Aperture by Tailscale configuration

{
  "providers": {
    "anthropic": {
      "baseurl": "https://api.anthropic.com",
      "apikey": "YOUR_ANTHROPIC_API_KEY",
      "models": [
        "claude-sonnet-4-5",
        "claude-opus-4-5",
      ],
      "authorization": "x-api-key",
      "compatibility": {
        "anthropic_messages": true,
      }
    }
  }
}

{
    // The grants section uses the Tailscale ACL grant structure.
    "grants": [
        // Grant admin access (permission to see the settings and all other
        // users in the dashboard).
        {
            "src": [
                // Explicitly identify certain users by their Tailscale login.
                "example-user@example.com",

                // Grant admin access to everyone by default.
                // Remove this after you've configured explicit admin
                // access for yourself.
                // BE CAREFUL! If you remove this without granting explicit
                // admin access to yourself, you'll lose your ability
                // to edit this file.
                "*",
            ],
            "app": {
                "tailscale.com/cap/aperture": [
                    { "role": "admin" },
                ],
            },
        },

        // Every user who can access Aperture gets at least user-level access.
        // Remove this and Aperture denies access entirely by default.
        // Admin access in a separate grant takes precedence over this section.
        {
            "src": ["*"],
            "app": {
                "tailscale.com/cap/aperture": [
                    { "role": "user" },
                ],
            },
        },

        // Default: allow all users to access all models from all providers.
        // Without this grant, users can't access any models (deny by default).
        {
            "src": ["*"],
            "app": {
                "tailscale.com/cap/aperture": [
                    { "models": "**" },
                ],
            },
        },

        // This example hook sends traffic to Oso if it matches certain
        // parameters. Configure Oso in the "hooks" section for this to work.
        {
            "src": [
                // No users by default. Try "*" to capture everyone's traffic.
            ],
            "app": {
                "tailscale.com/cap/aperture": [
                    {
                        "send_hooks": [
                            {
                                "name": "oso",
                                // Capturing only tool calls
                                "events": ["tool_call_entire_request"],
                                "send": ["user_message", "tools", "request_body", "response_body"],
                            },
                        ],
                    },
                ],
            },
        },
    ],

    // Configure your LLM backends here.
    // Fill your API keys in below to share these providers with your team.
    // There's no limit to the number of providers you can configure.
    "providers": {
        "openai": {
            "baseurl": "https://api.openai.com",
            "name": "OpenAI",
            "apikey": "YOUR_OPENAI_API_KEY",
            "models": [
                "gpt-5",
                "gpt-5-mini",
                "gpt-5-nano",
                "gpt-4.1",
                "gpt-4.1-nano",
                "gpt-5.1-codex",
                "gpt-5.1-codex-max",
            ],
            "compatibility": {
                "openai_chat": true,
                "openai_responses": true,
                "anthropic_messages": false,
            },
        },
        "anthropic": {
            "baseurl": "https://api.anthropic.com",
            "name": "Anthropic",
            "apikey": "YOUR_ANTHROPIC_API_KEY",
            "models": [
                "claude-sonnet-4-5",
                "claude-sonnet-4-5-20250929",
                "claude-haiku-4-5",
                "claude-haiku-4-5-20251001",
                "claude-opus-4-5",
                "claude-opus-4-5-20251101",
            ],
            "compatibility": {
                "openai_chat": false,
                "openai_responses": false,
                "anthropic_messages": true,
            },
        },
    },

    // Hooks are configured API endpoints that Aperture calls under certain
    // conditions. The conditions themselves are configured in the
    // "grants" section.
    "hooks": {
        "oso": {
            "url":    "https://api.osohq.com/api/agents/v1/model-request",
            "apikey": "YOUR_OSO_API_KEY",
        },
    },
}

{
  "providers": {
    "openai": { ... },
    "anthropic": { ... },
    "private": { ... }
  }
}

"grants": [
  {
    "src": ["*"],               // who this grant applies to
    "app": {
      "tailscale.com/cap/aperture": [
        // array of individual capabilities
        { "models": "**" },     // allow access to all models
      ],
    },
  },
]

{ "role": "admin" }   // full admin access
{ "role": "user" }    // standard user access

{
  "mcp_tools": "local/*",       // tools from the "local" MCP server
  "mcp_resources": "**",        // all resources from all servers
  "mcp_templates": "remote/*",  // templates from "remote" server
}

{
  "src": ["admin@example.com"],
  "app": {
    "tailscale.com/cap/aperture": [
      { "role": "admin" },
      { "models": "**" },
    ],
    // Custom capability — forwarded to hooks via "grants" send type
    "mycompany.com/cap/policy": [
      { "tier": "enterprise", "department": "engineering" },
    ],
  },
},

// In the tailnet policy file (not the Aperture config):
"grants": [
  {
    "src": ["group:engineering"],
    "dst": ["tag:aperture"],
    "app": {
      "tailscale.com/cap/aperture": [
        { "models": "**" },
        { "role": "user" },
      ],
    },
  },
  {
    "src": ["group:ml-team"],
    "dst": ["tag:aperture"],
    "app": {
      "tailscale.com/cap/aperture": [
        { "models": "**" },
        { "role": "admin" },
      ],
    },
  },
]

"quotas": {
  // Per-user daily budget: refills $5/day, can burst up to $10
  "daily:<user>": {
    "capacity": "$10.00",
    "rate": "$5.00/day",
    "on_exceed": "reject",
  },

  // Shared pool across all users who reference it
  "eng-team-pool": {
    "capacity": "$100.00",
    "rate": "$100.00/day",
    "on_exceed": "reject",
  },

  // Per-user limit for expensive models
  "opus:<user>": {
    "capacity": "$5.00",
    "rate": "$2.50/day",
    "on_exceed": "reject",
  },
}

"grants": [
  {
    "src": ["*"],
    "app": {
      "tailscale.com/cap/aperture": [
        {
          "models": "**",
          "quotas": [
            {"bucket": "daily:<user>"},
            {"bucket": "eng-team-pool"},
          ],
        },
      ],
    },
  },
]

"quotas": {
  "daily:<user>": {
    "capacity": "$10.00",
    "rate": "$5.00/day",
    "on_exceed": "reject",
  },
},
"grants": [
  {
    "src": ["*"],
    "app": {
      "tailscale.com/cap/aperture": [
        { "role": "user" },
        { "models": "**",
          "quotas": [{"bucket": "daily:<user>"}] },
      ],
    },
  },
]

"quotas": {
  "opus:<user>": {
    "capacity": "$5.00",
    "rate": "$2.50/day",
    "on_exceed": "reject",
  },
},
"grants": [
  {
    "src": ["*"],
    "app": {
      "tailscale.com/cap/aperture": [
        // General access — no quota
        { "models": "**" },
        // Additional quota for Opus models only
        {
          "models": "*/claude-opus*",
          "quotas": [{"bucket": "opus:<user>"}],
        },
      ],
    },
  },
]

"quotas": {
  "daily:<user>": {
    "capacity": "$10.00",
    "rate": "$5.00/day",
    "on_exceed": "reject",
  },
  "team-pool": {
    "capacity": "$200.00",
    "rate": "$200.00/day",
    "on_exceed": "reject",
  },
},
"grants": [
  {
    "src": ["*"],
    "app": {
      "tailscale.com/cap/aperture": [
        { "role": "user" },
        {
          "models": "**",
          "quotas": [
            {"bucket": "daily:<user>"},
            {"bucket": "team-pool"},
          ],
        },
      ],
    },
  },
]

{
  "hooks": {
    "oso": {
      "url": "https://api.osohq.com/api/agents/v1/model-request",
      "apikey": "YOUR_OSO_API_KEY",
      "timeout": "10s"
    },
    "my-webhook": {
      "url": "https://example.com/webhook",
      "apikey": "YOUR_API_KEY"
    }
  }
}

{
  "grants": [
    {
      "src": ["*"],
      "app": {
        "tailscale.com/cap/aperture": [
          {
            "models": "**",
            "send_hooks": [
              {
                "name": "oso",
                "events": ["tool_call_entire_request"],
                "send": ["tools", "user_message", "request_body", "response_body"],
              },
            ],
          },
        ],
      },
    },
  ]
}

{
  "models": "**",
  "send_hooks": [
    {
      "name": "audit",
      "events": ["tool_call_entire_request"],
      "send": ["tools", "estimated_cost"],
    },
  ],
}

{
  "metadata": {
    "login_name": "user@example.com",
    "...": "...",
    "estimated_cost": {
      "dollars": 0.0342,
      "cost_basis": "anthropic/claude-sonnet-4-5",
      "usage": {
        "input_tokens": 1500,
        "output_tokens": 800,
        "cached_tokens": 200,
        "reasoning_tokens": 0
      }
    }
  },
  "tool_calls": [...]
}

{
  "src": ["alice@example.com"],
  "app": {
    "tailscale.com/cap/aperture": [
      { "models": "**" },
      {
        "send_hooks": [
          {
            "name": "policy-engine",
            "events": ["entire_request"],
            "send": ["estimated_cost", "grants"],
          },
        ],
      },
    ],
    "mycompany.com/cap/policy": [
      {"tier": "enterprise", "max_context": 200000},
    ],
  },
}

{
  "metadata": {
    "login_name": "alice@example.com",
    "...": "...",
    "grants": {
      "mycompany.com/cap/policy": [
        {"tier": "enterprise", "max_context": 200000}
      ]
    },
    "estimated_cost": { "..." }
  }
}

"send": ["tools", "quotas"]

{
  "metadata": {
    "login_name": "alice@example.com",
    "...": "...",
    "quotas": {
      "daily:alice@example.com": {
        "current": 7250000000,
        "capacity": 10000000000,
        "rate": "$5.00/day"
      }
    }
  }
}

{
  "metadata": {
    "login_name": "user@example.com",
    "user_agent": "curl/8.0",
    "url": "/v1/chat/completions",
    "model": "gpt-5",
    "provider": "openai",
    "tailnet_name": "example.com",
    "stable_node_id": "n12345",
    "request_id": "abc123",
    "session_id": "oacc_1a2b3c4d5e6f7890"
  }
}

{
  "grants": [
    {
      "src": ["developer@company.com"],
      "app": {
        "tailscale.com/cap/aperture": [
          {
            "models": "anthropic/**",
            "send_hooks": [
              {
                "name": "my-webhook",
                "events": ["tool_call_entire_request"],
                "send": ["tools", "user_message", "estimated_cost"],
              },
            ],
          },
          {
            "models": "openai/**",
            "send_hooks": [
              {
                "name": "my-webhook",
                "events": ["tool_call_entire_request"],
                "send": ["tools", "user_message", "estimated_cost"],
              },
            ],
          },
        ],
      },
    },
  ]
}

{
  "exporters": {
    "s3": {
      "endpoint": "https://your-s3-compatible-endpoint.url",
      "bucket_name": "aperture-exports",
      "region": "us-east-1",
      "prefix": "prod",
      "access_key_id": "YOUR_AWS_KEY",
      "access_secret": "YOUR_AWS_SECRET",
      "every": 3600,
      "limit": 1000
    }
  }
}

{
  "mcp": {
    "accept_registrations": true,
    "servers": {
      "local": {
        "url": "http://localhost:8185/v1/mcp"
      },
      "remote": {
        "url": "http://mcp-server.example.ts.net:8080/v1/mcp"
      }
    }
  }
}

{
  // Access control: who can use which models
  "grants": [
    // All users: access all models with per-user and org-wide quotas
    {
      "src": ["*"],
      "app": {
        "tailscale.com/cap/aperture": [
          { "role": "user" },
          {
            "models": "**",
            "quotas": [
              {"bucket": "daily:<user>"},
              {"bucket": "org-monthly"},
            ],
          },
        ],
      },
    },
    // Admin access for specific user with audit hook
    {
      "src": ["admin@company.com"],
      "app": {
        "tailscale.com/cap/aperture": [
          { "role": "admin" },
          {
            "models": "**",
            "send_hooks": [
              {
                "name": "oso",
                "events": ["tool_call_entire_request"],
                "send": ["tools", "estimated_cost"],
              },
            ],
          },
        ],
      },
    },
  ],

  // Dollar-based spending limits
  "quotas": {
    "daily:<user>": {
      "capacity": "$10.00",
      "rate": "$5.00/day",
      "on_exceed": "reject",
    },
    "org-monthly": {
      "capacity": "$2000.00",
      "rate": "$2000.00/month",
      "on_exceed": "reject",
    },
  },

  // LLM session log export configuration
  "exporters": {
    "s3": {
      // Required for S3-compatible services (GCS, MinIO, Backblaze B2, and others)
      "endpoint": "https://your-s3-compatible-endpoint.url",
      "bucket_name": "aperture-exports",
      "region": "us-west-2",
      "prefix": "prod",
      "access_key_id": "YOUR_AWS_KEY",
      "access_secret": "YOUR_AWS_SECRET",
      "every": 3600,
      "limit": 1000
    }
  },

  // LLM providers
  "providers": {
    "openai": {
      "baseurl": "https://api.openai.com/",
      "apikey": "YOUR_OPENAI_KEY",
      "models": ["gpt-5", "gpt-5-mini", "gpt-4.1"],
      "name": "OpenAI",
      "description": "OpenAI models for coding and chat",
      "compatibility": {
        "openai_chat": true,
        "openai_responses": true
      }
    },
    "anthropic": {
      "baseurl": "https://api.anthropic.com",
      "apikey": "YOUR_PROXY_ANTHROPIC_KEY",
      "authorization": "x-api-key",
      "models": ["claude-sonnet-4-5", "claude-haiku-4-5", "claude-opus-4-5"],
      "name": "Anthropic",
      "compatibility": {
        "openai_chat": false,
        "anthropic_messages": true
      }
    },
    "gemini": {
      "baseurl": "https://generativelanguage.googleapis.com",
      "apikey": "YOUR_PROXY_GEMINI_KEY",
      "authorization": "x-goog-api-key",
      "models": ["gemini-2.5-flash", "gemini-2.5-pro"],
      "name": "Google Gemini",
      "compatibility": {
        "openai_chat": false,
        "gemini_generate_content": true
      }
    },
    "private": {
      "baseurl": "YOUR_PRIVATE_LLM_URL",
      "models": ["qwen3-coder-30b"]
    }
  },

  // Hooks for external integrations
  "hooks": {
    "oso": {
      "url": "https://api.osohq.com/api/agents/v1/model-request",
      "apikey": "YOUR_OSO_API_KEY",
    },
  },

  // MCP server proxying
  "mcp": {
    "accept_registrations": true,
    "servers": {
      "tools": {
        "url": "http://mcp-tools.example.ts.net:8080/v1/mcp",
      },
    },
  },
}