From 3ee0b96ed5704ba0cdea0aab72016c717f53a009 Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Sun, 1 Feb 2026 01:14:58 +0100
Subject: [PATCH] feat: add acl policies to the headscale

---
 headscale/compose.yaml               |  1 +
 headscale/config/policy.json.example | 26 ++++++++++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 headscale/config/policy.json.example

diff --git a/headscale/compose.yaml b/headscale/compose.yaml
index 440e578..cd1b671 100644
--- a/headscale/compose.yaml
+++ b/headscale/compose.yaml
@@ -9,6 +9,7 @@ services:
     volumes:
       - ./config/headscale.yaml:/etc/headscale/config.yaml
       - data:/var/lib/headscale
+      - ./config/policy.json:/var/lib/headscale/policy.json
     labels:
       - "me.tale.headplane.target: headscale"
       - "traefik.enable=true"
diff --git a/headscale/config/policy.json.example b/headscale/config/policy.json.example
new file mode 100644
index 0000000..6e2e93a
--- /dev/null
+++ b/headscale/config/policy.json.example
@@ -0,0 +1,26 @@
+{
+    "groups": {
+        "group:admin": [
+            "admin@"
+        ],
+        "group:users": []
+    },
+    "tagOwners": {},
+    "hosts": {},
+    "acls": [
+        {
+            "#ha-meta": {
+                "name": "users",
+                "open": true
+            },
+            "action": "accept",
+            "src": [
+                "autogroup:member"
+            ],
+            "dst": [
+                "autogroup:self:*"
+            ]
+        }
+    ],
+    "ssh": []
+}
\ No newline at end of file