3560 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Kristoffer Dalby	c87471136b	integration: eventually fixups (#2799)	2025-10-17 08:28:30 +02:00
Kristoffer Dalby	e7a28a14af	changelog: prepare for 0.27.0 (#2797)	2025-10-16 19:04:07 +02:00
Kristoffer Dalby	4912769ab3	update dependencies (#2798)	2025-10-16 19:03:30 +02:00
Stavros Kois	c07cc491bf	add health command (#2659) ... * add health command * update health check implementation to allow for more checks to added over time * add change changelog entry	2025-10-16 12:00:11 +00:00
Vitalij Dovhanyc	c2a58a304d	feat: add autogroup:self (#2789)	2025-10-16 12:59:52 +02:00
Kristoffer Dalby	fddc7117e4	stability and race conditions in auth and node store (#2781) ... This PR addresses some consistency issues that was introduced or discovered with the nodestore. nodestore: Now returns the node that is being put or updated when it is finished. This closes a race condition where when we read it back, we do not necessarily get the node with the given change and it ensures we get all the other updates from that batch write. auth: Authentication paths have been unified and simplified. It removes a lot of bad branches and ensures we only do the minimal work. A comprehensive auth test set has been created so we do not have to run integration tests to validate auth and it has allowed us to generate test cases for all the branches we currently know of. integration: added a lot more tooling and checks to validate that nodes reach the expected state when they come up and down. Standardised between the different auth models. A lot of this is to support or detect issues in the changes to nodestore (races) and auth (inconsistencies after login and reaching correct state) This PR was assisted, particularly tests, by claude code.	2025-10-16 12:17:43 +02:00
Florian Preinstorfer	881a6b9227	The sequential prefix allocation uses a best-effort approach ... Fixes: #2682	2025-10-15 17:07:13 +02:00
yckwan	3fbde7a1b6	Update official.md ... in the step 5 file default value is [line11] ExecStart=/usr/bin/headscale serve	2025-10-13 17:06:56 +02:00
Andrey Bobelev	c4a8c038cd	fix: return valid AuthUrl in followup request on expired reg id ... - tailscale client gets a new AuthUrl and sets entry in the regcache - regcache entry expires - client doesn't know about that - client always polls followup request а gets error When user clicks "Login" in the app (after cache expiry), they visit invalid URL and get "node not found in registration cache". Some clients on Windows for e.g. can't get a new AuthUrl without restart the app. To fix that we can issue a new reg id and return user a new valid AuthUrl. RegisterNode is refactored to be created with NewRegisterNode() to autocreate channel and other stuff.	2025-10-11 05:57:39 +02:00
Andrey Bobelev	022098fe4e	chore: make reg cache expiry tunable ... Mostly for the tests, opts: - tuning.register_cache_expiration - tuning.register_cache_cleanup	2025-10-11 05:57:39 +02:00
Florian Preinstorfer	bd35fcf338	Add FAQ entry about policy migration in the database	2025-09-17 16:32:29 +02:00
Florian Preinstorfer	2d680b5ebb	Misc typos and spelling	2025-09-17 16:32:29 +02:00
Kristoffer Dalby	ed3a9c8d6d	mapper: send change instead of full update (#2775)	2025-09-17 14:23:21 +02:00
Kristoffer Dalby	4de56c40d8	flake: goreleaser doesnt follow go nix convention (#2779)	2025-09-17 09:41:05 +02:00
github-actions[bot]	40b3d54c1f	flake.lock: Update (#2755)	2025-09-14 16:15:51 +00:00
Florian Preinstorfer	30d12dafed	Add FAQ entry about the recommended upgrade path	2025-09-13 08:15:01 +02:00
Kristoffer Dalby	2b30a15a68	cmd: add option to get and set policy directly from database (#2765)	2025-09-12 16:55:15 +02:00
Kristoffer Dalby	2938d03878	policy: reject unsupported fields (#2764)	2025-09-12 14:47:56 +02:00
Kristoffer Dalby	1b1c989268	{policy, node}: allow return paths in route reduction (#2767)	2025-09-12 11:47:51 +02:00
Kristoffer Dalby	3950f8f171	cli: use gobuild version handling (#2770)	2025-09-12 11:47:31 +02:00
Kristoffer Dalby	ee0ef396a2	policy: fix ssh usermap, fixing autogroup:nonroot (#2768)	2025-09-12 09:12:30 +02:00
Kristoffer Dalby	7056fbb63b	derp: fix flaky shuffle test (#2772)	2025-09-11 13:49:02 +00:00
Kristoffer Dalby	c91b9fc761	poll: add missing godoc (#2763)	2025-09-11 14:15:19 +02:00
Kristoffer Dalby	d41fb4d540	app: fix sigint hanging ... When the node notifier was replaced with batcher, we removed its closing, but forgot to add the batchers so it was never stopping node connections and waiting forever. Fixes #2751 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-11 11:53:26 +02:00
Kristoffer Dalby	01c1f6f82a	policy: validate error message for asterix in ssh (#2766)	2025-09-10 18:41:43 +02:00
Oleksii Samoliuk	3f6657ae57	fix: documentation	2025-09-09 20:54:47 +02:00
Kristoffer Dalby	0512f7c57e	.github/ISSUE_TEMPLATE: add node number to environment ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 19:04:23 +02:00
Florian Preinstorfer	c6427aa296	Use group id instead of group name for Entra ID	2025-09-09 12:23:34 +02:00
Florian Preinstorfer	4e6d42d5bd	Keycloak's group format is configurable	2025-09-09 12:23:34 +02:00
Florian Preinstorfer	8ff5baadbe	Refresh OIDC docs ... The UserInfo endpoint is always queried since 5d8a2c2. This allows to use all OIDC related features without any extra configuration on Authelia. For Keycloak, its sufficient to add the groups mapper to the userinfo endpoint.	2025-09-09 12:23:34 +02:00
Florian Preinstorfer	2f3c365b68	Describe how to remove a DERP region ... Add documentation for d29feaef. Fixes: #2450	2025-09-09 11:05:30 +02:00
Kristoffer Dalby	4893cdac74	integration: make timestamp const ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	476f30ab20	state: ensure netinfo is preserved and not removed ... the client will send a lot of fields as `nil` if they have not changed. NetInfo, which is inside Hostinfo, is one of those fields and we often would override the whole hostinfo meaning that we would remove netinfo if it hadnt changed. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	233dffc186	lint and leftover ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	39443184d6	gen: new proto version ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	0303b76e1f	postgres uses more memory ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	684239e015	cmd/mapresponses: add mini tool to inspect mapresp state from integration ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	81b3e8f743	util: harden parsing of traceroute ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	50ed24847b	debug: add json and improve ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	9b962956b5	integration: Eventually, debug output, lint and format ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	3b16b75fe6	integration: rework retry for waiting for node sync ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	9d236571f4	state/nodestore: in memory representation of nodes ... Initial work on a nodestore which stores all of the nodes and their relations in memory with relationship for peers precalculated. It is a copy-on-write structure, replacing the "snapshot" when a change to the structure occurs. It is optimised for reads, and while batches are not fast, they are grouped together to do less of the expensive peer calculation if there are many changes rapidly. Writes will block until commited, while reads are never blocked. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	38be30b6d4	derp: allow override to ip for debug ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	7f8b14f6f3	.github/workflows: remove integration retry ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	3326c5b7ec	cmd/hi: lint and format ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	b6d5788231	mapper: produce map before poll ... Before this patch, we would send a message to each "node stream" that there is an update that needs to be turned into a mapresponse and sent to a node. Producing the mapresponse is a "costly" afair which means that while a node was producing one, it might start blocking and creating full queues from the poller and all the way up to where updates where sent. This could cause updates to time out and being dropped as a bad node going away or spending too time processing would cause all the other nodes to not get any updates. In addition, it contributed to "uncontrolled parallel processing" by potentially doing too many expensive operations at the same time: Each node stream is essentially a channel, meaning that if you have 30 nodes, we will try to process 30 map requests at the same time. If you have 8 cpu cores, that will saturate all the cores immediately and cause a lot of wasted switching between the processing. Now, all the maps are processed by workers in the mapper, and the number of workers are controlable. These would now be recommended to be a bit less than number of CPU cores, allowing us to process them as fast as we can, and then send them to the poll. When the poll recieved the map, it is only responsible for taking it and sending it to the node. This might not directly improve the performance of Headscale, but it will likely make the performance a lot more consistent. And I would argue the design is a lot easier to reason about. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	33e9e7a71f	CLAUDE: split into agents ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	ccd79ed8d4	mcp: add some standard mcp server ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	f6c4b338fd	.github/workflows: add generate check ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	306d8e1bd4	integration: validate expected online status in ping ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00