tailscale/gitops-acl-action — explained in plain English
Analysis updated 2026-07-25 · repo last pushed 2026-07-20
Manage who can access which servers in your Tailscale network by editing a file in GitHub instead of a dashboard.
Require team review before network access changes go live, catching mistakes before they affect production.
Grant a new contractor access to specific servers by opening a pull request and merging once approved.
| tailscale/gitops-acl-action | adguardteam/adguardmv3 | awslabs/loom | |
|---|---|---|---|
| Stars | 146 | 146 | 146 |
| Language | — | TypeScript | Python |
| Last pushed | 2026-07-20 | 2024-07-12 | — |
| Maintenance | Active | Dormant | — |
| Setup difficulty | moderate | moderate | hard |
| Complexity | 2/5 | 3/5 | 5/5 |
| Audience | ops devops | developer | ops devops |
Figures from each repo's GitHub metadata at analysis time.
Requires a Tailscale account with API access and choosing an authentication method, API keys expire after 90 days so OAuth or federated identity is recommended for long-term use.
Tailscale gitops-acl-action lets you manage your Tailscale network's access rules through a GitHub repository instead of a web dashboard. Tailscale is a tool that connects your devices into a private network, and it uses a policy file to control which devices and users can talk to each other. This action automatically syncs that policy file whenever you push changes to GitHub. The setup involves storing your policy file in a repo and configuring GitHub Actions to run on every push and pull request. When you open a pull request, the action runs in "test" mode, checking your changes for errors without actually applying them. When you merge to your main branch, it runs in "apply" mode, validating and then pushing the updated rules to your live Tailscale network. You authenticate using either an API key, an OAuth client, or a federated identity. This is useful for teams that want to treat their network configuration like code. Instead of one person clicking around a dashboard to change who can access what, changes go through the normal pull request workflow: someone proposes a change, a teammate reviews it, and automated checks catch mistakes before anything goes live. For example, if you want to grant a new contractor access to specific servers, you'd edit the policy file, open a PR, and merge it once approved. The project supports all three of Tailscale's authentication methods, though the README notes that API keys expire after 90 days and recommends using OAuth clients or federated identities for long-term setups. The federated identity approach is shown as the preferred option in the provided example, leveraging GitHub's built-in token system so you don't have to manage rotating credentials manually.
A GitHub Action that manages your Tailscale network access rules through code. Push changes to GitHub and they automatically sync to your live network after review.
Active — commit in last 30 days (last push 2026-07-20).
No license information is provided in the explanation, so the permissions for this project are unknown.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly ops devops.
This repo across BitVibe Labs
double-check against the repo, no cap.