mirror of
https://github.com/juanfont/headscale.git
synced 2026-09-10 18:51:38 +09:00
Deployed 63123196 to development with ProperDocs 1.6.7 and mike 2.2.0
This commit is contained in:
github-actions
@@ -12,30 +12,30 @@
|
||||
</span><span id=__span-4-4><a id=__codelineno-4-4 name=__codelineno-4-4 href=#__codelineno-4-4></a><span class=go> | | 192.168.0.0/24 | 192.168.0.0/24 | 192.168.0.0/24</span>
|
||||
</span></code></pre></div> <h4 id=use-the-subnet-router>Use the subnet router<a class=headerlink href=#use-the-subnet-router title="Permanent link">¶</a></h4> <p>To accept routes advertised by a subnet router on a node:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-5-1><a id=__codelineno-5-1 name=__codelineno-5-1 href=#__codelineno-5-1></a><span class=gp>$ </span>sudo<span class=w> </span>tailscale<span class=w> </span><span class=nb>set</span><span class=w> </span>--accept-routes
|
||||
</span></code></pre></div> <p>Please refer to the official <a href=https://tailscale.com/docs/features/subnet-routers#use-your-subnet-routes-from-other-devices>Tailscale documentation</a> for how to use a subnet router on different operating systems.</p> <h3 id=restrict-the-use-of-a-subnet-router-with-a-policy>Restrict the use of a subnet router with a policy<a class=headerlink href=#restrict-the-use-of-a-subnet-router-with-a-policy title="Permanent link">¶</a></h3> <p>The routes announced by subnet routers are available to the nodes in a tailnet. By default, without a policy enabled, all nodes can accept and use such routes. Configure a policy to explicitly manage who can use routes.</p> <p>The policy snippet below defines three hosts, a subnet router <code>router</code>, a regular node <code>node</code> and <code>service.example.net</code> as internal service that can be reached via a route on the subnet router <code>router</code>. It allows the node <code>node</code> to access <code>service.example.net</code> on port 80 and 443 which is reachable via the subnet router. Access to the subnet router itself is denied.</p> <div class="language-json highlight"><span class=filename>Access the routes of a subnet router without the subnet router itself</span><pre><span></span><code><span id=__span-6-1><a id=__codelineno-6-1 name=__codelineno-6-1 href=#__codelineno-6-1></a><span class=p>{</span>
|
||||
</span><span id=__span-6-2><a id=__codelineno-6-2 name=__codelineno-6-2 href=#__codelineno-6-2></a><span class=w> </span><span class=nt>"hosts"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-6-2><a id=__codelineno-6-2 name=__codelineno-6-2 href=#__codelineno-6-2></a><span class=w> </span><span class=nt>"hosts"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-6-3><a id=__codelineno-6-3 name=__codelineno-6-3 href=#__codelineno-6-3></a><span class=w> </span><span class=c1>// the router is not referenced but announces 192.168.0.0/24</span>
|
||||
</span><span id=__span-6-4><a id=__codelineno-6-4 name=__codelineno-6-4 href=#__codelineno-6-4></a><span class=w> </span><span class=nt>"router"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.1/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-5><a id=__codelineno-6-5 name=__codelineno-6-5 href=#__codelineno-6-5></a><span class=w> </span><span class=nt>"node"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.2/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-6><a id=__codelineno-6-6 name=__codelineno-6-6 href=#__codelineno-6-6></a><span class=w> </span><span class=nt>"service.example.net"</span><span class=p>:</span><span class=w> </span><span class=s2>"192.168.0.1/32"</span>
|
||||
</span><span id=__span-6-4><a id=__codelineno-6-4 name=__codelineno-6-4 href=#__codelineno-6-4></a><span class=w> </span><span class=nt>"router"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.1/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-5><a id=__codelineno-6-5 name=__codelineno-6-5 href=#__codelineno-6-5></a><span class=w> </span><span class=nt>"node"</span><span class=p>:</span><span class=w> </span><span class=s2>"100.64.0.2/32"</span><span class=p>,</span>
|
||||
</span><span id=__span-6-6><a id=__codelineno-6-6 name=__codelineno-6-6 href=#__codelineno-6-6></a><span class=w> </span><span class=nt>"service.example.net"</span><span class=p>:</span><span class=w> </span><span class=s2>"192.168.0.1/32"</span>
|
||||
</span><span id=__span-6-7><a id=__codelineno-6-7 name=__codelineno-6-7 href=#__codelineno-6-7></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-6-8><a id=__codelineno-6-8 name=__codelineno-6-8 href=#__codelineno-6-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-6-8><a id=__codelineno-6-8 name=__codelineno-6-8 href=#__codelineno-6-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-6-9><a id=__codelineno-6-9 name=__codelineno-6-9 href=#__codelineno-6-9></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-6-10><a id=__codelineno-6-10 name=__codelineno-6-10 href=#__codelineno-6-10></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"node"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-11><a id=__codelineno-6-11 name=__codelineno-6-11 href=#__codelineno-6-11></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"service.example.net"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-12><a id=__codelineno-6-12 name=__codelineno-6-12 href=#__codelineno-6-12></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"80,443"</span><span class=p>]</span>
|
||||
</span><span id=__span-6-10><a id=__codelineno-6-10 name=__codelineno-6-10 href=#__codelineno-6-10></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"node"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-11><a id=__codelineno-6-11 name=__codelineno-6-11 href=#__codelineno-6-11></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"service.example.net"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-12><a id=__codelineno-6-12 name=__codelineno-6-12 href=#__codelineno-6-12></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"80,443"</span><span class=p>]</span>
|
||||
</span><span id=__span-6-13><a id=__codelineno-6-13 name=__codelineno-6-13 href=#__codelineno-6-13></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-6-14><a id=__codelineno-6-14 name=__codelineno-6-14 href=#__codelineno-6-14></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-6-15><a id=__codelineno-6-15 name=__codelineno-6-15 href=#__codelineno-6-15></a><span class=p>}</span>
|
||||
</span></code></pre></div> <h3 id=automatically-approve-routes-of-a-subnet-router>Automatically approve routes of a subnet router<a class=headerlink href=#automatically-approve-routes-of-a-subnet-router title="Permanent link">¶</a></h3> <p>The initial setup of a subnet router usually requires manual approval of their announced routes on the control server before they can be used by a node in a tailnet. Headscale supports the <code>autoApprovers</code> section in a policy to automate the approval of routes served with a subnet router.</p> <p>The policy snippet below defines the tag <code>tag:router</code> owned by the user <code>alice</code>. This tag is used for <code>routes</code> in the <code>autoApprovers</code> section. The IPv4 route <code>192.168.0.0/24</code> is automatically approved once announced by a subnet router that advertises the tag <code>tag:router</code>.</p> <div class="language-json highlight"><span class=filename>Subnet routers tagged with tag:router are automatically approved</span><pre><span></span><code><span id=__span-7-1><a id=__codelineno-7-1 name=__codelineno-7-1 href=#__codelineno-7-1></a><span class=p>{</span>
|
||||
</span><span id=__span-7-2><a id=__codelineno-7-2 name=__codelineno-7-2 href=#__codelineno-7-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-3><a id=__codelineno-7-3 name=__codelineno-7-3 href=#__codelineno-7-3></a><span class=w> </span><span class=nt>"tag:router"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-2><a id=__codelineno-7-2 name=__codelineno-7-2 href=#__codelineno-7-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-3><a id=__codelineno-7-3 name=__codelineno-7-3 href=#__codelineno-7-3></a><span class=w> </span><span class=nt>"tag:router"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-4><a id=__codelineno-7-4 name=__codelineno-7-4 href=#__codelineno-7-4></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-5><a id=__codelineno-7-5 name=__codelineno-7-5 href=#__codelineno-7-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-6><a id=__codelineno-7-6 name=__codelineno-7-6 href=#__codelineno-7-6></a><span class=w> </span><span class=nt>"routes"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-7><a id=__codelineno-7-7 name=__codelineno-7-7 href=#__codelineno-7-7></a><span class=w> </span><span class=nt>"192.168.0.0/24"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:router"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-5><a id=__codelineno-7-5 name=__codelineno-7-5 href=#__codelineno-7-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-6><a id=__codelineno-7-6 name=__codelineno-7-6 href=#__codelineno-7-6></a><span class=w> </span><span class=nt>"routes"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-7-7><a id=__codelineno-7-7 name=__codelineno-7-7 href=#__codelineno-7-7></a><span class=w> </span><span class=nt>"192.168.0.0/24"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:router"</span><span class=p>]</span>
|
||||
</span><span id=__span-7-8><a id=__codelineno-7-8 name=__codelineno-7-8 href=#__codelineno-7-8></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-7-9><a id=__codelineno-7-9 name=__codelineno-7-9 href=#__codelineno-7-9></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-10><a id=__codelineno-7-10 name=__codelineno-7-10 href=#__codelineno-7-10></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-7-10><a id=__codelineno-7-10 name=__codelineno-7-10 href=#__codelineno-7-10></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-7-11><a id=__codelineno-7-11 name=__codelineno-7-11 href=#__codelineno-7-11></a><span class=w> </span><span class=c1>// more rules</span>
|
||||
</span><span id=__span-7-12><a id=__codelineno-7-12 name=__codelineno-7-12 href=#__codelineno-7-12></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-7-13><a id=__codelineno-7-13 name=__codelineno-7-13 href=#__codelineno-7-13></a><span class=p>}</span>
|
||||
@@ -54,42 +54,42 @@
|
||||
</span><span id=__span-13-4><a id=__codelineno-13-4 name=__codelineno-13-4 href=#__codelineno-13-4></a><span class=go> | | ::/0 | ::/0 | ::/0</span>
|
||||
</span></code></pre></div> <h4 id=use-the-exit-node>Use the exit node<a class=headerlink href=#use-the-exit-node title="Permanent link">¶</a></h4> <p>The exit node can now be used on a node with:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-14-1><a id=__codelineno-14-1 name=__codelineno-14-1 href=#__codelineno-14-1></a><span class=gp>$ </span>sudo<span class=w> </span>tailscale<span class=w> </span><span class=nb>set</span><span class=w> </span>--exit-node<span class=w> </span>myexit
|
||||
</span></code></pre></div> <p>Please refer to the official <a href=https://tailscale.com/docs/features/exit-nodes#use-the-exit-node>Tailscale documentation</a> for how to use an exit node on different operating systems.</p> <h3 id=restrict-the-use-of-an-exit-node-with-a-policy>Restrict the use of an exit node with a policy<a class=headerlink href=#restrict-the-use-of-an-exit-node-with-a-policy title="Permanent link">¶</a></h3> <p>An exit node is offered to all nodes in a tailnet. By default, without a policy enabled, all nodes in a tailnet can select and use an exit node. Configure <code>autogroup:internet</code> in a policy rule to restrict who can use <em>any</em> of the available exit nodes.</p> <div class="language-json highlight"><span class=filename>Example use of autogroup:internet</span><pre><span></span><code><span id=__span-15-1><a id=__codelineno-15-1 name=__codelineno-15-1 href=#__codelineno-15-1></a><span class=p>{</span>
|
||||
</span><span id=__span-15-2><a id=__codelineno-15-2 name=__codelineno-15-2 href=#__codelineno-15-2></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-15-2><a id=__codelineno-15-2 name=__codelineno-15-2 href=#__codelineno-15-2></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-15-3><a id=__codelineno-15-3 name=__codelineno-15-3 href=#__codelineno-15-3></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-15-4><a id=__codelineno-15-4 name=__codelineno-15-4 href=#__codelineno-15-4></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"..."</span><span class=p>],</span>
|
||||
</span><span id=__span-15-5><a id=__codelineno-15-5 name=__codelineno-15-5 href=#__codelineno-15-5></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-15-6><a id=__codelineno-15-6 name=__codelineno-15-6 href=#__codelineno-15-6></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-15-4><a id=__codelineno-15-4 name=__codelineno-15-4 href=#__codelineno-15-4></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"..."</span><span class=p>],</span>
|
||||
</span><span id=__span-15-5><a id=__codelineno-15-5 name=__codelineno-15-5 href=#__codelineno-15-5></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-15-6><a id=__codelineno-15-6 name=__codelineno-15-6 href=#__codelineno-15-6></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-15-7><a id=__codelineno-15-7 name=__codelineno-15-7 href=#__codelineno-15-7></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-15-8><a id=__codelineno-15-8 name=__codelineno-15-8 href=#__codelineno-15-8></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-15-9><a id=__codelineno-15-9 name=__codelineno-15-9 href=#__codelineno-15-9></a><span class=p>}</span>
|
||||
</span></code></pre></div> <h3 id=restrict-access-to-exit-nodes-per-user-or-group>Restrict access to exit nodes per user or group<a class=headerlink href=#restrict-access-to-exit-nodes-per-user-or-group title="Permanent link">¶</a></h3> <p>A user can use <em>any</em> of the available exit nodes with <code>autogroup:internet</code>. Alternatively, the policy snippet below assigns each user a specific exit node while hiding all other exit nodes. The user <code>alice</code> can only use an exit node tagged with <code>tag:exit1</code> while user <code>bob</code> can only use an exit node tagged with <code>tag:exit2</code>.</p> <div class="language-json highlight"><span class=filename>Assign each user a dedicated exit node</span><pre><span></span><code><span id=__span-16-1><a id=__codelineno-16-1 name=__codelineno-16-1 href=#__codelineno-16-1></a><span class=p>{</span>
|
||||
</span><span id=__span-16-2><a id=__codelineno-16-2 name=__codelineno-16-2 href=#__codelineno-16-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-3><a id=__codelineno-16-3 name=__codelineno-16-3 href=#__codelineno-16-3></a><span class=w> </span><span class=nt>"tag:exit1"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-4><a id=__codelineno-16-4 name=__codelineno-16-4 href=#__codelineno-16-4></a><span class=w> </span><span class=nt>"tag:exit2"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-2><a id=__codelineno-16-2 name=__codelineno-16-2 href=#__codelineno-16-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-3><a id=__codelineno-16-3 name=__codelineno-16-3 href=#__codelineno-16-3></a><span class=w> </span><span class=nt>"tag:exit1"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-4><a id=__codelineno-16-4 name=__codelineno-16-4 href=#__codelineno-16-4></a><span class=w> </span><span class=nt>"tag:exit2"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-5><a id=__codelineno-16-5 name=__codelineno-16-5 href=#__codelineno-16-5></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-16-6><a id=__codelineno-16-6 name=__codelineno-16-6 href=#__codelineno-16-6></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-16-6><a id=__codelineno-16-6 name=__codelineno-16-6 href=#__codelineno-16-6></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-16-7><a id=__codelineno-16-7 name=__codelineno-16-7 href=#__codelineno-16-7></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-8><a id=__codelineno-16-8 name=__codelineno-16-8 href=#__codelineno-16-8></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-9><a id=__codelineno-16-9 name=__codelineno-16-9 href=#__codelineno-16-9></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-10><a id=__codelineno-16-10 name=__codelineno-16-10 href=#__codelineno-16-10></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit1"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-11><a id=__codelineno-16-11 name=__codelineno-16-11 href=#__codelineno-16-11></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-8><a id=__codelineno-16-8 name=__codelineno-16-8 href=#__codelineno-16-8></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-9><a id=__codelineno-16-9 name=__codelineno-16-9 href=#__codelineno-16-9></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-10><a id=__codelineno-16-10 name=__codelineno-16-10 href=#__codelineno-16-10></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit1"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-11><a id=__codelineno-16-11 name=__codelineno-16-11 href=#__codelineno-16-11></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-12><a id=__codelineno-16-12 name=__codelineno-16-12 href=#__codelineno-16-12></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-16-13><a id=__codelineno-16-13 name=__codelineno-16-13 href=#__codelineno-16-13></a><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-16-14><a id=__codelineno-16-14 name=__codelineno-16-14 href=#__codelineno-16-14></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-15><a id=__codelineno-16-15 name=__codelineno-16-15 href=#__codelineno-16-15></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-16><a id=__codelineno-16-16 name=__codelineno-16-16 href=#__codelineno-16-16></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit2"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-17><a id=__codelineno-16-17 name=__codelineno-16-17 href=#__codelineno-16-17></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-14><a id=__codelineno-16-14 name=__codelineno-16-14 href=#__codelineno-16-14></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"bob@"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-15><a id=__codelineno-16-15 name=__codelineno-16-15 href=#__codelineno-16-15></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-16><a id=__codelineno-16-16 name=__codelineno-16-16 href=#__codelineno-16-16></a><span class=w> </span><span class=nt>"via"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit2"</span><span class=p>],</span>
|
||||
</span><span id=__span-16-17><a id=__codelineno-16-17 name=__codelineno-16-17 href=#__codelineno-16-17></a><span class=w> </span><span class=nt>"ip"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"*"</span><span class=p>]</span>
|
||||
</span><span id=__span-16-18><a id=__codelineno-16-18 name=__codelineno-16-18 href=#__codelineno-16-18></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-16-19><a id=__codelineno-16-19 name=__codelineno-16-19 href=#__codelineno-16-19></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-16-20><a id=__codelineno-16-20 name=__codelineno-16-20 href=#__codelineno-16-20></a><span class=p>}</span>
|
||||
</span></code></pre></div> <h3 id=automatically-approve-an-exit-node-with-auto-approvers>Automatically approve an exit node with auto approvers<a class=headerlink href=#automatically-approve-an-exit-node-with-auto-approvers title="Permanent link">¶</a></h3> <p>The initial setup of an exit node usually requires manual approval on the control server before it can be used by a node in a tailnet. Headscale supports the <code>autoApprovers</code> section in a policy to automate the approval of a new exit node as soon as it joins the tailnet.</p> <p>The policy snippet below defines the tag <code>tag:exit</code> owned by the user <code>alice</code>. This tag is used for the <code>exitNode</code> entry in the <code>autoApprovers</code> section. A new exit node that advertises the tag <code>tag:exit</code> is automatically approved:</p> <div class="language-json highlight"><span class=filename>Exit nodes tagged with tag:exit are automatically approved</span><pre><span></span><code><span id=__span-17-1><a id=__codelineno-17-1 name=__codelineno-17-1 href=#__codelineno-17-1></a><span class=p>{</span>
|
||||
</span><span id=__span-17-2><a id=__codelineno-17-2 name=__codelineno-17-2 href=#__codelineno-17-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-3><a id=__codelineno-17-3 name=__codelineno-17-3 href=#__codelineno-17-3></a><span class=w> </span><span class=nt>"tag:exit"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-2><a id=__codelineno-17-2 name=__codelineno-17-2 href=#__codelineno-17-2></a><span class=w> </span><span class=nt>"tagOwners"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-3><a id=__codelineno-17-3 name=__codelineno-17-3 href=#__codelineno-17-3></a><span class=w> </span><span class=nt>"tag:exit"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"alice@"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-4><a id=__codelineno-17-4 name=__codelineno-17-4 href=#__codelineno-17-4></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-17-5><a id=__codelineno-17-5 name=__codelineno-17-5 href=#__codelineno-17-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-6><a id=__codelineno-17-6 name=__codelineno-17-6 href=#__codelineno-17-6></a><span class=w> </span><span class=nt>"exitNode"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-5><a id=__codelineno-17-5 name=__codelineno-17-5 href=#__codelineno-17-5></a><span class=w> </span><span class=nt>"autoApprovers"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-17-6><a id=__codelineno-17-6 name=__codelineno-17-6 href=#__codelineno-17-6></a><span class=w> </span><span class=nt>"exitNode"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"tag:exit"</span><span class=p>]</span>
|
||||
</span><span id=__span-17-7><a id=__codelineno-17-7 name=__codelineno-17-7 href=#__codelineno-17-7></a><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-17-8><a id=__codelineno-17-8 name=__codelineno-17-8 href=#__codelineno-17-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-17-8><a id=__codelineno-17-8 name=__codelineno-17-8 href=#__codelineno-17-8></a><span class=w> </span><span class=nt>"grants"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-17-9><a id=__codelineno-17-9 name=__codelineno-17-9 href=#__codelineno-17-9></a><span class=w> </span><span class=c1>// more rules</span>
|
||||
</span><span id=__span-17-10><a id=__codelineno-17-10 name=__codelineno-17-10 href=#__codelineno-17-10></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-17-11><a id=__codelineno-17-11 name=__codelineno-17-11 href=#__codelineno-17-11></a><span class=p>}</span>
|
||||
|
||||
Reference in New Issue
Block a user