From 1d82c1b3d091fe130738454e7d5e8d967476218d Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Wed, 22 Jul 2026 12:42:40 +0000 Subject: [PATCH] gokrazy/tsapp: lock down breakglass access Point tsapp at the tailscale/breakglass fork, fetch SSH keys from EC2 IMDSv2, restrict to the sec-scan user and internal CIDRs, start on boot, and stop after 120s idle. Updates #1866 Signed-off-by: Kristoffer Dalby --- gokrazy/tsapp/config.json | 10 +++++++--- gokrazy/tsapp/gokrazydeps.go | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/gokrazy/tsapp/config.json b/gokrazy/tsapp/config.json index 10825b3c5..fbf87f0b1 100644 --- a/gokrazy/tsapp/config.json +++ b/gokrazy/tsapp/config.json @@ -11,16 +11,20 @@ ], "Packages": [ "github.com/gokrazy/serial-busybox", - "github.com/gokrazy/breakglass", + "github.com/tailscale/breakglass", "github.com/bradfitz/qemu-guest-kragent", "tailscale.com/cmd/fbstatus", "tailscale.com/cmd/tailscale", "tailscale.com/cmd/tailscaled" ], "PackageConfig": { - "github.com/gokrazy/breakglass": { + "github.com/tailscale/breakglass": { "CommandLineFlags": [ - "-authorized_keys=/perm/breakglass.authorized_keys" + "-authorized_keys=ec2", + "-allowed_user=aws-marketplace-sec-scan", + "-allowed_cidrs=10.0.0.0/16,10.2.0.0/16", + "-stop_after_idle=120s", + "-start_on_boot=true" ] }, "tailscale.com/cmd/tailscale": { diff --git a/gokrazy/tsapp/gokrazydeps.go b/gokrazy/tsapp/gokrazydeps.go index 60935b24f..477d5da0d 100644 --- a/gokrazy/tsapp/gokrazydeps.go +++ b/gokrazy/tsapp/gokrazydeps.go @@ -7,12 +7,12 @@ import ( _ "github.com/bradfitz/qemu-guest-kragent" - _ "github.com/gokrazy/breakglass" _ "github.com/gokrazy/gokrazy/cmd/dhcp" _ "github.com/gokrazy/gokrazy/cmd/ntp" _ "github.com/gokrazy/gokrazy/cmd/randomd" _ "github.com/gokrazy/kernel.amd64" _ "github.com/gokrazy/serial-busybox" + _ "github.com/tailscale/breakglass" _ "github.com/tailscale/ts-gokrazy/gokrazyinit" _ "tailscale.com/cmd/tailscale" _ "tailscale.com/cmd/tailscaled"