headscale/hscontrol/policy/v2/testdata/acl_results/ACL-ERR09.hujson

// ACL-ERR09
//
// ACLs:
//   accept: src=['*'] dst=['autogroup:self:*']
//   accept: src=['autogroup:tagged'] dst=['autogroup:self:22']
//
// Expected: Error — autogroup:self can only be used with users, groups, or supported autogroups
{
  "test_id": "ACL-ERR09",
  "timestamp": "2026-03-17T14:28:39Z",
  "error": true,
  "input": {
    "policy_file": "acl_policies/acl_err09.json",
    "full_policy": {
      "groups": {
        "group:admins": ["kratail2tid@passkey"],
        "group:developers": ["kristoffer@dalby.cc", "kratail2tid@passkey"],
        "group:monitors": ["monitorpasskeykradalby@passkey"],
        "group:empty": []
      },
      "tagOwners": {
        "tag:server": ["kratail2tid@passkey"],
        "tag:prod": ["kratail2tid@passkey"],
        "tag:client": ["kratail2tid@passkey"],
        "tag:router": ["kratail2tid@passkey"],
        "tag:exit": ["kratail2tid@passkey"]
      },
      "hosts": {
        "webserver": "100.108.74.26",
        "prodbox": "100.103.8.15",
        "internal": "10.0.0.0/8",
        "subnet24": "192.168.1.0/24"
      },
      "autoApprovers": {
        "routes": {
          "10.33.0.0/16": ["tag:router"],
          "0.0.0.0/0": ["tag:exit"],
          "::/0": ["tag:exit"]
        }
      },
      "acls": [
        {
          "action": "accept",
          "src": ["*"],
          "dst": ["autogroup:self:*"]
        },
        {
          "action": "accept",
          "src": ["autogroup:tagged"],
          "dst": ["autogroup:self:22"]
        }
      ]
    },
    "api_endpoint": "https://api.tailscale.com/api/v2/tailnet/kratail2tid%40passkey/acl",
    "api_response_code": 400,
    "api_response_body": { "message": "autogroup:self can only be used with users, groups, or supported autogroups" }
  }
}