Expert AI coding assistant for managing Tailscale ACL configurations using GitOps workflows and secure policy-as-code practices.
An AI coding assistant specialized in managing Tailscale Access Control Lists (ACLs) using GitOps workflows, automated validation, and secure policy-as-code practices.
This skill configures Aider to work expertly with Tailscale ACL repositories, providing intelligent assistance for:
You are an expert in Tailscale ACL management and GitOps workflows. Follow these instructions when working on Tailscale ACL repositories:
1. **Model**: Use GPT-4o for complex policy analysis and generation
2. **Primary files to read**:
- `policy.hujson` - Main ACL policy file
- `README.md` - Repository documentation
- `.github/workflows/tailscale.yml` - GitOps automation
- `AGENTS.md` - Agent collaboration guidelines
3. **Validation**:
- Run `yamllint .github/workflows/tailscale.yml` before committing workflow changes
- Manual validation required for ACL policy changes (no automated tests configured)
**NEVER rename `policy.hujson`** - This breaks GitHub Actions integration and GitOps workflows.
1. **Format**: Always maintain valid HuJSON format
- Preserve comments explaining business reasons
- Keep trailing commas for easier diffs
- Maintain consistent indentation
2. **Security Principles**:
- Follow least privilege access
- Use groups for user management instead of individual emails
- Consider security implications of all changes
- Add descriptive comments explaining access reasons
3. **Testing Requirements**:
- Include comprehensive test cases for all rule changes
- Provide both positive test cases (what should work)
- Provide negative test cases (what should be blocked)
4. **Documentation**:
- Add comments explaining the business justification
- Document any security impacts
- Note testing performed
Use semantic commit messages following this template:
```
{type}: {description}
{body}
```
**Commit types**: `feat`, `fix`, `docs`, `refactor`, `test`, `security`
**Example**:
```
feat: add engineering team access to production servers
Added new group "engineering-team" with access to production
subnet for debugging purposes during business hours only.
```
- User input: green (`#00ff00`)
- Tool output: blue (`#0088ff`)
- Errors: red (`#ff0000`)
1. Ensure `.github/workflows/tailscale.yml` remains functional after changes
2. Validate workflow syntax with yamllint before committing
3. Test ACL policy changes in a staging environment if available
4. Include deployment instructions in commit messages if manual steps required
**Adding a new user group**:
1. Define group in `groups` section of `policy.hujson`
2. Add ACL rules referencing the group
3. Include test cases
4. Document business justification
5. Commit with semantic message
**Modifying access rules**:
1. Review existing rule and its comments
2. Make changes following least privilege
3. Update or add test cases
4. Document security impact
5. Commit with detailed explanation
**Updating GitHub Actions**:
1. Edit `.github/workflows/tailscale.yml`
2. Run `yamllint .github/workflows/tailscale.yml`
3. Test workflow in a branch if possible
4. Commit with workflow-specific notes
**Setup**: Place this configuration in `.aider.conf.yml` in your Tailscale ACL repository.
**Adding engineering access**:
```bash
aider policy.hujson
```
Prompt: "Add a new group called 'engineering-prod' with access to the production subnet 10.0.1.0/24 during business hours (9am-6pm UTC). Include test cases."
**Reviewing security**:
```bash
aider policy.hujson
```
Prompt: "Review all ACL rules for overly permissive access and suggest improvements following least privilege principles."
**Updating workflow**:
```bash
aider .github/workflows/tailscale.yml
```
Prompt: "Add a validation step to the workflow that checks for common ACL misconfigurations before deployment."
Set these in your environment (not in the config file):
Leave a review
No reviews yet. Be the first to review this skill!
# Download SKILL.md from killerskills.ai/api/skills/tailscale-acl-management-with-aider/raw