From 2ba21d2f8db44f59740aa3fb006653fcedbcd884 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Thu, 15 Oct 2026 08:02:20 +0000 Subject: [PATCH] CHANGELOG: add tls block and certmagic Updates #2527 --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0270b276d..844190e8d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -106,6 +106,9 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`, - `dns.extra_records_path` must end in `.json`, `.hujson`, `.yaml` or `.yml`; the extension picks the format - A `derp.paths` file that decodes to no regions now stops headscale from starting instead of being silently ignored - `unix_socket_permission` must be a quoted octal string no higher than `"0777"`, e.g. `"0770"`; an unquoted number or an invalid value now stops headscale from starting instead of silently using `0700` [#3540](https://github.com/juanfont/headscale/pull/3540) +- `tls_cert_path`, `tls_key_path`, `tls_letsencrypt_*`, `acme_url` and `acme_email` are deprecated in favour of `tls.cert_path`, `tls.key_path` and `tls.acme.*` [#3554](https://github.com/juanfont/headscale/pull/3554) + - The old keys continue to work, with a warning, but will be removed in a future release +- Headscale's own ACME certificate is managed by CertMagic instead of autocert; the first start registers a new ACME account and obtains a new certificate in `tls.acme.cache_dir`, which now defaults to `/var/lib/headscale/cache` [#3554](https://github.com/juanfont/headscale/pull/3554) #### CLI @@ -116,6 +119,7 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`, - `settings.ephemeral_node_inactivity_timeout` is removed; set `settings.node.ephemeral.inactivity_timeout`, which headscale reads instead - `settings.dns.split` is removed; headscale never read it, set `settings.dns.nameservers.split` +- `settings.tls_*` options move to `settings.tls.*`; old `settings.tls_*` values still work [#3554](https://github.com/juanfont/headscale/pull/3554) ### Changes @@ -138,6 +142,7 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`, - Add `dns.certificates.enabled` and `dns.certificates.zone` to let nodes get TLS certificates [#3554](https://github.com/juanfont/headscale/pull/3554) - Add `dns.challenge.provider`, `dns.challenge.propagation_timeout` and `dns.challenge.resolvers` for ACME DNS-01 challenges [#3554](https://github.com/juanfont/headscale/pull/3554) - The v2 tailnet setting `httpsEnabled` reports `dns.certificates.enabled` [#3554](https://github.com/juanfont/headscale/pull/3554) +- `tls.acme.challenge_type` accepts `DNS-01`, using `dns.challenge.provider` [#3554](https://github.com/juanfont/headscale/pull/3554) - Fix the unix socket being created `0700` instead of the documented `0770` when `unix_socket_permission` is unset. The socket grants full admin access without authentication, so members of its group gain that access; check who is in it before upgrading [#3540](https://github.com/juanfont/headscale/pull/3540) - A policy write builds the peer map once instead of twice [#3557](https://github.com/juanfont/headscale/pull/3557)