infrastructure/ansible/roles/headscale/files/acls.json

{
    "tagOwners": {
        "tag:client": [],
        "tag:private-svcs": []

    },
    "acls": [
        {
            "action": "accept",
            "src": ["tag:client"],
            "dst": ["*:*"]
        },
        {
            "action": "accept",
            "src": ["tag:private-svcs"],
            "dst": ["{{ vps_hosts.private_ipv6_marker }}:80,443"]
        }
    ]
}