public/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-07-09 01:20:21 +09:00
Code Issues Packages Projects Releases Wiki Activity

Deployed 72adc5ff to development with ProperDocs 1.6.7 and mike 2.2.0

Browse Source
This commit is contained in:
github-actions
2026-06-19 13:22:36 +00:00
parent ffd81c2eac
commit c1a6d2eeb5
8 changed files with 50 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
development/about/faq/index.html
+1 -1
View File
File diff suppressed because one or more lines are too long
development/ref/api/index.html
+6 -6
View File
File diff suppressed because one or more lines are too long
development/ref/integration/reverse-proxy/index.html
+6 -7
View File
@@ -4,15 +4,14 @@
</span></code></pre></div> <p>Headscale logs <code>WRN listening without TLS but ServerURL does not start with http://</code> during startup. This is expected and indicates that the reverse proxy is in charge of terminating TLS.</p> <h3 id=trusted-proxies>Trusted proxies<a class=headerlink href=#trusted-proxies title="Permanent link">&para;</a></h3> <p>Headscale ignores <code>True-Client-IP</code>, <code>X-Real-IP</code> and <code>X-Forwarded-For</code> headers unless the request's TCP peer matches the <code>trusted_proxies</code> configuration option. Set this to the CIDR(s) your reverse proxy connects from so the real client IP appears in access logs.</p> <div class="language-yaml highlight"><span class=filename>config.yaml</span><pre><span></span><code><span id=__span-1-1><a id=__codelineno-1-1 name=__codelineno-1-1 href=#__codelineno-1-1></a><span class=nt>trusted_proxies</span><span class=p>:</span>
</span><span id=__span-1-2><a id=__codelineno-1-2 name=__codelineno-1-2 href=#__codelineno-1-2></a><span class=w> </span><span class="p p-Indicator">-</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">127.0.0.1/32</span>
</span><span id=__span-1-3><a id=__codelineno-1-3 name=__codelineno-1-3 href=#__codelineno-1-3></a><span class=w> </span><span class="p p-Indicator">-</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">::1/128</span>
</span></code></pre></div> <p>The reverse proxy is responsible to replace any client-supplied <code>True-Client-IP</code>, <code>X-Real-IP</code>, <code>X-Forwarded-For</code> headers on inbound requests with sanitized values. Headscale picks the first valid IP address supplied by headers in this order:</p> <ul> <li><code>True-Client-IP</code></li> <li><code>X-Real-IP</code></li> <li><code>X-Forwarded-For</code></li> </ul> <h2 id=limitations>Limitations<a class=headerlink href=#limitations title="Permanent link">&para;</a></h2> <ul> <li>A reverse proxy adds another layer of complexity that needs to be able to handle the <a href=#websocket>Tailscale Control Protocol</a> properly. Be sure to test your setup without a reverse proxy before raising an issue.</li> <li>STUN (used along with the <a href=../../derp/ >embedded DERP server</a>) requires udp/3478 to be served publicly.</li> <li><a href=../../api/#grpc>gRPC</a> (used to remote control Headscale) may not be proxied.</li> </ul> <h2 id=reverse-proxy-specific-configuration>Reverse proxy specific configuration<a class=headerlink href=#reverse-proxy-specific-configuration title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Third-party software and services</p> <p>This section of the documentation is specific for third-party software and services. We recommend users read the third-party documentation for a secure configuration.</p> </div> <p>This following Headscale configuration may be used as base for the various reverse proxy examples below. The following is <a href=../../../setup/requirements/ >assumed</a>:</p> <ul> <li>Service for Tailscale clients is served via HTTPS on port 443.</li> <li>The reverse proxy redirects HTTP to HTTPS and is terminating TLS.</li> <li>Both Headscale and the reverse proxy are running on the same host.</li> <li><a href=../../debug/#metrics-and-debug-endpoint>Metrics</a> and <a href=../../api/#grpc>gRPC</a> are not proxied, those are available via localhost.</li> </ul> <div class="language-yaml highlight"><span class=filename>config.yaml</span><pre><span></span><code><span id=__span-2-1><a id=__codelineno-2-1 name=__codelineno-2-1 href=#__codelineno-2-1></a><span class=hll><span class=nt>server_url</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">https://&lt;SERVER_NAME&gt;</span>
</span></code></pre></div> <p>The reverse proxy is responsible to replace any client-supplied <code>True-Client-IP</code>, <code>X-Real-IP</code>, <code>X-Forwarded-For</code> headers on inbound requests with sanitized values. Headscale picks the first valid IP address supplied by headers in this order:</p> <ul> <li><code>True-Client-IP</code></li> <li><code>X-Real-IP</code></li> <li><code>X-Forwarded-For</code></li> </ul> <h2 id=limitations>Limitations<a class=headerlink href=#limitations title="Permanent link">&para;</a></h2> <ul> <li>A reverse proxy adds another layer of complexity that needs to be able to handle the <a href=#websocket>Tailscale Control Protocol</a> properly. Be sure to test your setup without a reverse proxy before raising an issue.</li> <li>STUN (used along with the <a href=../../derp/ >embedded DERP server</a>) requires udp/3478 to be served publicly.</li> </ul> <h2 id=reverse-proxy-specific-configuration>Reverse proxy specific configuration<a class=headerlink href=#reverse-proxy-specific-configuration title="Permanent link">&para;</a></h2> <div class="admonition warning"> <p class=admonition-title>Third-party software and services</p> <p>This section of the documentation is specific for third-party software and services. We recommend users read the third-party documentation for a secure configuration.</p> </div> <p>This following Headscale configuration may be used as base for the various reverse proxy examples below. The following is <a href=../../../setup/requirements/ >assumed</a>:</p> <ul> <li>Service for Tailscale clients is served via HTTPS on port 443.</li> <li>The reverse proxy redirects HTTP to HTTPS and is terminating TLS.</li> <li>Both Headscale and the reverse proxy are running on the same host.</li> <li><a href=../../debug/#metrics-and-debug-endpoint>Metrics</a> are not proxied, those are available via localhost.</li> </ul> <div class="language-yaml highlight"><span class=filename>config.yaml</span><pre><span></span><code><span id=__span-2-1><a id=__codelineno-2-1 name=__codelineno-2-1 href=#__codelineno-2-1></a><span class=hll><span class=nt>server_url</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">https://&lt;SERVER_NAME&gt;</span>
</span></span><span id=__span-2-2><a id=__codelineno-2-2 name=__codelineno-2-2 href=#__codelineno-2-2></a><span class=nt>listen_addr</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">127.0.0.1:8080</span>
</span><span id=__span-2-3><a id=__codelineno-2-3 name=__codelineno-2-3 href=#__codelineno-2-3></a><span class=nt>metrics_listen_addr</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">127.0.0.1:9090</span>
</span><span id=__span-2-4><a id=__codelineno-2-4 name=__codelineno-2-4 href=#__codelineno-2-4></a><span class=nt>grpc_listen_addr</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">127.0.0.1:50443</span>
</span><span id=__span-2-5><a id=__codelineno-2-5 name=__codelineno-2-5 href=#__codelineno-2-5></a><span class=nt>trusted_proxies</span><span class=p>:</span>
</span><span id=__span-2-6><a id=__codelineno-2-6 name=__codelineno-2-6 href=#__codelineno-2-6></a><span class=w> </span><span class="p p-Indicator">-</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">127.0.0.1/32</span>
</span><span id=__span-2-7><a id=__codelineno-2-7 name=__codelineno-2-7 href=#__codelineno-2-7></a><span class=w> </span><span class="p p-Indicator">-</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">::1/128</span>
</span><span id=__span-2-8><a id=__codelineno-2-8 name=__codelineno-2-8 href=#__codelineno-2-8></a><span class=nt>tls_cert_path</span><span class=p>:</span><span class=w> </span><span class=s>&quot;&quot;</span>
</span><span id=__span-2-9><a id=__codelineno-2-9 name=__codelineno-2-9 href=#__codelineno-2-9></a><span class=nt>tls_key_path</span><span class=p>:</span><span class=w> </span><span class=s>&quot;&quot;</span>
</span><span id=__span-2-4><a id=__codelineno-2-4 name=__codelineno-2-4 href=#__codelineno-2-4></a><span class=nt>trusted_proxies</span><span class=p>:</span>
</span><span id=__span-2-5><a id=__codelineno-2-5 name=__codelineno-2-5 href=#__codelineno-2-5></a><span class=w> </span><span class="p p-Indicator">-</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">127.0.0.1/32</span>
</span><span id=__span-2-6><a id=__codelineno-2-6 name=__codelineno-2-6 href=#__codelineno-2-6></a><span class=w> </span><span class="p p-Indicator">-</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">::1/128</span>
</span><span id=__span-2-7><a id=__codelineno-2-7 name=__codelineno-2-7 href=#__codelineno-2-7></a><span class=nt>tls_cert_path</span><span class=p>:</span><span class=w> </span><span class=s>&quot;&quot;</span>
</span><span id=__span-2-8><a id=__codelineno-2-8 name=__codelineno-2-8 href=#__codelineno-2-8></a><span class=nt>tls_key_path</span><span class=p>:</span><span class=w> </span><span class=s>&quot;&quot;</span>
</span></code></pre></div> <h3 id=apache>Apache<a class=headerlink href=#apache title="Permanent link">&para;</a></h3> <p>The following basic Apache configuration works with the Headscale configuration <a href=#reverse-proxy-specific-configuration>as shown above</a>. Substitute placeholders and adjust the configuration as needed:</p> <ul> <li><code>&lt;SERVER_NAME&gt;</code>: The server name for your instance, e.g. <code>headscale.example.com</code></li> <li><code>&lt;PATH_TO_TLS_CERT&gt;</code>: Absolute path to your TLS certificate</li> <li><code>&lt;PATH_TO_TLS_KEY&gt;</code>: Absolute path to your TLS private key</li> </ul> <div class="language-apache highlight"><span class=filename>apache.conf</span><pre><span></span><code><span id=__span-3-1><a id=__codelineno-3-1 name=__codelineno-3-1 href=#__codelineno-3-1></a><span class=nt>&lt;VirtualHost</span><span class=w> </span><span class=s>*:80</span><span class=nt>&gt;</span>
</span><span id=__span-3-2><a id=__codelineno-3-2 name=__codelineno-3-2 href=#__codelineno-3-2></a><span class=hll><span class=w> </span><span class=nb>ServerName</span><span class=w> </span>&lt;SERVER_NAME&gt;
</span></span><span id=__span-3-3><a id=__codelineno-3-3 name=__codelineno-3-3 href=#__codelineno-3-3></a>
development/search/search_index.json
+1 -1
View File
File diff suppressed because one or more lines are too long
development/setup/requirements/index.html
+1 -1
View File
File diff suppressed because one or more lines are too long
development/sitemap.xml
+33 -33
View File
@@ -2,167 +2,167 @@
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://juanfont.github.io/headscale/development/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/about/clients/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/about/contributing/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/about/faq/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/about/features/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/about/help/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/about/releases/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/about/sponsor/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/api/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/configuration/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/debug/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/derp/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/dns/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/oidc/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/policy/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/registration/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/routes/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/tags/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/tls/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/integration/reverse-proxy/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/integration/tools/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/ref/integration/web-ui/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/setup/requirements/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/setup/upgrade/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/setup/install/community/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/setup/install/container/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/setup/install/main/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/setup/install/official/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/setup/install/source/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/usage/getting-started/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/usage/connect/android/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/usage/connect/apple/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://juanfont.github.io/headscale/development/usage/connect/windows/</loc>
<lastmod>2026-06-18</lastmod>
<lastmod>2026-06-19</lastmod>
<changefreq>daily</changefreq>
</url>
</urlset>
development/sitemap.xml.gz
BIN
View File
Binary file not shown.
versions.json
+2 -2
View File
@@ -10,8 +10,8 @@
"version": "0.29.1",
"title": "0.29.1",
"aliases": [
"stable",
"latest"
"latest",
"stable"
]
},
{