feat: additional iteration over acl, now simpler

headscale/acl.json

@@ -0,0 +1,41 @@
+{
+	"groups": {
+		"group:admin": ["davide"],
+		"group:family": ["davide", "dario"],
+		"group:services": ["services"],
+		"group:external": []
+	},
+	"tagOwners": {
+		"tag:web": ["group:admin"],
+		"tag:dns": ["group:admin"],
+		"tag:exitnode": ["group:admin"],
+		"tag:game": ["group:admin", "group:family"]
+	},
+	"acls": [
+		// Family and admin should be able to access everything
+		{
+			"action": "accept",
+			"src": ["group:admin", "group:family"],
+			"dst": [
+				"*:*"
+			]
+		},
+		// External can access only hosted games
+		{
+			"action": "accept",
+			"src": ["group:external"],
+			"dst": [
+				"tag:game:*"
+			]
+		},
+		// Everyone should access DNS server (or we break their internet connection)
+		{
+			"action": "accept",
+			"src": ["*"],
+			"proto": "udp",
+			"dst": [
+				"tag:dns:53"
+			]
+		}
+	]
+}

headscale/config.yaml

@@ -213,7 +213,7 @@ policy:
   mode: file
   # If the mode is set to "file", the path to a
   # HuJSON file containing ACL policies.
-  path: ""
+  path: "/etc/headscale/acl.json"
 
 ## DNS
 #
@@ -279,6 +279,9 @@ dns:
     - name: "pi.hole"
       type: "A"
       value: "100.64.0.4"
+    - name: "pihole.lan.poldebra.me"
+      type: "A"
+      value: "100.64.0.4"
   # - name: "grafana.myvpn.example.com"
   #   type: "A"
   #   value: "100.64.0.3"