From 0032085139411fcd9bc84147ab8912b98f82e5b5 Mon Sep 17 00:00:00 2001
From: chyoo <chyoo@futuredrive.net>
Date: Wed, 7 Oct 2026 14:55:39 +0900
Subject: [PATCH] fix: allow gateway access with open ACL policy

---
 src/services/headscale-adapter.ts | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/services/headscale-adapter.ts b/src/services/headscale-adapter.ts
index d17291b..c5c5ec7 100644
--- a/src/services/headscale-adapter.ts
+++ b/src/services/headscale-adapter.ts
@@ -73,16 +73,31 @@ export class HeadscaleAdapter {
     unresolved: string[]
     error?: string
   }> {
+    const gatewaySources = [...new Set(
+      config.headscaleGatewayUsers.map((user) => this.toHeadscaleUserName(user)),
+    )]
     const policy: HeadscalePolicy = {
       groups: {},
       tagOwners: {
         'tag:teaching-device': [`${config.headscaleTeachingDeviceOwner}@`],
       },
-      acls: [{
-        action: 'accept',
-        src: ['*'],
-        dst: ['*:*'],
-      }],
+      acls: [
+        {
+          action: 'accept',
+          src: ['*'],
+          dst: ['*:*'],
+        },
+        {
+          action: 'accept',
+          src: gatewaySources,
+          dst: ['*:*'],
+        },
+        {
+          action: 'accept',
+          src: ['tag:teaching-device'],
+          dst: ['*:*'],
+        },
+      ],
     }
 
     const result = await this.applyPolicy(policy)