tailnet-policy

Overview

Headscale uses Tailscale-compatible policy files written in huJSON (Human JSON — standard JSON with trailing commas and // comments). Policy files control:

• ACLs (deprecated legacy syntax) — {action, users, ports} rules
• Grants (modern syntax) — {src, dst, ip, proto, via} rules
• Tags — Node identity tags (tag:dev, tag:prod)
• TagOwners — Which users/groups can apply which tags
• AutoApprovers — Auto-approval for subnet routers and exit nodes
• Tailscale SSH — SSH access rules via ssh.users and ssh.action

ACLs vs Grants