fix: set default ACL and IAM policy if not provided

internal/domain/acl.go

@@ -47,6 +47,18 @@ type SSHRule struct {
 	Users  []string `json:"users"`
 }
 
+func DefaultACLPolicy() ACLPolicy {
+	return ACLPolicy{
+		ACLs: []ACL{
+			{
+				Action: "accept",
+				Src:    []string{"*"},
+				Dst:    []string{"*:*"},
+			},
+		},
+	}
+}
+
 func (a ACLPolicy) FindAutoApprovedIPs(routableIPs []netip.Prefix, tags []string, u *User) []netip.Prefix {
 	if a.AutoApprovers == nil || len(routableIPs) == 0 {
 		return nil

internal/service/tailnet.go

@@ -59,12 +59,16 @@ func (s *Service) CreateTailnet(ctx context.Context, req *connect.Request[api.Cr
 		if err := mapping.CopyViaJson(req.Msg.IamPolicy, &tailnet.IAMPolicy); err != nil {
 			return nil, errors.Wrap(err, 0)
 		}
+	} else {
+		tailnet.IAMPolicy = domain.DefaultIAMPolicy()
 	}
 
 	if req.Msg.AclPolicy != nil {
 		if err := mapping.CopyViaJson(req.Msg.AclPolicy, &tailnet.ACLPolicy); err != nil {
 			return nil, errors.Wrap(err, 0)
 		}
+	} else {
+		tailnet.ACLPolicy = domain.DefaultACLPolicy()
 	}
 
 	if err := s.repository.SaveTailnet(ctx, tailnet); err != nil {