// Headscale ACLs for LLMHosts Hive Mode (Phase 3)
// Tailscale ACL format: https://tailscale.com/kb/1018/acls/
//
// Per-Hive isolation: LLMHosts generates this file via generate_acl_policy() and
// sync_headscale_acls() when HEADSCALE_ACL_PATH points at this file. One group per
// Hive (group:hive-<id>), accept only same-Hive traffic; no cross-Hive. Set
// HEADSCALE_ACL_PATH in the environment of the process that runs `llmhost hive create|join|leave`
// so this path is written after each change. Reload Headscale after file changes
// (e.g. systemctl reload headscale). Headscale v0.22 has no policy REST API (file-based only).
//
// Fallback below: allow-all. Replace with generated content or run llmhost with
// HEADSCALE_ACL_PATH set to this file.
{
  "groups": {},
  "tagOwners": {},
  "acls": [
    {
      "action": "accept",
      "src": ["*"],
      "dst": ["*:*"]
    }
  ]
}
