3657 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Kristoffer Dalby	22ee2bfc9c	tags: process tags on registration, simplify policy (#2931) ... This PR investigates, adds tests and aims to correctly implement Tailscale's model for how Tags should be accepted, assigned and used to identify nodes in the Tailscale access and ownership model. When evaluating in Headscale's policy, Tags are now only checked against a nodes "tags" list, which defines the source of truth for all tags for a given node. This simplifies the code for dealing with tags greatly, and should help us have less access bugs related to nodes belonging to tags or users. A node can either be owned by a user, or a tag. Next, to ensure the tags list on the node is correctly implemented, we first add tests for every registration scenario and combination of user, pre auth key and pre auth key with tags with the same registration expectation as observed by trying them all with the Tailscale control server. This should ensure that we implement the correct behaviour and that it does not change or break over time. Lastly, the missing parts of the auth has been added, or changed in the cases where it was wrong. This has in large parts allowed us to delete and simplify a lot of code. Now, tags can only be changed when a node authenticates or if set via the CLI/API. Tags can only be fully overwritten/replaced and any use of either auth or CLI will replace the current set if different. A user owned device can be converted to a tagged device, but it cannot be changed back. A tagged device can never remove the last tag either, it has to have a minimum of one.	2025-12-08 18:51:07 +01:00
Dusty Mabe	1f5df017a1	hscontrol: log acme/autocert errors (#2933)	2025-12-08 16:39:30 +00:00
Florian Preinstorfer	bba91a89be	Use lists for integration docs ... Refactor the tables in "Tools" and "WebUI" integration pages to lists. Lists are easier to extend and contributions are easier to review.	2025-12-08 12:50:19 +01:00
Florian Preinstorfer	6359511a62	Use debian13 distroless images	2025-12-07 20:58:29 +01:00
adinhodovic	d2fcd5b95b	docs(tools): Add tailscale-exporter ... A Prometheus exporter for Tailscale and Headscale that provides tailnet-level metrics using the Tailscale/Headscale API.	2025-12-07 14:39:08 +01:00
Kristoffer Dalby	15c84b34e0	policy: allow tags to own tags (#2930)	2025-12-06 10:23:35 +01:00
Kristoffer Dalby	eb788cd007	make tags first class node owner (#2885) ... This PR changes tags to be something that exists on nodes in addition to users, to being its own thing. It is part of moving our tags support towards the correct tailscale compatible implementation. There are probably rough edges in this PR, but the intention is to get it in, and then start fixing bugs from 0.28.0 milestone (long standing tags issue) to discover what works and what doesnt. Updates #2417 Closes #2619	2025-12-02 12:01:25 +01:00
Kristoffer Dalby	705b239677	changelog: prep for 0.27.2 rc ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-02 12:01:02 +01:00
Kristoffer Dalby	cb4d5b1906	hscontrol/oidc: fix ACL policy not applied to new OIDC nodes (#2890) ... Fixes #2888 Fixes #2896	2025-12-02 12:01:02 +01:00
Vitalij Dovhanyc	0078eb7790	chore: fix filterHash to work with autogroup:self in the acls (#2882)	2025-12-02 12:01:02 +01:00
Kristoffer Dalby	3cf2d7195a	auth: ensure machines are allowed in when pak change (#2917)	2025-12-02 12:01:02 +01:00
Kristoffer Dalby	16d811b306	cli: remove node move command (#2922)	2025-12-01 21:43:31 +01:00
Kristoffer Dalby	eec196d200	modernize: run gopls modernize to bring up to 1.25 (#2920)	2025-12-01 19:40:25 +01:00
Kristoffer Dalby	bfcd9d261d	cmd/hi: reject if we are already running (#2919)	2025-12-01 19:40:08 +01:00
Florian Preinstorfer	f00c412cde	Move static doc assets into docs/assets	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	2010805712	Provide Headscale's favicon at its expected place ... Assets need to reside within the docs/ directory for mkdocs to pick them up.	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	c5133ee5d3	Fix trailing whitespace	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	9c33cbfdc8	Exclude docs/ only for prettier pre-commit hook ... Applying the the built-in hooks to docs/ seems to be fine.	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	9b327f6b56	Update pre-commit-hooks	2025-11-28 21:27:54 +01:00
Kristoffer Dalby	9368fee1c5	generate: add new patches (#2921)	2025-11-28 17:00:52 +01:00
Kristoffer Dalby	ed78bf4b98	cmd/hi: improve test cleanup to reduce CI disk usage (#2881)	2025-11-28 16:59:54 +01:00
Kristoffer Dalby	db293e0698	hscontrol/state: make NodeStore batch configuration tunable (#2886)	2025-11-28 16:38:29 +01:00
pwuersch	9c4c017eac	docs: Enable automatic theme switching ... Signed-off-by: pwuersch <49908921+pwuersch@users.noreply.github.com>	2025-11-24 06:43:22 +01:00
János Benjamin Antal	14af9b3ab1	Add docs to manage headscale from another local user	2025-11-24 06:37:35 +01:00
Florian Preinstorfer	72d5fd04a7	Remove duplicated documentation and link to getting started instead	2025-11-18 11:07:49 +01:00
Florian Preinstorfer	e86d063056	Mention /health instead of /windows	2025-11-18 11:07:49 +01:00
Acha	e0c9e18e22	Update OIDC documentation for allowed groups filter ... Clarify configuration for allowed groups filter with Microsoft Entra ID.	2025-11-15 17:44:00 +01:00
Florian Preinstorfer	21af106f68	Containers should be read-only ... This improves security and explicitly fails on startup when a user picks the wrong directory to store its data. - Run in read-only mode - Make /var/run/headscale a read-write tmpfs - Mount the config volume read-only - Use the /health endpoint to check if Headscale is up	2025-11-14 14:51:27 +01:00
Kristoffer Dalby	7fb0f9a501	batcher: send endpoint and derp only updates. (#2856)	2025-11-13 20:38:49 +01:00
Kristoffer Dalby	4b25976288	db: add comment to always check errors in migration ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-13 09:46:40 -06:00
Kristoffer Dalby	1c146f70e9	db: remove _schema from migration tests ... Previously we tested migrations on schemas and dumps of old databases. The problems with testing migrations against the schemas is that the migration table is empty, so we try to run migrations that are already ran on that schema, which might blow up. This commit removes the schema approach and just leaves all the dumps, which include the migration table. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-13 09:46:40 -06:00
Florian Preinstorfer	249630bed8	Add API documentation ... Document the API endpoint and the built-in swagger docs at /swagger. The remote control docs are just a use case for gRPC - move it in the API docs and update links to it.	2025-11-13 15:22:55 +01:00
Kristoffer Dalby	75247f82b8	hscontrol/db: add init schema, drop pre-0.25 support (#2883)	2025-11-13 04:44:10 -06:00
Tianon Gravi	665cc44094	Explicitly drop apt-get clean and use dist-clean ... The former is a no-op in the base images (45491f2c5c/scripts/debuerreotype-minimizing-config (L87-L109)), and `apt-get dist-clean` is a safer/better version of the `rm -rf /var/lib/apt/lists/*` that keeps the cryptographic bits that help prevent downgrade attacks.	2025-11-13 07:15:22 +01:00
Kristoffer Dalby	8394e7094a	capver: update latest (#2774)	2025-11-12 20:26:54 +01:00
Kristoffer Dalby	da9018a0eb	types: make pre auth key use bcrypt (#2853)	2025-11-12 16:36:36 +01:00
Kristoffer Dalby	e3ced80278	hscontrol: consolidate assets into single package ... Move favicon.png, style.css, and headscale.svg to hscontrol/assets/ and create a single assets.go file with all embed directives. Update hscontrol/handlers.go and hscontrol/templates/general.go to use the centralized assets package.	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	09c9762fe0	hscontrol: convert BlankHandler to use elem-go	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	75e24de7bd	flake: disable CGO in dev shell ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	2aa5b8b68d	changelog: add entry for templates redesign	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	4e77e910c5	hscontrol: use octal literal syntax in test	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	a496864762	hscontrol: add template HTML consistency test ... Add test to validate HTML template output consistency across all templates (OIDC callback, registration, Windows, Apple). Verifies all templates produce valid HTML5 with: - Proper DOCTYPE declaration - HTML5 lang attribute - UTF-8 charset - Viewport meta tag - Semantic HTML structure Ensures template refactoring maintains standards compliance.	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	3ed1067a95	hscontrol/templates: refactor to use CSS classes and embedded files ... Refactor template system to use go:embed for external assets and CSS classes for styling instead of inline styles: - general.go: Add go:embed directives for style.css and headscale.svg, replace inline styles with CSS classes (H1, H2, H3, P, etc.), add mdTypesetBody wrapper with Material for MkDocs styling - apple.go, oidc_callback.go, register_web.go, windows.go: Update to use new CSS-based helper functions (H1, H2, P, etc.) and mdTypesetBody for consistent layout This separates content from presentation, making templates easier to maintain and update. All styling is now centralized in style.css with Material for MkDocs design system.	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	285c4e46a9	hscontrol/templates: add Material for MkDocs design assets ... Add design system assets for HTML templates: - headscale.svg: Logo with optimized viewBox for proper alignment - style.css: Material for MkDocs CSS variables and typography - design.go: Design system constants for consistent styling The logo viewBox is adjusted to 32.92 0 1247.08 640 to eliminate whitespace from the original export and ensure left alignment with text content.	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	89285c317b	templates: migrate OIDC callback to elem-go ... Replace html/template with type-safe elem-go templating for OIDC callback page. Improves consistency with other templates and provides compile-time safety. All UI elements and styling preserved.	2025-11-12 08:28:12 -06:00
Kristoffer Dalby	d14be8d43b	nix: add NixOS module and tests (#2857)	2025-11-12 13:11:38 +00:00
Kristoffer Dalby	000d5c3b0c	prettier: use standard config for all files including changelog (#2879)	2025-11-12 13:59:43 +01:00
Teej	218a8db1b9	add favicon to webpages (#2858) ... Co-authored-by: TeejMcSteez <tjhall047@gmail.com> Co-authored-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-11-12 03:46:57 +00:00
Kristoffer Dalby	1dcb04ce9b	changelog: add changelog entry ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-11 17:27:00 -06:00
Andrey Bobelev	299cef4e99	fix: free ips from usedIps ipset on DeleteNode	2025-11-11 17:27:00 -06:00