my-rules.json

@@ -16,13 +16,14 @@
 		// {"action": "accept", "src": ["*"], "dst": ["*:*"]},
 
 		// Random can
-		{"action": "accept", "src": ["tag:Random"], "dst": ["*:*"]},
-
+		{"action": "accept", "src": ["tag:Random"], "dst": ["*:*"]}, 
+	
 		// Host can
 		{"action": "accept", "src": ["tag:Host"], "dst": ["tag:Service:*"]},
 
 		// Hidden serves
 		{"action": "accept", "src": ["*"], "dst": ["tag:Hidden:*"]},
+
 	],
 
 	// Define postures that will be applied to all rules without any specific
@@ -51,24 +52,27 @@
 
 	// Define users and devices that can use Tailscale SSH.
 	"ssh": [
+		// Allow all users to SSH into their own devices in check mode.
+		// Comment this section out if you want to define specific restrictions.
 		{
 			"action": "accept",
 			"src":    ["tag:Random"],
-			"dst":    ["tag:Host", "tag:Service"],
+			"dst":    ["autogroup:taged"],
 			"users":  ["autogroup:nonroot", "root"],
 		},
 	],
 
 	// Test access rules every time they're saved.
-	"tests": [
+	 "tests": [
+	  	{
+	  		"src": "tag:Bridge",
+	  		"accept": ["tag:Random:80"],
+	  		"deny": ["tag:Host:80"],
+	  	},
 		{
-			"src":  "tag:Bridge",
-			"accept": ["tag:Hidden:80"],
-			"deny": ["tag:Host:80"],
-		},
-		{
-			"src":    "tag:Random",
+			"src": "tag:Random",
 			"accept": ["tag:Bridge:80", "tag:Host:80"],
 		},
-	],
+	 ],
 }
+