3593 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
dependabot[bot]	baa45573a6	build(deps): bump github.com/opencontainers/runc from 1.3.2 to 1.3.3 ... Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.3.2 to 1.3.3. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/v1.3.3/CHANGELOG.md) - [Commits](https://github.com/opencontainers/runc/compare/v1.3.2...v1.3.3) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-version: 1.3.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-11-05 16:40:13 +00:00
Kristoffer Dalby	2024219bd1	types: Distinguish subnet and exit node access ... When we fixed the issue of node visibility of nodes that only had access to eachother because of a subnet route, we gave all nodes access to all exit routes by accident. This commit splits exit nodes and subnet routes in the access. If a matcher indicates that the node should have access to any part of the subnet routes, we do not remove it from the node list. If a matcher destination is equal to the internet, and the target node is an exit node, we also do not remove the access. Fixes #2784 Fixes #2788 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	d9c3eaf8c8	matcher: Add func for comparing Dests and TheInternet ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	bd9cf42b96	types: NodeView CanAccess uses internal ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	d7a43a7cf1	state: use AllApprovedRoutes instead of SubnetRoutes ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	1c0bb0338d	types: split SubnetRoutes and ExitRoutes ... There are situations where the subnet routes and exit nodes must be treated differently. This splits it so SubnetRoutes only returns routes that are not exit routes. It adds `IsExitRoutes` and `AllApprovedRoutes` for convenience. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	c649c89e00	policy: Reproduce exit node visibility issues ... Reproduces #2784 and #2788 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Vitalij Dovhanyc	af2de35b6c	chore: fix autogroup:self with other acl rules (#2842)	2025-11-02 10:48:27 +00:00
Kristoffer Dalby	02c7c1a0e7	cli: only validate bypass-grpc set policy (#2854)	2025-11-02 09:42:59 +00:00
Copilot	d23fa26395	Fix flaky TestShuffleDERPMapDeterministic by ensuring deterministic map iteration (#2848) ... Co-authored-by: kradalby <98431+kradalby@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2025-11-02 10:05:23 +01:00
Andrey	f9bb88ad24	expire nodes with a custom timestamp (#2828)	2025-11-01 08:09:13 +01:00
Kristoffer Dalby	456a5d5cce	db: ignore _litestream tables when validating (#2843)	2025-11-01 07:08:22 +00:00
Kristoffer Dalby	ddbd3e14ba	db: remove all old, unused tables (#2844)	2025-11-01 08:03:37 +01:00
Florian Preinstorfer	0a43aab8f5	Use Debian 12 as minimum version for the deb package	2025-10-28 05:55:26 +01:00
Florian Preinstorfer	4bd614a559	Use current stable base images for Debian and Alpine	2025-10-28 05:55:26 +01:00
Kristoffer Dalby	19a33394f6	changelog: set 0.27 date (#2823)	2025-10-27 12:14:02 +01:00
Kristoffer Dalby	84fe3de251	integration: reduce TestAutoApproveMultiNetwork matrix to 3 tests (#2815)	2025-10-27 11:08:52 +00:00
Paarth Shah	450a7b15ec	#2796: Add creation_time and ko_data_creation_time to goreleaser.yml kos	2025-10-27 11:18:57 +01:00
Kristoffer Dalby	64b7142e22	.goreleaser: add upgrade section (#2820)	2025-10-27 10:41:52 +01:00
Kristoffer Dalby	52d27d58f0	hscontrol: add /version HTTP endpoint (#2821)	2025-10-27 10:41:34 +01:00
Kristoffer Dalby	e68e2288f7	gen: test-integration (#2814)	2025-10-24 17:22:53 +02:00
Kristoffer Dalby	c808587de0	cli: do not show new pre-releases on stable (#2813)	2025-10-24 13:15:53 +02:00
Kristoffer Dalby	2bf1200483	policy: fix autogroup:self propagation and optimize cache invalidation (#2807)	2025-10-23 17:57:41 +02:00
Kristoffer Dalby	66826232ff	integration: add tests for api bypass (#2811)	2025-10-22 16:30:25 +02:00
Kristoffer Dalby	1cdea7ed9b	stricter hostname validation and replace (#2383)	2025-10-22 13:50:39 +02:00
Elyas Asmad	2c9e98d3f5	fix: guard every error statement with early return (#2810)	2025-10-22 13:48:07 +02:00
Florian Preinstorfer	8becb7e54a	Mention explicitly that @ is only required in policy	2025-10-21 14:28:03 +02:00
Florian Preinstorfer	ed38d00aaa	Fix autogroup:self alternative example ... Also indent and split the comment into two lines to avoid horizontal scrolling.	2025-10-21 14:28:03 +02:00
Florian Preinstorfer	8010cc574e	Remove outdated hint about an empty config file	2025-10-19 17:14:15 +02:00
Juanjo Presa	c97d0ff23d	Fix fatal error on missing config file by handling viper.ConfigFileNotFoundError ... Correctly identify Viper's ConfigFileNotFoundError in LoadConfig to log a warning and use defaults, unifying behavior with empty config files. Fixes fatal error when no config file is present for CLI commands relying on environment variables.	2025-10-19 15:29:47 +02:00
Florian Preinstorfer	047dbda136	Add FAQ on how to disable log submission ... Fixes: #2793	2025-10-19 08:24:23 +02:00
Florian Preinstorfer	2a1392fb5b	Add healthcheck to container docs	2025-10-19 08:22:30 +02:00
Florian Preinstorfer	46477b8021	Downgrade completed broadcast message to debug	2025-10-18 07:56:59 +02:00
Kristoffer Dalby	c87471136b	integration: eventually fixups (#2799)	2025-10-17 08:28:30 +02:00
Kristoffer Dalby	e7a28a14af	changelog: prepare for 0.27.0 (#2797)	2025-10-16 19:04:07 +02:00
Kristoffer Dalby	4912769ab3	update dependencies (#2798)	2025-10-16 19:03:30 +02:00
Stavros Kois	c07cc491bf	add health command (#2659) ... * add health command * update health check implementation to allow for more checks to added over time * add change changelog entry	2025-10-16 12:00:11 +00:00
Vitalij Dovhanyc	c2a58a304d	feat: add autogroup:self (#2789)	2025-10-16 12:59:52 +02:00
Kristoffer Dalby	fddc7117e4	stability and race conditions in auth and node store (#2781) ... This PR addresses some consistency issues that was introduced or discovered with the nodestore. nodestore: Now returns the node that is being put or updated when it is finished. This closes a race condition where when we read it back, we do not necessarily get the node with the given change and it ensures we get all the other updates from that batch write. auth: Authentication paths have been unified and simplified. It removes a lot of bad branches and ensures we only do the minimal work. A comprehensive auth test set has been created so we do not have to run integration tests to validate auth and it has allowed us to generate test cases for all the branches we currently know of. integration: added a lot more tooling and checks to validate that nodes reach the expected state when they come up and down. Standardised between the different auth models. A lot of this is to support or detect issues in the changes to nodestore (races) and auth (inconsistencies after login and reaching correct state) This PR was assisted, particularly tests, by claude code.	2025-10-16 12:17:43 +02:00
Florian Preinstorfer	881a6b9227	The sequential prefix allocation uses a best-effort approach ... Fixes: #2682	2025-10-15 17:07:13 +02:00
yckwan	3fbde7a1b6	Update official.md ... in the step 5 file default value is [line11] ExecStart=/usr/bin/headscale serve	2025-10-13 17:06:56 +02:00
Andrey Bobelev	c4a8c038cd	fix: return valid AuthUrl in followup request on expired reg id ... - tailscale client gets a new AuthUrl and sets entry in the regcache - regcache entry expires - client doesn't know about that - client always polls followup request а gets error When user clicks "Login" in the app (after cache expiry), they visit invalid URL and get "node not found in registration cache". Some clients on Windows for e.g. can't get a new AuthUrl without restart the app. To fix that we can issue a new reg id and return user a new valid AuthUrl. RegisterNode is refactored to be created with NewRegisterNode() to autocreate channel and other stuff.	2025-10-11 05:57:39 +02:00
Andrey Bobelev	022098fe4e	chore: make reg cache expiry tunable ... Mostly for the tests, opts: - tuning.register_cache_expiration - tuning.register_cache_cleanup	2025-10-11 05:57:39 +02:00
Florian Preinstorfer	bd35fcf338	Add FAQ entry about policy migration in the database	2025-09-17 16:32:29 +02:00
Florian Preinstorfer	2d680b5ebb	Misc typos and spelling	2025-09-17 16:32:29 +02:00
Kristoffer Dalby	ed3a9c8d6d	mapper: send change instead of full update (#2775)	2025-09-17 14:23:21 +02:00
Kristoffer Dalby	4de56c40d8	flake: goreleaser doesnt follow go nix convention (#2779)	2025-09-17 09:41:05 +02:00
github-actions[bot]	40b3d54c1f	flake.lock: Update (#2755)	2025-09-14 16:15:51 +00:00
Florian Preinstorfer	30d12dafed	Add FAQ entry about the recommended upgrade path	2025-09-13 08:15:01 +02:00
Kristoffer Dalby	2b30a15a68	cmd: add option to get and set policy directly from database (#2765)	2025-09-12 16:55:15 +02:00