Repository navigation
Feat/tailscale acl serve scope split - #25
Merged
Merged
Conversation
…s, eliminating muscle host-vars
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request restructures and centralizes Tailscale configuration, separating sensitive and non-sensitive variables for better maintainability and security. It moves global, non-secret Tailscale settings into a new
inventory/group_vars/all/tailscale.ymlfile, removes redundant or misplaced variables from other files, and updates documentation and ACL templates to reflect these changes. Sensitive information such as operator emails remains in the encrypted secrets file. The result is a more declarative, secure, and easier-to-understand Tailscale configuration.Centralization and Separation of Tailscale Configuration:
inventory/group_vars/all/tailscale.ymlas the single source of truth for all non-sensitive Tailscale settings (toolchain versions, mesh defaults, node attributes, serve flags, and ports), with clear documentation and privacy contract.inventory/group_vars/all/main.yml,inventory/group_vars/all/images.yml, andinventory/group_vars/muscle/tailscale.yml, ensuring all non-secret config is now in the new central file. [1] [2] [3] [4] [5] [6]Sensitive Data Handling and ACL Source Configuration:
tailscale_acl_serve_sourcesininventory/group_vars/all/secrets.sops.yml.examplefor operator email addresses, with fallback logic and documentation, ensuring no PII is stored in public config files.Role Defaults and Template Logic Updates:
roles/L2_compliance/general/defaults/tailscale.ymlandroles/L2_compliance/defaults/main.ymlto provide only safe fallbacks, deferring all topology and policy configuration to the new group_vars file. [1] [2]tailscale-acls.json.j2) to use the new global enable flag and correct variable fallbacks for operator sources, matching the new configuration structure.Documentation Improvements:
OPERATIONS_RUNBOOK.mdto document the new declarative, partitioned approach for Tailscale Serve access control and setup, with clear separation between public and encrypted configuration.Maintenance and Baseline Updates:
.secrets.baselineto reflect line number changes and regeneration timestamp due to the config file refactoring. [1] [2]