mirror of
https://github.com/juanfont/headscale.git
synced 2026-09-10 02:31:59 +09:00
Deployed 63123196 to development with ProperDocs 1.6.7 and mike 2.2.0
This commit is contained in:
github-actions
File diff suppressed because one or more lines are too long
@@ -2,7 +2,7 @@
|
||||
</span><span id=__span-0-2><a id=__codelineno-0-2 name=__codelineno-0-2 href=#__codelineno-0-2></a><span class=w> </span><span class=c1># Valid log levels: panic, fatal, error, warn, info, debug, trace</span>
|
||||
</span><span id=__span-0-3><a id=__codelineno-0-3 name=__codelineno-0-3 href=#__codelineno-0-3></a><span class=hll><span class=w> </span><span class=nt>level</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">debug</span>
|
||||
</span></span></code></pre></div> <h3 id=database-logging>Database logging<a class=headerlink href=#database-logging title="Permanent link">¶</a></h3> <p>The database debug mode logs all database queries. Enable it to see how Headscale interacts with its database. This also requires the application log level to be set to either <code>debug</code> or <code>trace</code>.</p> <div class="language-yaml highlight"><pre><span></span><code><span id=__span-1-1><a id=__codelineno-1-1 name=__codelineno-1-1 href=#__codelineno-1-1></a><span class=nt>database</span><span class=p>:</span>
|
||||
</span><span id=__span-1-2><a id=__codelineno-1-2 name=__codelineno-1-2 href=#__codelineno-1-2></a><span class=w> </span><span class=c1># Enable debug mode. This setting requires the log.level to be set to "debug" or "trace".</span>
|
||||
</span><span id=__span-1-2><a id=__codelineno-1-2 name=__codelineno-1-2 href=#__codelineno-1-2></a><span class=w> </span><span class=c1># Enable debug mode. This setting requires the log.level to be set to "debug" or "trace".</span>
|
||||
</span><span id=__span-1-3><a id=__codelineno-1-3 name=__codelineno-1-3 href=#__codelineno-1-3></a><span class=hll><span class=w> </span><span class=nt>debug</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">false</span>
|
||||
</span></span><span id=__span-1-4><a id=__codelineno-1-4 name=__codelineno-1-4 href=#__codelineno-1-4></a>
|
||||
</span><span id=__span-1-5><a id=__codelineno-1-5 name=__codelineno-1-5 href=#__codelineno-1-5></a><span class=nt>log</span><span class=p>:</span>
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -2,8 +2,8 @@
|
||||
</span></code></pre></div> <div class="tabbed-set tabbed-alternate" data-tabs=1:2><input checked=checked id=__tabbed_1_1 name=__tabbed_1 type=radio><input id=__tabbed_1_2 name=__tabbed_1 type=radio><div class=tabbed-labels><label for=__tabbed_1_1>Personal devices</label><label for=__tabbed_1_2>Tagged devices</label></div> <div class=tabbed-content> <div class=tabbed-block> <p>Run <code>tailscale up</code> to login your personal device:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-1-1><a id=__codelineno-1-1 name=__codelineno-1-1 href=#__codelineno-1-1></a><span class=go>tailscale up --login-server <YOUR_HEADSCALE_URL></span>
|
||||
</span></code></pre></div> <p>Usually, a browser window with further instructions is opened. This page explains how to complete the registration on your Headscale server and it also prints the Auth ID required to approve the node:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-2-1><a id=__codelineno-2-1 name=__codelineno-2-1 href=#__codelineno-2-1></a><span class=go>headscale auth register --user <USER> --auth-id <AUTH_ID></span>
|
||||
</span></code></pre></div> <p>Congrations, the registration of your personal node is complete and it should be listed as "online" in the output of <code>headscale nodes list</code>. The "User" column displays <code><USER></code> as the owner of the node.</p> </div> <div class=tabbed-block> <p>Your Headscale user needs to be authorized to register tagged devices. This authorization is specified in the <a href=https://tailscale.com/docs/reference/syntax/policy-file#tag-owners><code>tagOwners</code></a> section of the <a href=../policy/ >policy</a>. A simple example looks like this:</p> <div class="language-json highlight"><span class=filename>The user alice can register nodes tagged with tag:server</span><pre><span></span><code><span id=__span-3-1><a id=__codelineno-3-1 name=__codelineno-3-1 href=#__codelineno-3-1></a><span class=p>{</span>
|
||||
</span><span id=__span-3-2><a id=__codelineno-3-2 name=__codelineno-3-2 href=#__codelineno-3-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-3-3><a id=__codelineno-3-3 name=__codelineno-3-3 href=#__codelineno-3-3></a><span class=w> </span><span class=nt>"tag:server"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-3-2><a id=__codelineno-3-2 name=__codelineno-3-2 href=#__codelineno-3-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-3-3><a id=__codelineno-3-3 name=__codelineno-3-3 href=#__codelineno-3-3></a><span class=w> </span><span class=nt>"tag:server"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-3-4><a id=__codelineno-3-4 name=__codelineno-3-4 href=#__codelineno-3-4></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-3-5><a id=__codelineno-3-5 name=__codelineno-3-5 href=#__codelineno-3-5></a><span class=w> </span><span class=c1>// more rules</span>
|
||||
</span><span id=__span-3-6><a id=__codelineno-3-6 name=__codelineno-3-6 href=#__codelineno-3-6></a><span class=p>}</span>
|
||||
|
||||
@@ -12,30 +12,30 @@
|
||||
</span><span id=__span-4-4><a id=__codelineno-4-4 name=__codelineno-4-4 href=#__codelineno-4-4></a><span class=go> | | 192.168.0.0/24 | 192.168.0.0/24 | 192.168.0.0/24</span>
|
||||
</span></code></pre></div> <h4 id=use-the-subnet-router>Use the subnet router<a class=headerlink href=#use-the-subnet-router title="Permanent link">¶</a></h4> <p>To accept routes advertised by a subnet router on a node:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-5-1><a id=__codelineno-5-1 name=__codelineno-5-1 href=#__codelineno-5-1></a><span class=gp>$ </span>sudo<span class=w> </span>tailscale<span class=w> </span><span class=nb>set</span><span class=w> </span>--accept-routes
|
||||
</span></code></pre></div> <p>Please refer to the official <a href=https://tailscale.com/docs/features/subnet-routers#use-your-subnet-routes-from-other-devices>Tailscale documentation</a> for how to use a subnet router on different operating systems.</p> <h3 id=restrict-the-use-of-a-subnet-router-with-a-policy>Restrict the use of a subnet router with a policy<a class=headerlink href=#restrict-the-use-of-a-subnet-router-with-a-policy title="Permanent link">¶</a></h3> <p>The routes announced by subnet routers are available to the nodes in a tailnet. By default, without a policy enabled, all nodes can accept and use such routes. Configure a policy to explicitly manage who can use routes.</p> <p>The policy snippet below defines three hosts, a subnet router <code>router</code>, a regular node <code>node</code> and <code>service.example.net</code> as internal service that can be reached via a route on the subnet router <code>router</code>. It allows the node <code>node</code> to access <code>service.example.net</code> on port 80 and 443 which is reachable via the subnet router. Access to the subnet router itself is denied.</p> <div class="language-json highlight"><span class=filename>Access the routes of a subnet router without the subnet router itself</span><pre><span></span><code><span id=__span-6-1><a id=__codelineno-6-1 name=__codelineno-6-1 href=#__codelineno-6-1></a><span class=p>{</span>
|
||||
</span><span id=__span-6-2><a id=__codelineno-6-2 name=__codelineno-6-2 href=#__codelineno-6-2></a><span class=w> </span><span class=nt>"hosts"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-6-2><a id=__codelineno-6-2 name=__codelineno-6-2 href=#__codelineno-6-2></a><span class=w> </span><span class=nt>"hosts"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-6-3><a id=__codelineno-6-3 name=__codelineno-6-3 href=#__codelineno-6-3></a><span class=w> </span><span class=c1>// the router is not referenced but announces 192.168.0.0/24</span>
|
||||
</span><span id=__span-6-4><a id=__codelineno-6-4 name=__codelineno-6-4 href=#__codelineno-6-4></a><span class=w> </span><span class=nt>"router"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.1/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-5><a id=__codelineno-6-5 name=__codelineno-6-5 href=#__codelineno-6-5></a><span class=w> </span><span class=nt>"node"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.2/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-6><a id=__codelineno-6-6 name=__codelineno-6-6 href=#__codelineno-6-6></a><span class=w> </span><span class=nt>"service.example.net"</span><span class=p>:</span><span class=w> </span><span class=s2>"192.168.0.1/32"</span>
|
||||
</span><span id=__span-6-4><a id=__codelineno-6-4 name=__codelineno-6-4 href=#__codelineno-6-4></a><span class=w> </span><span class=nt>"router"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.1/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-5><a id=__codelineno-6-5 name=__codelineno-6-5 href=#__codelineno-6-5></a><span class=w> </span><span class=nt>"node"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.2/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-6><a id=__codelineno-6-6 name=__codelineno-6-6 href=#__codelineno-6-6></a><span class=w> </span><span class=nt>"service.example.net"</span><span class=p>:</span><span class=w> </span><span class=s2>"192.168.0.1/32"</span>
|
||||
</span><span id=__span-6-7><a id=__codelineno-6-7 name=__codelineno-6-7 href=#__codelineno-6-7></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-6-8><a id=__codelineno-6-8 name=__codelineno-6-8 href=#__codelineno-6-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-6-8><a id=__codelineno-6-8 name=__codelineno-6-8 href=#__codelineno-6-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-6-9><a id=__codelineno-6-9 name=__codelineno-6-9 href=#__codelineno-6-9></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-6-10><a id=__codelineno-6-10 name=__codelineno-6-10 href=#__codelineno-6-10></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"node"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-11><a id=__codelineno-6-11 name=__codelineno-6-11 href=#__codelineno-6-11></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"service.example.net"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-12><a id=__codelineno-6-12 name=__codelineno-6-12 href=#__codelineno-6-12></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"80,443"</span><span class=p>]</span>
|
||||
</span><span id=__span-6-10><a id=__codelineno-6-10 name=__codelineno-6-10 href=#__codelineno-6-10></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"node"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-11><a id=__codelineno-6-11 name=__codelineno-6-11 href=#__codelineno-6-11></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"service.example.net"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-12><a id=__codelineno-6-12 name=__codelineno-6-12 href=#__codelineno-6-12></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"80,443"</span><span class=p>]</span>
|
||||
</span><span id=__span-6-13><a id=__codelineno-6-13 name=__codelineno-6-13 href=#__codelineno-6-13></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-6-14><a id=__codelineno-6-14 name=__codelineno-6-14 href=#__codelineno-6-14></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-6-15><a id=__codelineno-6-15 name=__codelineno-6-15 href=#__codelineno-6-15></a><span class=p>}</span>
|
||||
</span></code></pre></div> <h3 id=automatically-approve-routes-of-a-subnet-router>Automatically approve routes of a subnet router<a class=headerlink href=#automatically-approve-routes-of-a-subnet-router title="Permanent link">¶</a></h3> <p>The initial setup of a subnet router usually requires manual approval of their announced routes on the control server before they can be used by a node in a tailnet. Headscale supports the <code>autoApprovers</code> section in a policy to automate the approval of routes served with a subnet router.</p> <p>The policy snippet below defines the tag <code>tag:router</code> owned by the user <code>alice</code>. This tag is used for <code>routes</code> in the <code>autoApprovers</code> section. The IPv4 route <code>192.168.0.0/24</code> is automatically approved once announced by a subnet router that advertises the tag <code>tag:router</code>.</p> <div class="language-json highlight"><span class=filename>Subnet routers tagged with tag:router are automatically approved</span><pre><span></span><code><span id=__span-7-1><a id=__codelineno-7-1 name=__codelineno-7-1 href=#__codelineno-7-1></a><span class=p>{</span>
|
||||
</span><span id=__span-7-2><a id=__codelineno-7-2 name=__codelineno-7-2 href=#__codelineno-7-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-3><a id=__codelineno-7-3 name=__codelineno-7-3 href=#__codelineno-7-3></a><span class=w> </span><span class=nt>"tag:router"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-2><a id=__codelineno-7-2 name=__codelineno-7-2 href=#__codelineno-7-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-3><a id=__codelineno-7-3 name=__codelineno-7-3 href=#__codelineno-7-3></a><span class=w> </span><span class=nt>"tag:router"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-4><a id=__codelineno-7-4 name=__codelineno-7-4 href=#__codelineno-7-4></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-5><a id=__codelineno-7-5 name=__codelineno-7-5 href=#__codelineno-7-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-6><a id=__codelineno-7-6 name=__codelineno-7-6 href=#__codelineno-7-6></a><span class=w> </span><span class=nt>"routes"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-7><a id=__codelineno-7-7 name=__codelineno-7-7 href=#__codelineno-7-7></a><span class=w> </span><span class=nt>"192.168.0.0/24"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:router"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-5><a id=__codelineno-7-5 name=__codelineno-7-5 href=#__codelineno-7-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-6><a id=__codelineno-7-6 name=__codelineno-7-6 href=#__codelineno-7-6></a><span class=w> </span><span class=nt>"routes"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-7><a id=__codelineno-7-7 name=__codelineno-7-7 href=#__codelineno-7-7></a><span class=w> </span><span class=nt>"192.168.0.0/24"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:router"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-8><a id=__codelineno-7-8 name=__codelineno-7-8 href=#__codelineno-7-8></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-7-9><a id=__codelineno-7-9 name=__codelineno-7-9 href=#__codelineno-7-9></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-10><a id=__codelineno-7-10 name=__codelineno-7-10 href=#__codelineno-7-10></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-7-10><a id=__codelineno-7-10 name=__codelineno-7-10 href=#__codelineno-7-10></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-7-11><a id=__codelineno-7-11 name=__codelineno-7-11 href=#__codelineno-7-11></a><span class=w> </span><span class=c1>// more rules</span>
|
||||
</span><span id=__span-7-12><a id=__codelineno-7-12 name=__codelineno-7-12 href=#__codelineno-7-12></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-7-13><a id=__codelineno-7-13 name=__codelineno-7-13 href=#__codelineno-7-13></a><span class=p>}</span>
|
||||
@@ -54,42 +54,42 @@
|
||||
</span><span id=__span-13-4><a id=__codelineno-13-4 name=__codelineno-13-4 href=#__codelineno-13-4></a><span class=go> | | ::/0 | ::/0 | ::/0</span>
|
||||
</span></code></pre></div> <h4 id=use-the-exit-node>Use the exit node<a class=headerlink href=#use-the-exit-node title="Permanent link">¶</a></h4> <p>The exit node can now be used on a node with:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-14-1><a id=__codelineno-14-1 name=__codelineno-14-1 href=#__codelineno-14-1></a><span class=gp>$ </span>sudo<span class=w> </span>tailscale<span class=w> </span><span class=nb>set</span><span class=w> </span>--exit-node<span class=w> </span>myexit
|
||||
</span></code></pre></div> <p>Please refer to the official <a href=https://tailscale.com/docs/features/exit-nodes#use-the-exit-node>Tailscale documentation</a> for how to use an exit node on different operating systems.</p> <h3 id=restrict-the-use-of-an-exit-node-with-a-policy>Restrict the use of an exit node with a policy<a class=headerlink href=#restrict-the-use-of-an-exit-node-with-a-policy title="Permanent link">¶</a></h3> <p>An exit node is offered to all nodes in a tailnet. By default, without a policy enabled, all nodes in a tailnet can select and use an exit node. Configure <code>autogroup:internet</code> in a policy rule to restrict who can use <em>any</em> of the available exit nodes.</p> <div class="language-json highlight"><span class=filename>Example use of autogroup:internet</span><pre><span></span><code><span id=__span-15-1><a id=__codelineno-15-1 name=__codelineno-15-1 href=#__codelineno-15-1></a><span class=p>{</span>
|
||||
</span><span id=__span-15-2><a id=__codelineno-15-2 name=__codelineno-15-2 href=#__codelineno-15-2></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-15-2><a id=__codelineno-15-2 name=__codelineno-15-2 href=#__codelineno-15-2></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-15-3><a id=__codelineno-15-3 name=__codelineno-15-3 href=#__codelineno-15-3></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-15-4><a id=__codelineno-15-4 name=__codelineno-15-4 href=#__codelineno-15-4></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"..."</span><span class=p>],</span>
|
||||
</span><span id=__span-15-5><a id=__codelineno-15-5 name=__codelineno-15-5 href=#__codelineno-15-5></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-15-6><a id=__codelineno-15-6 name=__codelineno-15-6 href=#__codelineno-15-6></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-15-4><a id=__codelineno-15-4 name=__codelineno-15-4 href=#__codelineno-15-4></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"..."</span><span class=p>],</span>
|
||||
</span><span id=__span-15-5><a id=__codelineno-15-5 name=__codelineno-15-5 href=#__codelineno-15-5></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-15-6><a id=__codelineno-15-6 name=__codelineno-15-6 href=#__codelineno-15-6></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-15-7><a id=__codelineno-15-7 name=__codelineno-15-7 href=#__codelineno-15-7></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-15-8><a id=__codelineno-15-8 name=__codelineno-15-8 href=#__codelineno-15-8></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-15-9><a id=__codelineno-15-9 name=__codelineno-15-9 href=#__codelineno-15-9></a><span class=p>}</span>
|
||||
</span></code></pre></div> <h3 id=restrict-access-to-exit-nodes-per-user-or-group>Restrict access to exit nodes per user or group<a class=headerlink href=#restrict-access-to-exit-nodes-per-user-or-group title="Permanent link">¶</a></h3> <p>A user can use <em>any</em> of the available exit nodes with <code>autogroup:internet</code>. Alternatively, the policy snippet below assigns each user a specific exit node while hiding all other exit nodes. The user <code>alice</code> can only use an exit node tagged with <code>tag:exit1</code> while user <code>bob</code> can only use an exit node tagged with <code>tag:exit2</code>.</p> <div class="language-json highlight"><span class=filename>Assign each user a dedicated exit node</span><pre><span></span><code><span id=__span-16-1><a id=__codelineno-16-1 name=__codelineno-16-1 href=#__codelineno-16-1></a><span class=p>{</span>
|
||||
</span><span id=__span-16-2><a id=__codelineno-16-2 name=__codelineno-16-2 href=#__codelineno-16-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-3><a id=__codelineno-16-3 name=__codelineno-16-3 href=#__codelineno-16-3></a><span class=w> </span><span class=nt>"tag:exit1"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-4><a id=__codelineno-16-4 name=__codelineno-16-4 href=#__codelineno-16-4></a><span class=w> </span><span class=nt>"tag:exit2"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-2><a id=__codelineno-16-2 name=__codelineno-16-2 href=#__codelineno-16-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-3><a id=__codelineno-16-3 name=__codelineno-16-3 href=#__codelineno-16-3></a><span class=w> </span><span class=nt>"tag:exit1"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-4><a id=__codelineno-16-4 name=__codelineno-16-4 href=#__codelineno-16-4></a><span class=w> </span><span class=nt>"tag:exit2"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-5><a id=__codelineno-16-5 name=__codelineno-16-5 href=#__codelineno-16-5></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-16-6><a id=__codelineno-16-6 name=__codelineno-16-6 href=#__codelineno-16-6></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-16-6><a id=__codelineno-16-6 name=__codelineno-16-6 href=#__codelineno-16-6></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-16-7><a id=__codelineno-16-7 name=__codelineno-16-7 href=#__codelineno-16-7></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-8><a id=__codelineno-16-8 name=__codelineno-16-8 href=#__codelineno-16-8></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-9><a id=__codelineno-16-9 name=__codelineno-16-9 href=#__codelineno-16-9></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-10><a id=__codelineno-16-10 name=__codelineno-16-10 href=#__codelineno-16-10></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit1"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-11><a id=__codelineno-16-11 name=__codelineno-16-11 href=#__codelineno-16-11></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-8><a id=__codelineno-16-8 name=__codelineno-16-8 href=#__codelineno-16-8></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-9><a id=__codelineno-16-9 name=__codelineno-16-9 href=#__codelineno-16-9></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-10><a id=__codelineno-16-10 name=__codelineno-16-10 href=#__codelineno-16-10></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit1"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-11><a id=__codelineno-16-11 name=__codelineno-16-11 href=#__codelineno-16-11></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-12><a id=__codelineno-16-12 name=__codelineno-16-12 href=#__codelineno-16-12></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-16-13><a id=__codelineno-16-13 name=__codelineno-16-13 href=#__codelineno-16-13></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-14><a id=__codelineno-16-14 name=__codelineno-16-14 href=#__codelineno-16-14></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-15><a id=__codelineno-16-15 name=__codelineno-16-15 href=#__codelineno-16-15></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-16><a id=__codelineno-16-16 name=__codelineno-16-16 href=#__codelineno-16-16></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit2"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-17><a id=__codelineno-16-17 name=__codelineno-16-17 href=#__codelineno-16-17></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-14><a id=__codelineno-16-14 name=__codelineno-16-14 href=#__codelineno-16-14></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-15><a id=__codelineno-16-15 name=__codelineno-16-15 href=#__codelineno-16-15></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-16><a id=__codelineno-16-16 name=__codelineno-16-16 href=#__codelineno-16-16></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit2"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-17><a id=__codelineno-16-17 name=__codelineno-16-17 href=#__codelineno-16-17></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-18><a id=__codelineno-16-18 name=__codelineno-16-18 href=#__codelineno-16-18></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-16-19><a id=__codelineno-16-19 name=__codelineno-16-19 href=#__codelineno-16-19></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-16-20><a id=__codelineno-16-20 name=__codelineno-16-20 href=#__codelineno-16-20></a><span class=p>}</span>
|
||||
</span></code></pre></div> <h3 id=automatically-approve-an-exit-node-with-auto-approvers>Automatically approve an exit node with auto approvers<a class=headerlink href=#automatically-approve-an-exit-node-with-auto-approvers title="Permanent link">¶</a></h3> <p>The initial setup of an exit node usually requires manual approval on the control server before it can be used by a node in a tailnet. Headscale supports the <code>autoApprovers</code> section in a policy to automate the approval of a new exit node as soon as it joins the tailnet.</p> <p>The policy snippet below defines the tag <code>tag:exit</code> owned by the user <code>alice</code>. This tag is used for the <code>exitNode</code> entry in the <code>autoApprovers</code> section. A new exit node that advertises the tag <code>tag:exit</code> is automatically approved:</p> <div class="language-json highlight"><span class=filename>Exit nodes tagged with tag:exit are automatically approved</span><pre><span></span><code><span id=__span-17-1><a id=__codelineno-17-1 name=__codelineno-17-1 href=#__codelineno-17-1></a><span class=p>{</span>
|
||||
</span><span id=__span-17-2><a id=__codelineno-17-2 name=__codelineno-17-2 href=#__codelineno-17-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-3><a id=__codelineno-17-3 name=__codelineno-17-3 href=#__codelineno-17-3></a><span class=w> </span><span class=nt>"tag:exit"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-2><a id=__codelineno-17-2 name=__codelineno-17-2 href=#__codelineno-17-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-3><a id=__codelineno-17-3 name=__codelineno-17-3 href=#__codelineno-17-3></a><span class=w> </span><span class=nt>"tag:exit"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-4><a id=__codelineno-17-4 name=__codelineno-17-4 href=#__codelineno-17-4></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-17-5><a id=__codelineno-17-5 name=__codelineno-17-5 href=#__codelineno-17-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-6><a id=__codelineno-17-6 name=__codelineno-17-6 href=#__codelineno-17-6></a><span class=w> </span><span class=nt>"exitNode"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-5><a id=__codelineno-17-5 name=__codelineno-17-5 href=#__codelineno-17-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-6><a id=__codelineno-17-6 name=__codelineno-17-6 href=#__codelineno-17-6></a><span class=w> </span><span class=nt>"exitNode"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-7><a id=__codelineno-17-7 name=__codelineno-17-7 href=#__codelineno-17-7></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-17-8><a id=__codelineno-17-8 name=__codelineno-17-8 href=#__codelineno-17-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-17-8><a id=__codelineno-17-8 name=__codelineno-17-8 href=#__codelineno-17-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-17-9><a id=__codelineno-17-9 name=__codelineno-17-9 href=#__codelineno-17-9></a><span class=w> </span><span class=c1>// more rules</span>
|
||||
</span><span id=__span-17-10><a id=__codelineno-17-10 name=__codelineno-17-10 href=#__codelineno-17-10></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-17-11><a id=__codelineno-17-11 name=__codelineno-17-11 href=#__codelineno-17-11></a><span class=p>}</span>
|
||||
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user