3583 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Florian Preinstorfer	c04e17d82e	Document valid log levels ... Also change the order as the level seems more important than the format.	2025-07-22 14:56:45 +02:00
Florian Preinstorfer	98fc0563ac	Bump version in docs	2025-07-22 14:56:45 +02:00
Kian-Meng Ang	3123d5286b	Fix typos ... Found via `codespell -L shs,hastable,userr`	2025-07-21 12:06:07 +02:00
Kristoffer Dalby	7fce5065c4	all: remove 32 bit support (#2692)	2025-07-16 13:32:59 +02:00
Florian Preinstorfer	a98d9bd05f	The preauthkeys commands expect a user id instead of a username	2025-07-16 09:53:05 +02:00
Florian Preinstorfer	46c59a3fff	Fix command in bug report template	2025-07-15 21:12:32 +02:00
Kristoffer Dalby	044193bf34	integration: Use Eventually around external calls (#2685)	2025-07-13 17:37:11 +02:00
Mohammad Javad Naderi	a8f2eebf66	Fix config param name in TLS doc	2025-07-13 12:56:25 +02:00
github-actions[bot]	6220e64978	flake.lock: Update (#2669)	2025-07-13 06:36:04 +00:00
Kristoffer Dalby	c6d7b512bd	integration: replace time.Sleep with assert.EventuallyWithT (#2680)	2025-07-10 23:38:55 +02:00
Kristoffer Dalby	b904276f2b	poll: use nodeview everywhere ... There was a bug in HA subnet router handover where we used stale node data from the longpoll session that we handed to Connect. This meant that we got some odd behaviour where routes would not be deactivated correctly. This commit changes to the nodeview is used through out, and we load the current node to be updated in the write path and then handle it all there to be consistent. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-08 21:05:15 +02:00
Kristoffer Dalby	4a8d2d9ed3	.github/workflows: reduce integration retry to 3 ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-08 07:28:35 +01:00
Kristoffer Dalby	22e6094a90	golangci: disable varnamelen ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-07 21:28:59 +01:00
Kristoffer Dalby	73023c2ec3	all: use immutable node view in read path ... This commit changes most of our (*)types.Node to types.NodeView, which is a readonly version of the underlying node ensuring that there is no mutations happening in the read path. Based on the migration, there didnt seem to be any, but the idea here is to prevent it in the future and simplify other new implementations. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-07 21:28:59 +01:00
Kristoffer Dalby	5ba7120418	.github/workflows: prettier ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-07 15:48:38 +01:00
Kristoffer Dalby	d311d2e206	flake: dont override gopls ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-07 15:48:38 +01:00
Kristoffer Dalby	05996a5048	.github/workflow: only run a few selected postgres tests ... We are already being punished by github actions, there seem to be little value in running all the tests for both databases, so only run a few key tests to check postgres isnt broken. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-07 15:48:38 +01:00
Kristoffer Dalby	4668e5dd96	changelog: add entry for db ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-07 15:48:38 +01:00
Kristoffer Dalby	c6736dd6d6	db: add sqlite "source of truth" schema ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-07-07 15:48:38 +01:00
Stavros Kois	855c48aec2	remove unneeded check (#2658)	2025-07-04 15:47:01 +00:00
Stavros Kois	ded049b905	don't crash if config file is missing (#2656)	2025-07-04 12:58:17 +00:00
github-actions[bot]	3bad5d5590	flake.lock: Update (#2585) ... Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2025-07-04 12:00:59 +00:00
Florian Preinstorfer	d461db3abd	Refactor OpenID Connect documentation ... Restructure and rewrite the OpenID Connect documentation. Start from the most minimal configuration and describe what needs to be done both in Headscale and the identity provider. Describe additional features such as PKCE and authorization filters in a generic manner with examples. Document how Headscale populates its user profile and how it relates to OIDC claims. This is a revised version from the table in the changelog. Document the validation rules for fields and extend known limitations. Sort the provider specific section alphabetically and add a section for Authelia, Authentik, Kanidm and Keycloak. Also simplify and rename Azure to Entra ID. Update the description for the oidc section in the example configuration. Give a short explanation of each configuration setting. All documentend features were tested with Headscale 0.26 (using a fresh database each time) using the following identity providers: * Authelia * Authentik * Kanidm * Keycloak Fixes: #2295	2025-07-04 10:51:37 +02:00
eyJhb	efc6974017	fix typo in parseCapabilityVersion, and removed unused error (#2644) (#2644)	2025-07-04 09:40:29 +02:00
Fredrik Ekre	3f72ee9de8	Clarify SIGHUP log message (#2661)	2025-07-04 09:30:51 +02:00
nblock	e73b2a9fb9	Ensure that a username starts with a letter (#2635)	2025-06-24 14:45:44 +02:00
Kristoffer Dalby	081af2674b	ci: fix golangci-lint flag for v2 compatibility (#2654)	2025-06-24 08:14:50 +02:00
Kristoffer Dalby	1553f0ab53	state: introduce state ... this commit moves all of the read and write logic, and all different parts of headscale that manages some sort of persistent and in memory state into a separate package. The goal of this is to clearly define the boundry between parts of the app which accesses and modifies data, and where it happens. Previously, different state (routes, policy, db and so on) was used directly, and sometime passed to functions as pointers. Now all access has to go through state. In the initial implementation, most of the same functions exists and have just been moved. In the future centralising this will allow us to optimise bottle necks with the database (in memory state) and make the different parts talking to eachother do so in the same way across headscale components. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-06-24 07:58:54 +02:00
Kristoffer Dalby	a975b6a8b1	hscontrol: remove go-grpc-middleware v1 dependency (#2653) ... Co-authored-by: Claude <noreply@anthropic.com>	2025-06-23 16:57:20 +02:00
Kristoffer Dalby	afc11e1f0c	cmd/hi: fixes and qol (#2649)	2025-06-23 13:43:14 +02:00
Kristoffer Dalby	ea7376f522	cmd/hi: add integration test runner CLI tool (#2648) ... * cmd/hi: add integration test runner CLI tool Add a new CLI tool 'hi' for running headscale integration tests with Docker automation. The tool replaces manual Docker command composition with an automated solution. Features: - Run integration tests in golang:1.24 containers - Docker context detection (supports colima and other contexts) - Test isolation with unique run IDs and isolated control_logs - Automatic Docker image pulling and container management - Comprehensive cleanup operations for containers, networks, images - Docker volume caching for Go modules - Verbose logging and detailed test artifact reporting - Support for PostgreSQL/SQLite selection and various test flags Usage: go run ./cmd/hi run TestPingAllByIP --verbose The tool uses creachadair/command and flax for CLI parsing and provides cleanup subcommands for Docker resource management. Updates flake.nix vendorHash for new Go dependencies. * ci: update integration tests to use hi CLI tool Replace manual Docker command composition in GitHub Actions workflow with the new hi CLI tool for running integration tests. Changes: - Replace complex docker run command with simple 'go run ./cmd/hi run' - Remove manual environment variable setup (handled by hi tool) - Update artifact paths for new timestamped log directory structure - Simplify command from 15+ lines to 3 lines - Maintain all existing functionality (postgres/sqlite, timeout, test patterns) The hi tool automatically handles Docker context detection, container management, volume mounting, and environment variable setup that was previously done manually in the workflow. * makefile: remove test integration Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-06-18 11:22:15 +02:00
seiuneko	d325211617	feat: add verify client config for embedded DERP (#2260) ... * feat: add verify client config for embedded DERP * refactor: embedded DERP no longer verify clients via HTTP - register the `headscale://` protocol in `http.DefaultTransport` to intercept network requests - update configuration to use a single boolean option `verify_clients` * refactor: use `http.HandlerFunc` for type definition * refactor: some renaming and restructuring * chore: some renaming and fix lint * test: fix TestDERPVerifyEndpoint - `tailscale debug derp` use random node private key * test: add verify clients integration test for embedded DERP server * fix: apply code review suggestions * chore: merge upstream changes * fix: apply code review suggestions --------- Co-authored-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-06-18 09:24:53 +02:00
Mustafa Enes Batur	bad783321e	Fix /machine/map endpoint vulnerability (#2642) ... * Improve map auth logic * Bugfix * Add comment, improve error message * noise: make func, get by node this commit splits the additional validation into a separate function so it can be reused if we add more endpoints in the future. It swaps the check, so we still look up by NodeKey, but before accepting the connection, we validate the known machinekey from the db against the noise connection. The reason for this is that when a node logs in or out, the node key is replaced and it will no longer be possible to look it up, breaking reauthentication. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * noise: add comment to remind future use of getAndVal Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog: add entry Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> Co-authored-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-06-06 12:14:11 +02:00
Hannes	b8044c29dd	Replace magic-nix-cache-action (#2575)	2025-05-26 23:05:08 +02:00
Shubham Hibare	df69840f92	feat(tools): Add Go client implementation	2025-05-23 17:52:31 +02:00
lucarickli	76ca7a2b50	Add headscale-console	2025-05-22 06:52:02 +02:00
Florian Preinstorfer	cd704570be	Drop support for Ubuntu 20.04 ... Its old and our service file logs warning about unsupported options.	2025-05-21 15:40:32 +02:00
Florian Preinstorfer	43c9c50af4	Drop syslog.target and systemd-managed /var/run ... The systemd target "syslog.target" and not required because syslog is socket activated. The directory /var/run is usually a symlink to /run and its created by systemd via the RuntimeDirectory=headscale option. System creates and handles permissions, no need to manually mark it as a read-write path.	2025-05-21 15:40:32 +02:00
Florian Preinstorfer	4a941a2cb4	Refactor Debian/Ubuntu package ... Move files for packaging outside the docs directory into its own packaging directory. Replace the existing postinstall and postremove scripts with Debian maintainerscripts to behave more like a typical Debian package: * Start and enable the headscale systemd service by default * Does not print informational messages * No longer stop and disable the service on updates This package also performs migrations for all changes done in previous package versions on upgrade: * Set login shell to /usr/sbin/nologin * Set home directory to /var/lib/headscale * Migrate to system UID/GID The package is lintian-clean with a few exceptions that are documented as excludes and it passes puipars (both tested on Debian 12). The following scenarious were tested on Ubuntu 22.04, Ubuntu 24.04, Debian 11, Debian 12: * Install * Install same version again * Install -> Remove -> Install * Install -> Purge -> Install * Purge * Update from 0.22.0 * Update from 0.26.0 See: #2278 See: #2133 Fixes: #2311	2025-05-21 15:40:32 +02:00
Greg Dietsche	d2879b2b36	web: change node registration parameter order (#2607) ... This change makes editing the generated command easier. For example, after pasting into a terminal, the cursor position will be near the username portion which requires editing.	2025-05-21 11:18:53 +02:00
Kristoffer Dalby	a52f1df180	policy: remove v1 code (#2600) ... * policy: remove v1 code Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * db: update test with v1 removal Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: start moving to v2 policy Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: add ssh unmarshal tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog: add entry Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: remove v1 comment Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: remove comment out case Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * cleanup skipv1 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: remove v1 prefix workaround Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: add all node ips if prefix/host is ts ip Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-20 13:57:26 +02:00
azrikahar	1605e2a7a9	fix typo in TailSQL's log	2025-05-18 07:15:41 +02:00
Vitalij Dovhanyc	6750414db1	feat: add autogroup:member, autogroup:tagged (#2572)	2025-05-17 11:07:34 +02:00
Florian Preinstorfer	b50e10a1be	Document breaking change for dns.override_local_dns ... See: #2438	2025-05-16 19:33:00 +02:00
Florian Preinstorfer	c15aa541bb	Document HEADSCALE_CONFIG	2025-05-16 19:33:00 +02:00
Florian Preinstorfer	49b3468845	Do not ignore config-example.yml ... Various tools (e.g ripgrep) skip files ignored by Git. Do not ignore config-example.yml to include it in searches.	2025-05-16 19:33:00 +02:00
Kristoffer Dalby	bd6ed80936	policy/v2: error on missing or zero port (#2606) ... * policy/v2: error on missing or zero port Fixes #2605 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog: add entry Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-16 17:30:47 +02:00
Kristoffer Dalby	30525cee0e	goreleaser: always do draft (#2595) ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-16 10:23:22 +02:00
Kristoffer Dalby	2dc2f3b3f0	users: harden, test, and add cleaner of identifier (#2593) ... * users: harden, test, and add cleaner of identifier Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * db: migrate badly joined provider identifiers Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-14 16:45:14 +02:00
Kristoffer Dalby	d7a503a34e	changelog: entry for 0.26 (#2594) ... * changelog: entry for 0.26 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * docs: bump version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-14 16:32:56 +02:00