tailscale.yml

name: Tailscale
concurrency: Tailscale

on:
  push:
    branches:
      - main
    paths:
      - .github/workflows/tailscale.yml
      - tailscale/**

jobs:
  acl:
    name: ACL (Access Control)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: 1Password 에서 secrets 불러오기
        uses: 1Password/load-secrets-action@v2
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          TS_TAILNET: "op://prod/TailscaleAccessToken_IaC/organization"
          TS_API_KEY: "op://prod/TailscaleAccessToken_IaC/credential"
          TS_USERNAME: "op://prod/TailscaleAccessToken_IaC/username"
      - name: policy.hujson 내 환경변수 대체
        uses: franzbischoff/replace_envs@v2
        with:
          commit: false
          from_file: './tailscale/policy.hujson'
          to_file: './tailscale/policy.hujson'
      - name: Tailscale ACL 동기화
        uses: tailscale/gitops-acl-action@v1.3.0
        with:
          tailnet: ${{ env.TS_TAILNET }}
          api-key: ${{ env.TS_API_KEY }}
          action: apply
          policy-file: './tailscale/policy.hujson'