policy.jsonc

{
  "groups": {
    "group:root": ["ark@passkey"]
  },

  "tagOwners": {
    "tag:server":    ["group:root"],
    "tag:device":    ["group:root"],
    "tag:container": ["group:root"],

    "tag:exit-node":      ["group:root"],
    "tag:exit-node-user": ["group:root"],

    "tag:taildrive-server": ["group:root"],
    "tag:taildrive-client": ["group:root"],

    "tag:tailscale-ssh-server": ["group:root"],
    "tag:tailscale-ssh-client": ["group:root"],

    "tag:rdp-server": ["group:root"],
    "tag:rdp-client": ["group:root"],

    "tag:adb-daemon": ["group:root"],
    "tag:adb-server": ["group:root"],
    "tag:adb-client": ["group:root"],

    "tag:funnel-server": ["group:root"],

    "tag:dns-server": ["group:root"],
    "tag:dns-client": ["group:root"],
    "tag:doh-client": ["group:root"],
    "tag:dot-client": ["group:root"],
  },

  "hosts": {
    "arkg15.perch-map.ts.net":      "fd7a:115c:a1e0::cafe:babe",
    "arklab.perch-map.ts.net":      "fd7a:115c:a1e0::dead:beef",
    "arklab-wsl.perch-map.ts.net":  "fd7a:115c:a1e0::face:feed",
  },

  "acls": [ /* see below */ ],
  
  "ssh":  [ /* see below */ ],
  
  "nodeAttrs": [
    /* drive and funnel caps */
  ],
  
  "grants": [
    /* web UI & drive grants */
  ]
}