`Create ACL policies file` wrote this, verbatim, to /etc/headscale/acl.json:
content: |
{}
An empty policy. The real rules - who may reach which host on which port -
were maintained by hand on spacey and existed nowhere else. So the repo and
the box disagreed about the single file that governs every machine's access
to every other machine, and the repo's version was "nothing is allowed".
It had already fired once. /etc/headscale/acl.json.937464.2026-09-12@14:03:08~
is Ansible's own backup of a 1596-byte policy it replaced with {} on 12 Sep;
the live file is dated 17 Sep, so somebody rebuilt it by hand afterwards
without the playbook ever being corrected. Every subsequent `site.yml` run was
one command away from flattening the whole tailnet's access rules again.
This commit changes nothing on spacey. The policy now lives in
templates/acl.json.j2, captured verbatim from the live file, and the task is a
`template:` instead of an inline `{}`. Rendering it produces sha256
1ed14e7247d957db5e9f8d4f4c53846dc646131ad900054c868483a9a84ed8fd, byte for byte
the file that was already there - verified before applying, and again after.
Three deliberate choices:
- A template file, not the inline `content:` used elsewhere in this playbook.
The whole failure was three invisible characters passing review; a 2KB
policy needs to show up as a diff.
- `validate: python3 -m json.tool %s`. headscale refuses to load a malformed
policy, and a policy it will not load is the same outage as an empty one.
- `"counter-net@"` is now `"{{ headscale_namespace }}@"`, which is already a
fact in group_vars/all/main.yml rather than a fourteenth hand-typed copy.
The header comment records why a node with no ACL rule is INVISIBLE rather than
merely unreachable - it never appears in `tailscale status`, MagicDNS does not
resolve it, and the symptom is a downstream "no such host" that looks like a
DNS problem. That cost an hour today.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
counterweight
df4f712a93
