mirror/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2026-07-26 07:16:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

gokrazy/tsapp: lock down breakglass access

Browse Source 
Point tsapp at the tailscale/breakglass fork, fetch SSH keys from EC2
IMDSv2, restrict to the sec-scan user and internal CIDRs, start on
boot, and stop after 120s idle.

Updates #1866

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby
2026-07-22 12:42:40 +00:00
committed by Kristoffer Dalby
parent 745bb85072
commit 1d82c1b3d0
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
gokrazy/tsapp/config.json
View File

@@ -11,16 +11,20 @@
],
"Packages": [
"github.com/gokrazy/serial-busybox",
"github.com/gokrazy/breakglass",
"github.com/tailscale/breakglass",
"github.com/bradfitz/qemu-guest-kragent",
"tailscale.com/cmd/fbstatus",
"tailscale.com/cmd/tailscale",
"tailscale.com/cmd/tailscaled"
],
"PackageConfig": {
"github.com/gokrazy/breakglass": {
"github.com/tailscale/breakglass": {
"CommandLineFlags": [
"-authorized_keys=/perm/breakglass.authorized_keys"
"-authorized_keys=ec2",
"-allowed_user=aws-marketplace-sec-scan",
"-allowed_cidrs=10.0.0.0/16,10.2.0.0/16",
"-stop_after_idle=120s",
"-start_on_boot=true"
]
},
"tailscale.com/cmd/tailscale": {

2
gokrazy/tsapp/gokrazydeps.go
View File

@@ -7,12 +7,12 @@
import (
_ "github.com/bradfitz/qemu-guest-kragent"
_ "github.com/gokrazy/breakglass"
_ "github.com/gokrazy/gokrazy/cmd/dhcp"
_ "github.com/gokrazy/gokrazy/cmd/ntp"
_ "github.com/gokrazy/gokrazy/cmd/randomd"
_ "github.com/gokrazy/kernel.amd64"
_ "github.com/gokrazy/serial-busybox"
_ "github.com/tailscale/breakglass"
_ "github.com/tailscale/ts-gokrazy/gokrazyinit"
_ "tailscale.com/cmd/tailscale"
_ "tailscale.com/cmd/tailscaled"