<?xml version="1.0" encoding="utf-8"?>
<!--
  Alloy's copy of firewalld's `trusted` zone, which exists for one line: the
  interface binding at the bottom. A file here overrides the package's copy in
  /usr/lib/firewalld/zones/, so the rest of this is that file verbatim.

  WHY tailscale0 IS PINNED HERE. tailscaled writes its own nftables tables
  (ts-input, ts-forward, ts-postrouting) and has no firewalld awareness at all:
  zero matching strings in the 1.102.3 binary this image ships. Under nftables
  every base chain on a hook returns its own verdict, so firewalld dropping a
  packet in its table is final no matter what tailscale accepted in its own.

  That is measured, not reasoned: two tables in a network namespace, one with
  an accepting base chain at priority -100 and one with `policy drop` at
  priority 10, and the packet dies. Without this file, bringing firewalld up on
  a machine running tailscaled kills every inbound tailnet connection, and the
  whole tree is addressed by tailnet name.

  WHAT IT COSTS, stated because `trusted` means what it says: anything reaching
  this machine over the tailnet is accepted, on any port, including ports the
  default zone refuses from the LAN. That is not a new position. Tailscale SSH
  already bypasses authorized_keys on these hosts, so the tailnet ACL has been
  the access control here for as long as the tailnet has existed. If that ever
  stops being true, this file is where the change goes.

  The binding is declarative rather than a `firewall-cmd` at first boot: a
  command that has to run is a command that can fail to run, and on a headless
  box its failure is invisible until someone cannot reach it.

  tailscaled is disabled by default (etc/systemd/system-preset/50-alloy.preset).
  An interface that does not exist binds nothing, so this file is inert until
  someone turns the mesh on, which is the point at which it has to already be
  correct.
-->
<zone target="ACCEPT">
  <short>Trusted</short>
  <description>All network connections are accepted.</description>
  <forward/>
  <interface name="tailscale0"/>
</zone>
