Tailscale Policy Visualizer

Expands a Tailscale policy file so an ACL rule can be read without cross-referencing the rest of the file by eye. Policy files are HuJSON — JSON plus // and /* */ comments and trailing commas — and both are handled, so you can paste the file exactly as it is. Each rule is shown with its action, protocol, sources, and destinations; a group source is expanded to its members from the same file, a host destination is resolved to its address, and a destination is split into its host and port halves on the last colon, which is what keeps tag:prod:22 readable as tag:prod on port 22. Each rule also shows the posture conditions that gate it: its own srcPosture when it declares one, and the policy's top-level defaultSrcPosture otherwise, so a rule naming no posture is not unconditional in a policy that sets a default. An absent, null, or empty srcPosture all leave the rule without conditions of its own, so the default applies to all three. The postures block that defines those conditions is not evaluated here. What cannot be expanded is left alone rather than guessed: tag:, autogroup:, and svc: membership lives in the coordination server, not in the policy file, so those are labelled and shown as-is. A svc: reference is a Tailscale Service, which is a destination-only selector: this tool classifies it and reports it as invalid when a rule uses it as a source, but it never checks whether the service exists, is advertised, or is approved. An ipset: reference is checked against the file's own ipsets block, because that is where ipsets are declared, but its addresses are not expanded. Anything the file does not define — a mistyped group, a host that has no hosts entry, an ipset that no ipsets entry declares — is reported as an unresolved reference, since a typo there silently changes who a rule applies to. The review pass also reports tags used in rules but missing from tagOwners, groups no rule references, and groups with no members. Two boundaries: a policy that uses grants rather than acls is flagged and belongs in the grants matrix tool, and this tool never contacts a tailnet or an API, so it reflects the file only and not live device state. Your policy file stays in this page: it is not uploaded, stored, logged, or put in the URL.