - "dst": [ - "tag:setec" - ], - "app": { - "tailscale.com/cap/secrets": [ - { - "action": [ - "get", - "info", - "put", - "activate", - "delete" - ], - "secret": [ - "*" - ] - } - ] - } - }, - { - "src": [ - "tinyland-honey" - ], - "dst": [ - "tag:mcp-proxy" - ], - "ip": [ - "tcp:8080" - ] - }, - { - "src": [ - "tag:dollhouse" - ], - "dst": [ - "tag:dollhouse" - ], - "app": { - "tailscale.com/cap/relay": [ - {} - ] - } - } - ], - "ssh": [ - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "autogroup:admin" - ], - "dst": [ - "tag:dollhouse", - "tag:dev" - ], - "users": [ - "jess", - "jsullivan2", - "root", - "autogroup:nonroot" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-users" - ], - "dst": [ - "tag:dollhouse", - "tag:dev" - ], - "users": [ - "jess", - "jsullivan2", - "autogroup:nonroot" - ] - }, - { - "action": "accept", - "src": [ - "tag:dev", - "tag:dollhouse" - ], - "dst": [ - "tag:dev", - "tag:dollhouse" - ], - "users": [ - "jess", - "jsullivan2", - "root", - "autogroup:nonroot" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins" - ], - "dst": [ - "tag:tinyland-lab-common", - "tag:tinyland-lab-sunshine", - "tag:tinyland-lab-moonlight", - "tag:tinyland-lab-crush", - "tag:tinyland-lab-runner", - "tag:tinyland-lab-nix-target" - ], - "users": [ - "jess", - "jsullivan2", - "root", - "autogroup:nonroot" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-common", - "tag:tinyland-lab-runner" - ], - "dst": [ - "tag:tinyland-lab-common", - "tag:tinyland-lab-sunshine", - "tag:tinyland-lab-moonlight" - ], - "users": [ - "jess", - "jsullivan2", - "autogroup:nonroot" - ] - }, - { - "action": "accept", - "src": [ - "tag:tinyland-lab-ci-ephemeral", - "tag:tinyland-lab-deploy" - ], - "dst": [ - "tag:dev", - "tag:tinyland-lab-common" - ], - "users": [ - "jsullivan2", - "jess", - "autogroup:nonroot" - ] - }, - { - "action": "accept", - "src": [ - "group:dollhouse-admins", - "tag:dev", - "tag:dollhouse" - ], - "dst": [ - "tag:switch" - ], - "users": [ - "admin" - ] - }, - { - "action": "accept", - "src": [ - "tag:switch" - ], - "dst": [ - "tag:dollhouse", - "tag:dev" - ], - "users": [ - "admin", - "root", - "jess", - "jsullivan2" - ] - } - ], - "nodeAttrs": [ - { - "attr": [ - "funnel" - ], - "target": [ - "tag:dollhouse" - ] - } - ], - "autoApprovers": { - "exitNode": [ - "tag:exit-node" - ], - "routes": { - "10.0.0.0/8": [ - "tag:dollhouse", - "tag:k8s" - ], - "192.168.0.0/16": [ - "tag:subnet-router", - "tag:dollhouse" - ] - } - }, - "hosts": { - "ai": "100.108.97.127", - "tinyland-bumble": "100.88.101.107", - "tinyland-grafana-observability": "100.74.127.80", - "tinyland-honey": "100.113.89.12", - "tinyland-loki-observability": "100.64.15.87", - "tinyland-sting": "100.85.46.118" - } -}