Add tag:m3-agents to Tailscale ACL and automate agent auth (#43) #38

Merged

AlexCaswen merged 1 commit from add-tailscale-agents into main

2026-05-08 14:00:22 +00:00

AlexCaswen commented

2026-05-08 12:08:32 +00:00

(Migrated from gitlab.com)

Summary

Adds tag:m3-agents to the Tailscale ACL and wires up automated Tailscale authentication in the deploy-claude-code CI job.

ACL changes (`acl.hujson`)

Rule	Purpose
`tag:m3-agents` in tagOwners	New tag for AI agent containers
CI → agents	Deploy jobs can reach agent containers
Agents → monitoring	Grafana MCP read-only dashboard access
Agents → internet	Aperture, git, package downloads
Admin SSH → agents	Tailscale SSH console access

CI changes (`.gitlab-ci.yml`)

deploy-claude-code now runs tailscale up after nixos-rebuild switch:

Idempotent: checks tailscale status first, skips if already connected
Uses TAILSCALE_AGENTS_AUTHKEY CI variable (reusable, tagged tag:m3-agents)

Prerequisites

Before merging, create a CI variable:

Key: TAILSCALE_AGENTS_AUTHKEY
Value: Reusable auth key from Tailscale admin console, tagged tag:m3-agents
Masked: Yes
Hidden: Yes
Protected: No (MR branch pipelines need access)

Post-merge

After deploy-claude-code runs and Tailscale authenticates, you'll need to sign the node via Tailnet Lock from your iPhone or MacBook.

Closes #43

## Summary Adds `tag:m3-agents` to the Tailscale ACL and wires up automated Tailscale authentication in the `deploy-claude-code` CI job. ## ACL changes (`acl.hujson`) | Rule | Purpose | |------|--------| | `tag:m3-agents` in tagOwners | New tag for AI agent containers | | CI → agents | Deploy jobs can reach agent containers | | Agents → monitoring | Grafana MCP read-only dashboard access | | Agents → internet | Aperture, git, package downloads | | Admin SSH → agents | Tailscale SSH console access | ## CI changes (`.gitlab-ci.yml`) `deploy-claude-code` now runs `tailscale up` after `nixos-rebuild switch`: - Idempotent: checks `tailscale status` first, skips if already connected - Uses `TAILSCALE_AGENTS_AUTHKEY` CI variable (reusable, tagged `tag:m3-agents`) ## Prerequisites Before merging, create a CI variable: - **Key:** `TAILSCALE_AGENTS_AUTHKEY` - **Value:** Reusable auth key from Tailscale admin console, tagged `tag:m3-agents` - **Masked:** Yes - **Hidden:** Yes - **Protected:** No (MR branch pipelines need access) ## Post-merge After `deploy-claude-code` runs and Tailscale authenticates, you'll need to sign the node via Tailnet Lock from your iPhone or MacBook. Closes #43

AlexCaswen commented

2026-05-08 14:00:23 +00:00

(Migrated from gitlab.com)

mentioned in commit f04077d982

mentioned in commit f04077d9826fa710675b86e0d7aba70b0d8fefc9