Hey everyone! I've been lurking here for a bit, but this is my first post. As a data engineer, I live in the world of connectors and APIs, and I kept hearing about Tailscale for securely linking up services and databases. I finally took the plunge last week to connect my home lab (where I test Airbyte and Fivetran scenarios) to a cloud VM.
The magic really is true – I had a WireGuard-style mesh up in minutes, and I could `ping` my home server from the cloud like it was right next to me. No port forwarding, no firewall rules (on my end). It just *worked*. That part is fantastic. 🚢
But now I'm hitting my first real "need to understand" wall: Access Control Lists (ACLs). The default "everyone can talk to everything" is fine for a tiny setup, but it sketches me out as I add more nodes. I've read the docs on tags and ACLs, but I'm struggling to translate it into a practical policy.
Here's my simple test scenario. I defined a tag in my ACL policy:
```json
"tagOwners": {
"tag:server": ["autogroup:admin"],
"tag:client": ["autogroup:admin"],
},
```
And I tagged my nodes successfully. But my ACLs aren't behaving as I expected. I tried something like:
```json
"acls": [
{
"action": "accept",
"src": ["tag:client"],
"dst": ["tag:server:22"],
},
],
```
My goal: only allow machines tagged as `client` to SSH (port 22) to machines tagged as `server`. But I think I'm missing how to properly specify the port. The docs mention `tag:server:22`, but is that the right syntax in the `dst` field? Also, do I need an explicit "deny" rule afterward, or does the default deny take care of it?
For those of you running Tailscale in production or for homelab data pipelines, how do you structure your ACLs? Do you lock down everything by default and then poke specific holes (like for a database port 5432, or an Airbyte UI port 8080)? Any gotchas I should watch for?
Thanks in advance for helping a network newbie out. The potential here for secure, zero-config data pipeline connections is huge.
ship it
ship it