Tailscale Zero Trust Networking

Laptop ←── WireGuard tunnel ──→ Production Server
Laptop ←── WireGuard tunnel ──→ Kubernetes Cluster
Phone  ←── WireGuard tunnel ──→ Home NAS

# Install on any device
curl -fsSL https://tailscale.com/install.sh | sh

# Connect
sudo tailscale up

# Check your IP
tailscale ip -4
# 100.64.0.1

{
  "acls": [
    {
      "action": "accept",
      "src": ["group:developers"],
      "dst": ["tag:dev-servers:*"]
    },
    {
      "action": "accept",
      "src": ["group:sre"],
      "dst": ["tag:production:*"]
    },
    {
      "action": "accept",
      "src": ["group:developers"],
      "dst": ["tag:production:443"]
    }
  ],
  "groups": {
    "group:developers": ["alice@myorg.com", "bob@myorg.com"],
    "group:sre": ["charlie@myorg.com"]
  },
  "tagOwners": {
    "tag:dev-servers": ["group:sre"],
    "tag:production": ["group:sre"]
  }
}

helm install tailscale-operator tailscale/tailscale-operator \
  --namespace tailscale --create-namespace \
  --set oauth.clientId=$TS_CLIENT_ID \
  --set oauth.clientSecret=$TS_CLIENT_SECRET

apiVersion: v1
kind: Service
metadata:
  name: grafana
  annotations:
    tailscale.com/expose: "true"
    tailscale.com/hostname: "grafana-prod"
spec:
  selector:
    app: grafana
  ports:
    - port: 3000

# Register the API server on your tailnet
tailscale.com/expose: "true"  # On the API server service

# Access from any device on the tailnet
kubectl --server=https://k8s-prod:6443 get pods

# Enable Tailscale SSH on a server
tailscale up --ssh

# SSH from any device on the tailnet
ssh user@100.64.0.2
# Or use the MagicDNS name
ssh user@prod-server

# Tag the database server
tailscale up --advertise-tags=tag:database

# ACL: only backend services can reach databases
{
  "action": "accept",
  "src": ["tag:backend"],
  "dst": ["tag:database:5432"]
}

# On a node in the target network
tailscale up --advertise-routes=10.0.0.0/24,192.168.1.0/24

# Approve in admin console
# Now all tailnet devices can reach 10.0.0.0/24