fix: allow gateway access with open ACL policy

2026-10-07 14:55:39 +09:00
parent 2be752d7f8
commit b6c0503f27
1 changed files with 20 additions and 5 deletions
@@ -73,16 +73,31 @@ export class HeadscaleAdapter {
    unresolved: string[]
    error?: string
  }> {
+    const gatewaySources = [...new Set(
+      config.headscaleGatewayUsers.map((user) => this.toHeadscaleUserName(user)),
+    )]
    const policy: HeadscalePolicy = {
      groups: {},
      tagOwners: {
        'tag:teaching-device': [`${config.headscaleTeachingDeviceOwner}@`],
      },
-      acls: [{
-        action: 'accept',
-        src: ['*'],
-        dst: ['*:*'],
-      }],
+      acls: [
+        {
+          action: 'accept',
+          src: ['*'],
+          dst: ['*:*'],
+        },
+        {
+          action: 'accept',
+          src: gatewaySources,
+          dst: ['*:*'],
+        },
+        {
+          action: 'accept',
+          src: ['tag:teaching-device'],
+          dst: ['*:*'],
+        },
+      ],
    }

    const result = await this.applyPolicy(policy)