Change Tailscale SSH ACL from "check" to "accept" for admin devices

forgejo_admin commented

2026-04-04 17:13:25 +00:00

Contributor

Type

Feature

Lineage

Standalone — discovered during SSH debugging session (2026-04-04).
Termius on iPhone cannot complete the browser-based approval flow that "check" requires.

Repo

forgejo_admin/pal-e-platform

User Story

As an admin using Termius on my iPhone
I want direct SSH access to archbox via Tailscale
So that I can manage the platform from mobile without needing a browser approval step

Context

The Tailscale ACL SSH rule in terraform/modules/networking/main.tf:73-80 is currently:

ssh = [
  {
    action = "check"
    src    = ["autogroup:member"]
    dst    = ["autogroup:self"]
    users  = ["autogroup:nonroot", "root"]
  }
]

"check" maps to Tailscale's holdAndDelegate behavior — every SSH session requires browser-based approval. This works with tailscale ssh CLI but breaks standalone SSH clients (Termius, PuTTY, any standard SSH client) because they can't follow the HTTP redirect.

The ts-input iptables chain also DROPs all 100.64.0.0/10 traffic (Tailscale CGNAT range), confirming the ACL blocks peer SSH at the firewall level when Tailscale SSH isn't intercepting.

Changing to "accept" for autogroup:member → autogroup:self is safe because:

Only authenticated tailnet members can connect (WireGuard identity, not IP spoofable)
autogroup:self limits SSH to your own devices only
The tailnet already grants autogroup:admin full access on all ports via the grants block

File Targets

Files the agent should modify:

terraform/modules/networking/main.tf — change action = "check" to action = "accept" in the ssh block (line 76)

Files the agent should NOT touch:

terraform/modules/networking/variables.tf — no new variables needed
Any funnel or grant definitions — SSH ACL is independent

Acceptance Criteria

tofu plan shows only the ACL policy update (no other resource changes)
After tofu apply, tailscale debug netmap SSH policy shows accept: true (not holdAndDelegate)
SSH from iPhone Termius to archbox succeeds without browser approval
SSH from MacBook continues to work

Test Expectations

tofu validate passes
tofu plan -lock=false shows exactly 1 resource change (tailscale_acl.this)
No other ACL rules affected (grants, nodeAttrs, tagOwners unchanged)

Constraints

Must run tofu fmt before committing
Must include tofu plan output in PR
Must use -lock=false for plan commands (state lock blocks CI)
This is a 1-line change — do not refactor surrounding ACL structure

Checklist

PR opened
tofu plan output included
No unrelated changes

pal-e-platform — project this affects
sop-platform-tf-changes — SOP for terraform changes in this repo

### Type Feature ### Lineage Standalone — discovered during SSH debugging session (2026-04-04). Termius on iPhone cannot complete the browser-based approval flow that `"check"` requires. ### Repo `forgejo_admin/pal-e-platform` ### User Story As an admin using Termius on my iPhone I want direct SSH access to archbox via Tailscale So that I can manage the platform from mobile without needing a browser approval step ### Context The Tailscale ACL SSH rule in `terraform/modules/networking/main.tf:73-80` is currently: ```hcl ssh = [ { action = "check" src = ["autogroup:member"] dst = ["autogroup:self"] users = ["autogroup:nonroot", "root"] } ] ``` `"check"` maps to Tailscale's `holdAndDelegate` behavior — every SSH session requires browser-based approval. This works with `tailscale ssh` CLI but **breaks standalone SSH clients** (Termius, PuTTY, any standard SSH client) because they can't follow the HTTP redirect. The `ts-input` iptables chain also DROPs all `100.64.0.0/10` traffic (Tailscale CGNAT range), confirming the ACL blocks peer SSH at the firewall level when Tailscale SSH isn't intercepting. Changing to `"accept"` for `autogroup:member` → `autogroup:self` is safe because: - Only authenticated tailnet members can connect (WireGuard identity, not IP spoofable) - `autogroup:self` limits SSH to your own devices only - The tailnet already grants `autogroup:admin` full access on all ports via the grants block ### File Targets Files the agent should modify: - `terraform/modules/networking/main.tf` — change `action = "check"` to `action = "accept"` in the `ssh` block (line 76) Files the agent should NOT touch: - `terraform/modules/networking/variables.tf` — no new variables needed - Any funnel or grant definitions — SSH ACL is independent ### Acceptance Criteria - [ ] `tofu plan` shows only the ACL policy update (no other resource changes) - [ ] After `tofu apply`, `tailscale debug netmap` SSH policy shows `accept: true` (not `holdAndDelegate`) - [ ] SSH from iPhone Termius to archbox succeeds without browser approval - [ ] SSH from MacBook continues to work ### Test Expectations - [ ] `tofu validate` passes - [ ] `tofu plan -lock=false` shows exactly 1 resource change (`tailscale_acl.this`) - [ ] No other ACL rules affected (grants, nodeAttrs, tagOwners unchanged) ### Constraints - Must run `tofu fmt` before committing - Must include `tofu plan` output in PR - Must use `-lock=false` for plan commands (state lock blocks CI) - This is a 1-line change — do not refactor surrounding ACL structure ### Checklist - [ ] PR opened - [ ] `tofu plan` output included - [ ] No unrelated changes ### Related - `pal-e-platform` — project this affects - `sop-platform-tf-changes` — SOP for terraform changes in this repo

forgejo_admin commented

2026-04-04 17:18:25 +00:00

Author

Contributor

Scope Review: READY

Review note: review-802-2026-04-04
Ticket is well-scoped: 1-line change, file target verified at line 75, all template sections complete, story note confirmed.

[SCOPE] Missing arch-networking architecture note in pal-e-docs — create it to complete the traceability triangle.

## Scope Review: READY Review note: `review-802-2026-04-04` Ticket is well-scoped: 1-line change, file target verified at line 75, all template sections complete, story note confirmed. - [SCOPE] Missing `arch-networking` architecture note in pal-e-docs — create it to complete the traceability triangle.