pal-e-docs

Review: Change Tailscale SSH ACL from "check" to "accept"

review-802-2026-04-04 Doc

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Standalone, discovered during SSH debugging session (2026-04-04)
  • [x] Repo — forgejo_admin/pal-e-platform
  • [x] User Story — "As an admin using Termius on my iPhone, I want direct SSH access..."
  • [x] Context — detailed explanation of check vs accept behavior, iptables chain analysis
  • [x] File Targets — specific file with line number, plus explicit do-not-touch list
  • [x] Acceptance Criteria — 4 testable criteria
  • [x] Test Expectations — 3 concrete expectations with commands
  • [x] Constraints — tofu fmt, plan output, lock=false, no refactor
  • [x] Checklist — present
  • [x] Related — project page and SOP referenced

Traceability

  • [x] story:superuser-remote-access — "I can SSH into the platform from any device (phone, laptop, tablet) using any standard SSH client without browser-based approval gates."
  • [x] story note verified — found in project-pal-e-platform user-stories table (row 5)
  • [x] arch:networking label — networking component
  • [ ] arch note MISSING — [SCOPE] Create architecture note arch-networking for the Tailscale ACL/networking component
  • [x] Forgejo issue — forgejo_admin/pal-e-platform#262, open

File Targets

  • [x] terraform/modules/networking/main.tf:75 — verified: action = "check" exists at line 75 inside the ssh block (lines 73-80), exactly as described in the issue
Targets are specific enough for an agent to act on without guessing. The do-not-touch list prevents scope creep.

Repo Placement

Correct. Issue filed on forgejo_admin/pal-e-platform, file target is in this repo. Single-repo change, no cross-repo concerns.

Dependencies

No dependencies found. No in_progress or todo items touch networking or SSH ACLs. Related completed items (#400 nftables, #394 Tailscale connector, #447 hairpin elimination) are all independent of this change.

Acceptance Criteria

  • [x] tofu plan shows only the ACL policy update — automatable, specific
  • [x] tailscale debug netmap SSH policy shows accept — requires post-apply, but clearly testable
  • [x] SSH from iPhone Termius succeeds without browser approval — manual verification, clearly scoped
  • [x] SSH from MacBook continues to work — regression check, clearly scoped
All criteria are testable. No ambiguous language.

Blast Radius

Grep confirms action = "check" appears only once in the entire codebase (line 75 of the target file). The change affects only the SSH ACL rule — grants, nodeAttrs, tagOwners, and funnel definitions are untouched. Worst case: SSH access for tailnet members bypasses browser approval, but this is the intended behavior and is safe because autogroup:member to autogroup:self limits connections to authenticated tailnet members reaching their own devices only. Rollback is a 1-line revert.

Decomposition Assessment

1 file target, 1-line change, 4 acceptance criteria. Well within the three-thing limit and five-minute rule. No independent subtasks to parallelize. No decomposition needed.

Recommendation

  • [SCOPE] Create architecture note arch-networking for the Tailscale ACL/networking component in pal-e-docs. This completes the traceability triangle but does not block execution.