Ephemeral Castle Tailnet Security

TazLab networking follows a strict Zero Trust model where identity is managed via Tailscale tags and enforced by an ACL policy managed as code.

Identity Governance (acl.json)

Tag Owners

  • tag:tazpod: Managed by roberto.tazzoli@gmail.com.
  • tag:tazlab-vault: Managed by the operator and TazPod.
  • tag:tazlab-k8s: Managed by the operator.
  • tag:tazlab-db: Managed by the operator.

ACL Rules (Direct Access)

Source TagDestination TagPort(s)Purpose
tag:tazpodtag:tazlab-vault22, 6443, 50000Admin & Control.
tag:tazpodtag:tazlab-k8s6443, 50000K8s API & Talos API.
tag:tazpodtag:vault-api8200Vault operations.
tag:tazlab-k8stag:vault-api8200App secret retrieval.
tag:tazlab-vaulttag:tazlab-db5432DB access (Planned).
tag:tazlab-vaulttag:tazlab-vault8201Raft cluster gossip.

Automation via OAuth

The tailscale/main.tf file defines a tailscale_oauth_client named tazlab-bootstrap.

  • Scopes: auth_keys, devices.
  • Tags: Automatically assigns tag:tazpod and tag:tazlab-k8s to new devices.
  • This allows for the Automatic AuthKey Minting during rebirth.

See Also