From 88f90d040d05ceffa464236f59639f952cfe0967 Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@dalby.cc>
Date: Sat, 31 Oct 2026 14:23:47 +0000
Subject: [PATCH] api/v2: report routeSelection in tailnet settings

---
 hscontrol/api/v2/settings.go     | 7 +++++++
 hscontrol/apiv2_settings_test.go | 1 +
 2 files changed, 8 insertions(+)

diff --git a/hscontrol/api/v2/settings.go b/hscontrol/api/v2/settings.go
index f42d3c90e..7f4251446 100644
--- a/hscontrol/api/v2/settings.go
+++ b/hscontrol/api/v2/settings.go
@@ -15,6 +15,10 @@ func init() {
 	registrations = append(registrations, registerSettings)
 }
 
+// routeSelectionFailover is the only way headscale picks between routers of one
+// prefix: one serves, the others take over when it fails.
+const routeSelectionFailover = "active-passive-failover"
+
 // TailnetSettings is the Tailscale tailnet-settings response. Headscale's config
 // is file-based and mostly not runtime-mutable, so only a few fields carry a
 // real value; the rest report the default "off".
@@ -33,6 +37,8 @@ type TailnetSettings struct {
 	RegionalRoutingOn           bool `json:"regionalRoutingOn"`
 	PostureIdentityCollectionOn bool `json:"postureIdentityCollectionOn"`
 	HTTPSEnabled                bool `json:"httpsEnabled"`
+
+	RouteSelection string `json:"routeSelection"`
 }
 
 type (
@@ -75,6 +81,7 @@ func registerSettings(api huma.API, b Backend) {
 			// Tailscale's toggle for node certificates, not headscale's own TLS.
 			HTTPSEnabled:                           cfg.DNSConfig.Certificates.Enabled,
 			UsersRoleAllowedToJoinExternalTailnets: "none",
+			RouteSelection:                         routeSelectionFailover,
 		}}, nil
 	})
 
diff --git a/hscontrol/apiv2_settings_test.go b/hscontrol/apiv2_settings_test.go
index 83b6e26e5..133d6cb47 100644
--- a/hscontrol/apiv2_settings_test.go
+++ b/hscontrol/apiv2_settings_test.go
@@ -122,6 +122,7 @@ func TestAPIv2SettingsConstantOffFields(t *testing.T) {
 		DevicesKeyDurationDays:                 90,
 		HTTPSEnabled:                           true,
 		UsersRoleAllowedToJoinExternalTailnets: "none",
+		RouteSelection:                         "active-passive-failover",
 	}
 	if diff := cmp.Diff(want, s); diff != "" {
 		t.Errorf("settings mismatch (-want +got):\n%s", diff)