3685 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Justin Angel	7be20912f5	oidc: make email verification configurable ... Co-authored-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-18 11:42:32 +00:00
Kristoffer Dalby	e8753619de	capver: generate ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-18 10:02:23 +01:00
Kristoffer Dalby	251e16d772	tools/capver: regenerate from docker tags ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-18 10:02:23 +01:00
Kristoffer Dalby	3f0bfe28cc	changelog: prepare for 0.28.0 beta ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-17 15:15:43 +01:00
Kristoffer Dalby	82d4275c3b	mapper: correct some variable names missed from change ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-17 13:19:26 +01:00
Kristoffer Dalby	f3767dddf8	batcher: ensure removal from batcher ... Fixes #2924 Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-17 13:19:26 +01:00
Florian Preinstorfer	5c6cd62df1	Legacy preauthkeys must be used as-is	2025-12-17 13:05:08 +01:00
Shourya Gautam	56bec66a44	app: only wire up debug server if set ... Fixes #2871 Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-17 12:32:04 +01:00
Kristoffer Dalby	f0e464dc36	policy: add test to confirm group cant approve tag ... Confirms #2891 is implemented correctly. Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-17 09:32:05 +01:00
Kristoffer Dalby	2c3c943acf	.github/workflows: split long TestAutoApproveMultiNetwork into multiple jobs ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-17 09:32:05 +01:00
Kristoffer Dalby	a50bd13930	integration: prepare AutoApprove test for new tags ... Validates #2891 Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-17 09:32:05 +01:00
Kristoffer Dalby	5655ef86d7	AGENTS: golangci-lint from main, no "full matrix" ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-17 09:32:05 +01:00
Kristoffer Dalby	21ba197d06	integration: make entrypoint override more robust ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	9d77207ed8	policy: clarify usernam resolve comment ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	cf1ad47b42	flake: remove hi from shell ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	a288f04a1a	Dockerfile: align packages ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	5767ca5085	change: smarter change notifications ... This commit replaces the ChangeSet with a simpler bool based change model that can be directly used in the map builder to build the appropriate map response based on the change that has occured. Previously, we fell back to sending full maps for a lot of changes as that was consider "the safe" thing to do to ensure no updates were missed. This was slightly problematic as a node that already has a list of peers will only do full replacement of the peers if the list is non-empty, meaning that it was not possible to remove all nodes (if for example policy changed). Now we will keep track of last seen nodes, so we can send remove ids, but also we are much smarter on how we send smaller, partial maps when needed. Fixes #2389 Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	f67ed36fe2	integration: replicate tag propagation issue ... This commit adds tests to validate that there are issues with how we propagate tag changes in the system. This replicates #2389 Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	506bd8c8eb	policy: more accurate node change ... This commit changes so that node changes to the policy is calculated if any of the nodes has changed in a way that might affect the policy. Previously we just checked if the number of nodes had changed, which meant that if a node was added and removed, we would be in a bad state. Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	daf9f36c78	editorconfig: add basic editor config ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2025-12-16 10:12:36 +01:00
Kristoffer Dalby	616c0e895d	batcher: fix closed panic ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-15 16:28:27 +01:00
Kristoffer Dalby	c4600346f9	.github/workflows: prebuilt integration test artifacts (#2954) ... This PR restructures the integration tests and prebuilds all common assets used in all tests: Headscale and Tailscale HEAD image hi binary that is used to run tests go cache is warmed up for compilation of the test This essentially means we spend 6-10 minutes building assets before any tests starts, when that is done, all tests can just sprint through. It looks like we are saving 3-9 minutes per test, and since we are limited to running max 20 concurrent tests across the repo, that means we had a lot of double work. There is currently 113 checks, so we have to do five runs of 20, and the saving should be quite noticeable! I think the "worst case" saving would be 20+min and "best case" probably towards an hour.	2025-12-12 23:01:52 +01:00
Kristoffer Dalby	642073f4b8	types: add option to disable taildrop, improve tests (#2955)	2025-12-12 11:35:16 +01:00
Kristoffer Dalby	87bd67318b	golangci-lint: use forbidigo to block time.Sleep (#2946)	2025-12-10 16:45:59 +00:00
Kristoffer Dalby	0e1673041c	all: remove deadcode (#2952)	2025-12-10 15:55:15 +01:00
Kristoffer Dalby	f3f2d30004	cli: better formatting of lists (#2951)	2025-12-10 12:33:21 +01:00
Kristoffer Dalby	c8376e44a2	mapper: move tail node conversion to node type (#2950)	2025-12-10 09:16:22 +01:00
Rogan Lynch	5d0a6ab0e9	fix: list-routes command now respects identifier filter with JSON output ... Fixes #2927 In v0.27.0, the list-routes command with -i flag and -o json output was returning all nodes instead of just the specified node. The issue was that JSON output was happening before the identifier filtering logic. This change moves the JSON output to after both the identifier filter and route existence filter are applied, ensuring the correct filtered results are returned. This restores the v0.26.1 behavior where: headscale nodes list-routes -i 12 -o json correctly returns only node 12's route information.	2025-12-10 06:19:17 +01:00
Kristoffer Dalby	22ee2bfc9c	tags: process tags on registration, simplify policy (#2931) ... This PR investigates, adds tests and aims to correctly implement Tailscale's model for how Tags should be accepted, assigned and used to identify nodes in the Tailscale access and ownership model. When evaluating in Headscale's policy, Tags are now only checked against a nodes "tags" list, which defines the source of truth for all tags for a given node. This simplifies the code for dealing with tags greatly, and should help us have less access bugs related to nodes belonging to tags or users. A node can either be owned by a user, or a tag. Next, to ensure the tags list on the node is correctly implemented, we first add tests for every registration scenario and combination of user, pre auth key and pre auth key with tags with the same registration expectation as observed by trying them all with the Tailscale control server. This should ensure that we implement the correct behaviour and that it does not change or break over time. Lastly, the missing parts of the auth has been added, or changed in the cases where it was wrong. This has in large parts allowed us to delete and simplify a lot of code. Now, tags can only be changed when a node authenticates or if set via the CLI/API. Tags can only be fully overwritten/replaced and any use of either auth or CLI will replace the current set if different. A user owned device can be converted to a tagged device, but it cannot be changed back. A tagged device can never remove the last tag either, it has to have a minimum of one.	2025-12-08 18:51:07 +01:00
Dusty Mabe	1f5df017a1	hscontrol: log acme/autocert errors (#2933)	2025-12-08 16:39:30 +00:00
Florian Preinstorfer	bba91a89be	Use lists for integration docs ... Refactor the tables in "Tools" and "WebUI" integration pages to lists. Lists are easier to extend and contributions are easier to review.	2025-12-08 12:50:19 +01:00
Florian Preinstorfer	6359511a62	Use debian13 distroless images	2025-12-07 20:58:29 +01:00
adinhodovic	d2fcd5b95b	docs(tools): Add tailscale-exporter ... A Prometheus exporter for Tailscale and Headscale that provides tailnet-level metrics using the Tailscale/Headscale API.	2025-12-07 14:39:08 +01:00
Kristoffer Dalby	15c84b34e0	policy: allow tags to own tags (#2930)	2025-12-06 10:23:35 +01:00
Kristoffer Dalby	eb788cd007	make tags first class node owner (#2885) ... This PR changes tags to be something that exists on nodes in addition to users, to being its own thing. It is part of moving our tags support towards the correct tailscale compatible implementation. There are probably rough edges in this PR, but the intention is to get it in, and then start fixing bugs from 0.28.0 milestone (long standing tags issue) to discover what works and what doesnt. Updates #2417 Closes #2619	2025-12-02 12:01:25 +01:00
Kristoffer Dalby	705b239677	changelog: prep for 0.27.2 rc ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-02 12:01:02 +01:00
Kristoffer Dalby	cb4d5b1906	hscontrol/oidc: fix ACL policy not applied to new OIDC nodes (#2890) ... Fixes #2888 Fixes #2896	2025-12-02 12:01:02 +01:00
Vitalij Dovhanyc	0078eb7790	chore: fix filterHash to work with autogroup:self in the acls (#2882)	2025-12-02 12:01:02 +01:00
Kristoffer Dalby	3cf2d7195a	auth: ensure machines are allowed in when pak change (#2917)	2025-12-02 12:01:02 +01:00
Kristoffer Dalby	16d811b306	cli: remove node move command (#2922)	2025-12-01 21:43:31 +01:00
Kristoffer Dalby	eec196d200	modernize: run gopls modernize to bring up to 1.25 (#2920)	2025-12-01 19:40:25 +01:00
Kristoffer Dalby	bfcd9d261d	cmd/hi: reject if we are already running (#2919)	2025-12-01 19:40:08 +01:00
Florian Preinstorfer	f00c412cde	Move static doc assets into docs/assets	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	2010805712	Provide Headscale's favicon at its expected place ... Assets need to reside within the docs/ directory for mkdocs to pick them up.	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	c5133ee5d3	Fix trailing whitespace	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	9c33cbfdc8	Exclude docs/ only for prettier pre-commit hook ... Applying the the built-in hooks to docs/ seems to be fine.	2025-11-28 21:27:54 +01:00
Florian Preinstorfer	9b327f6b56	Update pre-commit-hooks	2025-11-28 21:27:54 +01:00
Kristoffer Dalby	9368fee1c5	generate: add new patches (#2921)	2025-11-28 17:00:52 +01:00
Kristoffer Dalby	ed78bf4b98	cmd/hi: improve test cleanup to reduce CI disk usage (#2881)	2025-11-28 16:59:54 +01:00
Kristoffer Dalby	db293e0698	hscontrol/state: make NodeStore batch configuration tunable (#2886)	2025-11-28 16:38:29 +01:00