mirror of
https://github.com/juanfont/headscale.git
synced 2026-11-03 20:24:08 +09:00
Deployed 697eff74 to development with ProperDocs 1.6.7 and mike 2.2.0
This commit is contained in:
github-actions committed
1 parent
088340f173
commit
fba2d78143
8 files changed
+42
-42
No files matched your search
@@ -8,8 +8,8 @@
|
||||
</span></code></pre></div> </div> <div class=tabbed-block> <div class="language-console highlight"><pre><span></span><code><span id=__span-5-1><a id=__codelineno-5-1 name=__codelineno-5-1 href=#__codelineno-5-1></a><span class=go>curl -H "Authorization: Bearer <API_KEY>" \</span>
|
||||
</span><span id=__span-5-2><a id=__codelineno-5-2 name=__codelineno-5-2 href=#__codelineno-5-2></a><span class=go> --json '{"user": "<USER>", "authId": "<AUTH_ID>"}' \</span>
|
||||
</span><span id=__span-5-3><a id=__codelineno-5-3 name=__codelineno-5-3 href=#__codelineno-5-3></a><span class=go> https://headscale.example.com/api/v1/auth/register</span>
|
||||
</span></code></pre></div> </div> </div> </div> <h2 id=join-nodes-with-an-oauth-client>Join nodes with an OAuth client<a class=headerlink href=#join-nodes-with-an-oauth-client title="Permanent link">¶</a></h2> <p>Headscale also serves a subset of the Tailscale-compatible API at <code>/api/v2</code>, which accepts <strong>OAuth 2.0 client-credentials</strong> in addition to API keys. The Tailscale client can use an OAuth client secret in place of an auth key: it exchanges the secret for an access token, mints a single-use tagged auth key and registers with it. This works anywhere the client takes an auth key: <code>tailscale up</code>, the container image, <code>tsnet</code> and the <a href=https://github.com/tailscale/github-action><code>tailscale/github-action</code></a>. One long-lived secret joins any number of nodes.</p> <p>Create an OAuth client with the <code>auth_keys</code> scope and the tags its nodes get. The secret is shown once:</p> <div class="language-shell highlight"><pre><span></span><code><span id=__span-6-1><a id=__codelineno-6-1 name=__codelineno-6-1 href=#__codelineno-6-1></a>headscale<span class=w> </span>oauth-clients<span class=w> </span>create<span class=w> </span>--scope<span class=w> </span>auth_keys<span class=w> </span>--tag<span class=w> </span>tag:ci
|
||||
</span></code></pre></div> <p>Build the auth key from the secret:</p> <ol> <li>Swap the prefix: <code>hskey-client-…</code> becomes <code>tskey-client-…</code>. The client only runs the exchange for <code>tskey-client-</code>; Headscale accepts both.</li> <li>Append <code>?baseURL=<your Headscale URL></code>.</li> <li>Set <code>--advertise-tags</code>. Each tag must exist in the policy's <code>tagOwners</code> and be one of the OAuth client's tags, or owned by one of them.</li> </ol> <div class="language-text highlight"><pre><span></span><code><span id=__span-7-1><a id=__codelineno-7-1 name=__codelineno-7-1 href=#__codelineno-7-1></a>tskey-client-<id>-<secret>?baseURL=https://headscale.example.com
|
||||
</span></code></pre></div> </div> </div> </div> <h2 id=join-nodes-with-an-oauth-client>Join nodes with an OAuth client<a class=headerlink href=#join-nodes-with-an-oauth-client title="Permanent link">¶</a></h2> <p>Headscale also serves a subset of the Tailscale-compatible API at <code>/api/v2</code>, which accepts <strong>OAuth 2.0 client-credentials</strong> in addition to API keys. The Tailscale client can use an OAuth client secret in place of an auth key: it exchanges the secret for an access token, mints a single-use tagged auth key and registers with it. This works anywhere the client takes an auth key: <code>tailscale up</code>, the container image, <code>tsnet</code> and the <a href=https://github.com/tailscale/github-action><code>tailscale/github-action</code></a>. One long-lived secret joins any number of nodes. A client keeps its newest 1000 access tokens and minting more ends the oldest, so give a long-lived integration its own client.</p> <p>Create an OAuth client with the <code>auth_keys</code> scope and the tags its nodes get. The secret is shown once:</p> <div class="language-shell highlight"><pre><span></span><code><span id=__span-6-1><a id=__codelineno-6-1 name=__codelineno-6-1 href=#__codelineno-6-1></a>headscale<span class=w> </span>oauth-clients<span class=w> </span>create<span class=w> </span>--scope<span class=w> </span>auth_keys<span class=w> </span>--tag<span class=w> </span>tag:ci
|
||||
</span></code></pre></div> <p>Scopes apply to the whole tailnet, as in Tailscale: an <code>auth_keys</code> token can read and revoke auth keys of any tag, an <code>oauth_keys</code> token every OAuth client, and a <code>devices:core:read</code> token reads every device, routes included with <code>fields=all</code>. Keep the secret as safe as any credential that can revoke keys. Without <code>all=true</code>, a token lists only the auth keys made through a token, whatever their tags; with it, every valid auth key. No listing holds a spent, expired or revoked key. Tags limit only the tags a token puts on keys, clients and devices, and which tagged devices it may retag. Deleting an OAuth client revokes its secret and its access tokens; auth keys, clients and nodes created with it stay until you remove them.</p> <p>Build the auth key from the secret:</p> <ol> <li>Swap the prefix: <code>hskey-client-…</code> becomes <code>tskey-client-…</code>. The client only runs the exchange for <code>tskey-client-</code>; Headscale accepts both.</li> <li>Append <code>?baseURL=<your Headscale URL></code>.</li> <li>Set <code>--advertise-tags</code>. Each tag must exist in the policy's <code>tagOwners</code> and be one of the OAuth client's tags, or owned by one of them.</li> </ol> <div class="language-text highlight"><pre><span></span><code><span id=__span-7-1><a id=__codelineno-7-1 name=__codelineno-7-1 href=#__codelineno-7-1></a>tskey-client-<id>-<secret>?baseURL=https://headscale.example.com
|
||||
</span></code></pre></div> <div class="admonition warning"> <p class=admonition-title>Warning</p> <p>Without <code>baseURL</code> the client sends the secret to <code>https://api.tailscale.com</code>.</p> </div> <h3 id=attributes>Attributes<a class=headerlink href=#attributes title="Permanent link">¶</a></h3> <p>These are all the attributes the client understands; any other is an error. Order does not matter and an empty value means the default.</p> <table> <thead> <tr> <th>Attribute</th> <th>Default</th> <th>Effect</th> </tr> </thead> <tbody> <tr> <td><code>baseURL</code></td> <td><code>https://api.tailscale.com</code></td> <td>Where the exchange and key creation go. Your Headscale URL, no trailing slash.</td> </tr> <tr> <td><code>ephemeral</code></td> <td><code>true</code></td> <td>Node is removed after it goes offline (<code>node.ephemeral.inactivity_timeout</code>). <code>false</code> to keep it.</td> </tr> <tr> <td><code>preauthorized</code></td> <td><code>false</code></td> <td>Accepted, no effect: Headscale always authorizes pre-auth-key nodes.</td> </tr> </tbody> </table> <p>Booleans take any Go <code>strconv.ParseBool</code> value (<code>true</code>, <code>false</code>, <code>1</code>, <code>0</code>, …).</p> <h3 id=examples>Examples<a class=headerlink href=#examples title="Permanent link">¶</a></h3> <p><code>tailscale up</code>, either as the auth key or via <code>--client-secret</code> (which also takes <code>file:/path/to/secret</code>):</p> <div class="language-shell highlight"><pre><span></span><code><span id=__span-8-1><a id=__codelineno-8-1 name=__codelineno-8-1 href=#__codelineno-8-1></a>tailscale<span class=w> </span>up<span class=w> </span>--login-server<span class=w> </span>https://headscale.example.com<span class=w> </span>--advertise-tags<span class=w> </span>tag:ci<span class=w> </span><span class=se>\</span>
|
||||
</span><span id=__span-8-2><a id=__codelineno-8-2 name=__codelineno-8-2 href=#__codelineno-8-2></a><span class=w> </span>--auth-key<span class=w> </span><span class=s1>'tskey-client-<id>-<secret>?baseURL=https://headscale.example.com&ephemeral=false'</span>
|
||||
</span></code></pre></div> <p>Container image:</p> <div class="language-shell highlight"><pre><span></span><code><span id=__span-9-1><a id=__codelineno-9-1 name=__codelineno-9-1 href=#__codelineno-9-1></a>docker<span class=w> </span>run<span class=w> </span>-d<span class=w> </span>--name<span class=w> </span>tailscale<span class=w> </span><span class=se>\</span>
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
</span><span id=__span-1-5><a id=__codelineno-1-5 name=__codelineno-1-5 href=#__codelineno-1-5></a><span class=nt>log</span><span class=p>:</span>
|
||||
</span><span id=__span-1-6><a id=__codelineno-1-6 name=__codelineno-1-6 href=#__codelineno-1-6></a><span class=w> </span><span class=c1># Valid log levels: panic, fatal, error, warn, info, debug, trace</span>
|
||||
</span><span id=__span-1-7><a id=__codelineno-1-7 name=__codelineno-1-7 href=#__codelineno-1-7></a><span class=hll><span class=w> </span><span class=nt>level</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">debug</span>
|
||||
</span></span></code></pre></div> <h3 id=metrics-and-debug-endpoint>Metrics and debug endpoint<a class=headerlink href=#metrics-and-debug-endpoint title="Permanent link">¶</a></h3> <p>Headscale provides a metrics and debug endpoint. It allows to introspect different aspects such as:</p> <ul> <li>Information about the Go runtime, memory usage and statistics</li> <li>Connected nodes and pending registrations</li> <li>Active policy, filters and SSH policy</li> <li>Current DERPMap</li> <li>Prometheus metrics</li> </ul> <div class="admonition warning"> <p class=admonition-title>Keep the metrics and debug endpoint private</p> <p>The listen address and port can be configured with the <code>metrics_listen_addr</code> variable in the <a href=../configuration/ >configuration file</a>. By default it listens on localhost, port 9090.</p> <p>Keep the metrics and debug endpoint private to your internal network and don't expose it to the Internet.</p> <p>The metrics and debug interface can be disabled completely by setting <code>metrics_listen_addr: null</code> in the <a href=../configuration/ >configuration file</a>.</p> </div> <p>Query metrics via <a href=http://localhost:9090/metrics>http://localhost:9090/metrics</a> and get an overview of available debug information via <a href=http://localhost:9090/debug/ >http://localhost:9090/debug/</a>. Metrics may be queried from outside localhost but the debug interface is subject to additional protection despite listening on all interfaces.</p> <div class="tabbed-set tabbed-alternate" data-tabs=1:4><input checked=checked id=__tabbed_1_1 name=__tabbed_1 type=radio><input id=__tabbed_1_2 name=__tabbed_1 type=radio><input id=__tabbed_1_3 name=__tabbed_1 type=radio><input id=__tabbed_1_4 name=__tabbed_1 type=radio><div class=tabbed-labels><label for=__tabbed_1_1>Direct access</label><label for=__tabbed_1_2>SSH port forwarding</label><label for=__tabbed_1_3>Via debug key</label><label for=__tabbed_1_4>Via debug IP address</label></div> <div class=tabbed-content> <div class=tabbed-block> <p>Access the debug interface directly on the server where Headscale is installed.</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-2-1><a id=__codelineno-2-1 name=__codelineno-2-1 href=#__codelineno-2-1></a><span class=go>curl http://localhost:9090/debug/</span>
|
||||
</span></span></code></pre></div> <h3 id=metrics-and-debug-endpoint>Metrics and debug endpoint<a class=headerlink href=#metrics-and-debug-endpoint title="Permanent link">¶</a></h3> <p>Headscale provides a metrics and debug endpoint. It allows to introspect different aspects such as:</p> <ul> <li>Information about the Go runtime, memory usage and statistics</li> <li>Connected nodes and pending registrations</li> <li>Active policy, filters and SSH policy</li> <li>Current DERPMap</li> <li>Prometheus metrics</li> </ul> <div class="admonition warning"> <p class=admonition-title>Keep the metrics and debug endpoint private</p> <p>The listen address and port can be configured with the <code>metrics_listen_addr</code> variable in the <a href=../configuration/ >configuration file</a>. By default it listens on localhost, port 9090.</p> <p>Keep the metrics and debug endpoint private to your internal network and don't expose it to the Internet.</p> <p>The metrics and debug interface can be disabled completely by setting <code>metrics_listen_addr: null</code> in the <a href=../configuration/ >configuration file</a>.</p> </div> <p>Query metrics via <a href=http://localhost:9090/metrics>http://localhost:9090/metrics</a> and get an overview of available debug information via <a href=http://localhost:9090/debug/ >http://localhost:9090/debug/</a>. Metrics may be queried from outside localhost but the debug interface is subject to additional protection despite listening on all interfaces.</p> <p>The debug interface accepts requests addressed to an IP literal, <code>localhost</code>, the host in <code>server_url</code>, or the hostname in <code>metrics_listen_addr</code>. Hostnames are case-insensitive and may end in a dot. Other hostnames receive HTTP 403; use an IP address or one of the accepted names. <code>dns.base_domain</code> does not add accepted hosts. This check covers all debug paths, including statsviz. <code>/metrics</code> accepts any Host.</p> <div class="tabbed-set tabbed-alternate" data-tabs=1:4><input checked=checked id=__tabbed_1_1 name=__tabbed_1 type=radio><input id=__tabbed_1_2 name=__tabbed_1 type=radio><input id=__tabbed_1_3 name=__tabbed_1 type=radio><input id=__tabbed_1_4 name=__tabbed_1 type=radio><div class=tabbed-labels><label for=__tabbed_1_1>Direct access</label><label for=__tabbed_1_2>SSH port forwarding</label><label for=__tabbed_1_3>Via debug key</label><label for=__tabbed_1_4>Via debug IP address</label></div> <div class=tabbed-content> <div class=tabbed-block> <p>Access the debug interface directly on the server where Headscale is installed.</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-2-1><a id=__codelineno-2-1 name=__codelineno-2-1 href=#__codelineno-2-1></a><span class=go>curl http://localhost:9090/debug/</span>
|
||||
</span></code></pre></div> </div> <div class=tabbed-block> <p>Use SSH port forwarding to forward Headscale's metrics and debug port to your device.</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-3-1><a id=__codelineno-3-1 name=__codelineno-3-1 href=#__codelineno-3-1></a><span class=go>ssh <HEADSCALE_SERVER> -L 9090:localhost:9090</span>
|
||||
</span></code></pre></div> <p>Access the debug interface on your device by opening <a href=http://localhost:9090/debug/ >http://localhost:9090/debug/</a> in your web browser.</p> </div> <div class=tabbed-block> <p>The access control of the debug interface supports the use of a debug key. Traffic is accepted if the path to a debug key is set via the environment variable <code>TS_DEBUG_KEY_PATH</code> and the debug key sent as value for <code>debugkey</code> parameter with each request.</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-4-1><a id=__codelineno-4-1 name=__codelineno-4-1 href=#__codelineno-4-1></a><span class=go>openssl rand -hex 32 | tee debugkey.txt</span>
|
||||
</span><span id=__span-4-2><a id=__codelineno-4-2 name=__codelineno-4-2 href=#__codelineno-4-2></a><span class=go>export TS_DEBUG_KEY_PATH=debugkey.txt</span>
|
||||
|
||||
@@ -28,7 +28,7 @@
|
||||
</span><span id=__span-4-5><a id=__codelineno-4-5 name=__codelineno-4-5 href=#__codelineno-4-5></a><span class=hll><span class=w> </span><span class=nt>scope</span><span class=p>:</span><span class=w> </span><span class="p p-Indicator">[</span><span class=s>"openid"</span><span class="p p-Indicator">,</span><span class=w> </span><span class=s>"profile"</span><span class="p p-Indicator">,</span><span class=w> </span><span class=s>"email"</span><span class="p p-Indicator">,</span><span class=w> </span><span class=s>"groups"</span><span class="p p-Indicator">]</span>
|
||||
</span></span><span id=__span-4-6><a id=__codelineno-4-6 name=__codelineno-4-6 href=#__codelineno-4-6></a><span class=hll><span class=w> </span><span class=nt>allowed_groups</span><span class=p>:</span>
|
||||
</span></span><span id=__span-4-7><a id=__codelineno-4-7 name=__codelineno-4-7 href=#__codelineno-4-7></a><span class=hll><span class=w> </span><span class="p p-Indicator">-</span><span class=w> </span><span class=s>"headscale_users"</span>
|
||||
</span></span></code></pre></div> </div> </div> </div> <h3 id=control-email-verification>Control email verification<a class=headerlink href=#control-email-verification title="Permanent link">¶</a></h3> <p>Headscale uses the <code>email</code> claim from the identity provider to synchronize the email address to its user profile. By default, a user's email address is only synchronized when the identity provider reports the email address as verified via the <code>email_verified: true</code> claim.</p> <p>Unverified emails may be allowed in case an identity provider does not send the <code>email_verified</code> claim or email verification is not required. In that case, a user's email address is always synchronized to the user profile.</p> <div class="language-yaml highlight"><pre><span></span><code><span id=__span-5-1><a id=__codelineno-5-1 name=__codelineno-5-1 href=#__codelineno-5-1></a><span class=nt>oidc</span><span class=p>:</span>
|
||||
</span></span></code></pre></div> </div> </div> </div> <h3 id=control-email-verification>Control email verification<a class=headerlink href=#control-email-verification title="Permanent link">¶</a></h3> <p>Headscale synchronizes the <code>email</code> claim from the identity provider to its user profile on each OIDC login. By default, the profile uses the email only when the latest login reports <code>email_verified: true</code>. An absent, unverified, or malformed email clears the previously stored address.</p> <p>Unverified emails may be allowed in case an identity provider does not send the <code>email_verified</code> claim or email verification is not required. With <code>email_verified_required: false</code>, the latest login's email is stored without requiring verification. An absent or malformed email still clears the previously stored address.</p> <div class="language-yaml highlight"><pre><span></span><code><span id=__span-5-1><a id=__codelineno-5-1 name=__codelineno-5-1 href=#__codelineno-5-1></a><span class=nt>oidc</span><span class=p>:</span>
|
||||
</span><span id=__span-5-2><a id=__codelineno-5-2 name=__codelineno-5-2 href=#__codelineno-5-2></a><span class=w> </span><span class=nt>issuer</span><span class=p>:</span><span class=w> </span><span class=s>"https://sso.example.com"</span>
|
||||
</span><span id=__span-5-3><a id=__codelineno-5-3 name=__codelineno-5-3 href=#__codelineno-5-3></a><span class=w> </span><span class=nt>client_id</span><span class=p>:</span><span class=w> </span><span class=s>"headscale"</span>
|
||||
</span><span id=__span-5-4><a id=__codelineno-5-4 name=__codelineno-5-4 href=#__codelineno-5-4></a><span class=w> </span><span class=nt>client_secret</span><span class=p>:</span><span class=w> </span><span class=s>"generated-secret"</span>
|
||||
@@ -41,7 +41,7 @@
|
||||
</span><span id=__span-7-4><a id=__codelineno-7-4 name=__codelineno-7-4 href=#__codelineno-7-4></a><span class=w> </span><span class=nt>client_secret</span><span class=p>:</span><span class=w> </span><span class=s>"generated-secret"</span>
|
||||
</span><span id=__span-7-5><a id=__codelineno-7-5 name=__codelineno-7-5 href=#__codelineno-7-5></a><span class=hll><span class=w> </span><span class=nt>use_expiry_from_token</span><span class=p>:</span><span class=w> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
|
||||
</span></span></code></pre></div> </div> </div> </div> <div class="admonition tip"> <p class=admonition-title>Expire a node and force re-authentication</p> <p>A node can be expired immediately via:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-8-1><a id=__codelineno-8-1 name=__codelineno-8-1 href=#__codelineno-8-1></a><span class=go>headscale node expire -i <NODE_ID></span>
|
||||
</span></code></pre></div> </div> <h3 id=reference-a-user-in-the-policy>Reference a user in the policy<a class=headerlink href=#reference-a-user-in-the-policy title="Permanent link">¶</a></h3> <p>You may refer to users in the Headscale policy via:</p> <ul> <li>Email address</li> <li>Username</li> <li>Provider identifier (this value is currently only available from the <a href=../api/ >API</a>, database or directly from your identity provider)</li> </ul> <div class="admonition note"> <p class=admonition-title>A user identifier in the policy must contain a single <code>@</code></p> <p>The Headscale policy requires a single <code>@</code> to reference a user. If the username or provider identifier doesn't already contain a single <code>@</code>, it needs to be appended at the end. For example: the Headscale username <code>ssmith</code> has to be written as <code>ssmith@</code> to be correctly identified as user within the policy.</p> <p>Ensure that the Headscale username itself does not end with <code>@</code>.</p> </div> <div class="admonition warning"> <p class=admonition-title>Email address or username might be updated by users</p> <p>Many identity providers allow users to update their own profile. Depending on the identity provider and its configuration, the values for username or email address might change over time. This might have unexpected consequences for Headscale where a policy might no longer work or a user might obtain more access by hijacking an existing username or email address.</p> </div> <div class="admonition tip"> <p class=admonition-title>Howto use the provider identifier in the policy</p> <p>The provider identifier uniquely identifies an OIDC user and a well-behaving identity provider guarantees that this value never changes for a particular user. It is usually an opaque and long string and its value is currently only available from the <a href=../api/ >API</a>, database or directly from your identity provider).</p> <p>Use the <a href=../api/ >API</a> with the <code>/api/v1/user</code> endpoint to fetch the provider identifier (<code>providerId</code>). The value (be sure to append an <code>@</code> in case the provider identifier doesn't already contain an <code>@</code> somewhere) can be used directly to reference a user in the policy. To improve readability of the policy, one may use the <code>groups</code> section as an alias:</p> <div class="language-json highlight"><pre><span></span><code><span id=__span-9-1><a id=__codelineno-9-1 name=__codelineno-9-1 href=#__codelineno-9-1></a><span class=p>{</span>
|
||||
</span></code></pre></div> </div> <h3 id=reference-a-user-in-the-policy>Reference a user in the policy<a class=headerlink href=#reference-a-user-in-the-policy title="Permanent link">¶</a></h3> <p>You may refer to users in the Headscale policy via:</p> <ul> <li>Email address</li> <li>Username</li> <li>Provider identifier (this value is currently only available from the <a href=../api/ >API</a>, database or directly from your identity provider)</li> </ul> <p>References match a provider identifier first, then a stored email address, then a username. A token shaped like an email address also matches a username with that value when no user has that email. If one user has the email and another has the username, the email owner wins. Multiple matching emails, or multiple matching usernames when no email matches, remain ambiguous.</p> <div class="admonition note"> <p class=admonition-title>A user identifier in the policy must contain a single <code>@</code></p> <p>The Headscale policy requires a single <code>@</code> to reference a user. If the username or provider identifier doesn't already contain a single <code>@</code>, it needs to be appended at the end. For example: the Headscale username <code>ssmith</code> has to be written as <code>ssmith@</code> to be correctly identified as user within the policy.</p> <p>Ensure that the Headscale username itself does not end with <code>@</code>.</p> </div> <div class="admonition warning"> <p class=admonition-title>Email address or username might be updated by users</p> <p>Many identity providers allow users to update their own profile. Depending on the identity provider and its configuration, the values for username or email address might change over time. This might have unexpected consequences for Headscale where a policy might no longer work or a user might obtain more access by hijacking an existing username or email address.</p> <p>Use provider identifiers in policies when your identity provider lets users change their own usernames.</p> </div> <div class="admonition tip"> <p class=admonition-title>Howto use the provider identifier in the policy</p> <p>The provider identifier uniquely identifies an OIDC user and a well-behaving identity provider guarantees that this value never changes for a particular user. It is usually an opaque and long string and its value is currently only available from the <a href=../api/ >API</a>, database or directly from your identity provider).</p> <p>Use the <a href=../api/ >API</a> with the <code>/api/v1/user</code> endpoint to fetch the provider identifier (<code>providerId</code>). The value (be sure to append an <code>@</code> in case the provider identifier doesn't already contain an <code>@</code> somewhere) can be used directly to reference a user in the policy. To improve readability of the policy, one may use the <code>groups</code> section as an alias:</p> <div class="language-json highlight"><pre><span></span><code><span id=__span-9-1><a id=__codelineno-9-1 name=__codelineno-9-1 href=#__codelineno-9-1></a><span class=p>{</span>
|
||||
</span><span id=__span-9-2><a id=__codelineno-9-2 name=__codelineno-9-2 href=#__codelineno-9-2></a><span class=w> </span><span class=nt>"groups"</span><span class=p>:</span><span class=w> </span><span class=p>{</span>
|
||||
</span><span id=__span-9-3><a id=__codelineno-9-3 name=__codelineno-9-3 href=#__codelineno-9-3></a><span class=w> </span><span class=nt>"group:alice"</span><span class=p>:</span><span class=w> </span><span class=p>[</span>
|
||||
</span><span id=__span-9-4><a id=__codelineno-9-4 name=__codelineno-9-4 href=#__codelineno-9-4></a><span class=w> </span><span class=s2>"https://sso.example.com/oauth2/openid/59ac9125-c31b-46c5-814e-06242908cf57@"</span>
|
||||
|
||||
@@ -120,4 +120,4 @@
|
||||
</span><span id=__span-19-24><a id=__codelineno-19-24 name=__codelineno-19-24 href=#__codelineno-19-24></a><span class=p>}</span>
|
||||
</span></code></pre></div> <p>The Tailscale client can suggest a viable exit node with:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-20-1><a id=__codelineno-20-1 name=__codelineno-20-1 href=#__codelineno-20-1></a><span class=gp>$ </span>sudo<span class=w> </span>tailscale<span class=w> </span>exit-node<span class=w> </span>suggest
|
||||
</span></code></pre></div> <p>or automatically select one by using <code>auto:any</code> as exit node identifier:</p> <div class="language-console highlight"><pre><span></span><code><span id=__span-21-1><a id=__codelineno-21-1 name=__codelineno-21-1 href=#__codelineno-21-1></a><span class=gp>$ </span>sudo<span class=w> </span>tailscale<span class=w> </span><span class=nb>set</span><span class=w> </span>--exit-node<span class=o>=</span>auto:any
|
||||
</span></code></pre></div> <p>Please see the <a href=https://tailscale.com/docs/features/exit-nodes/auto-exit-nodes>official Tailscale documentation</a> for more information on automatic exit node selection.</p> <h2 id=high-availability>High availability<a class=headerlink href=#high-availability title="Permanent link">¶</a></h2> <p>Headscale supports high availability routing. Multiple subnet routers with overlapping routes or multiple exit nodes can be used to provide high availability for users. If one router node goes offline, another one can serve the same routes to clients. Please see the official <a href=https://tailscale.com/docs/how-to/set-up-high-availability#subnet-router-high-availability>Tailscale documentation on high availability</a> for details.</p> <p>This feature is enabled by default when at least two nodes advertise the same prefix. See the configuration options <code>node.routes.ha</code> in the <a href=../configuration/ >configuration file</a> for details.</p> <h2 id=troubleshooting>Troubleshooting<a class=headerlink href=#troubleshooting title="Permanent link">¶</a></h2> <h3 id=enable-ip-forwarding>Enable IP forwarding<a class=headerlink href=#enable-ip-forwarding title="Permanent link">¶</a></h3> <p>A subnet router or exit node is routing traffic on behalf of other nodes and thus requires IP forwarding. Check the official <a href=https://tailscale.com/docs/features/subnet-routers#enable-ip-forwarding>Tailscale documentation</a> for how to enable IP forwarding.</p> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <div class=md-top data-md-component=top hidden> <div class=md-top__center> <button type=button class="md-top__button md-top__button--main" data-md-action=top> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> <span>Back to top</span> </button> <label class="md-top__button md-top__side md-top__side--nav" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg fill=none stroke=currentColor stroke-linecap=round stroke-linejoin=round stroke-width=2 class="lucide lucide-panel-left" viewbox="0 0 24 24"><rect width=18 height=18 x=3 y=3 rx=2 /><path d="M9 3v18"/></svg> </label> <label class="md-top__button md-top__side md-top__side--toc" for=__toc> <svg xmlns=http://www.w3.org/2000/svg fill=none stroke=currentColor stroke-linecap=round stroke-linejoin=round stroke-width=2 class="lucide lucide-panel-right" viewbox="0 0 24 24"><rect width=18 height=18 x=3 y=3 rx=2 /><path d="M15 3v18"/></svg> </label> </div> </div> </main> <footer class=md-footer> <nav class="md-footer__inner md-grid" aria-label=Footer> <a href=../oidc/ class="md-footer__link md-footer__link--prev" aria-label="Previous: OpenID Connect"> <div class="md-footer__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class=md-footer__title> <span class=md-footer__direction> Previous </span> <div class=md-ellipsis> OpenID Connect </div> </div> </a> <a href=../tls/ class="md-footer__link md-footer__link--next" aria-label="Next: TLS"> <div class=md-footer__title> <span class=md-footer__direction> Next </span> <div class=md-ellipsis> TLS </div> </div> <div class="md-footer__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> <div class=md-copyright__highlight> Copyright © 2026 Headscale authors </div> Made with <a href=https://jaywhj.github.io/mkdocs-materialx/ target=_blank rel=noopener> MaterialX </a> </div> <div class=md-social> <a href=https://github.com/juanfont/headscale target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M173.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M252.8 8C114.1 8 8 113.3 8 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.Line truncated
|
||||
</span></code></pre></div> <p>Please see the <a href=https://tailscale.com/docs/features/exit-nodes/auto-exit-nodes>official Tailscale documentation</a> for more information on automatic exit node selection.</p> <h2 id=high-availability>High availability<a class=headerlink href=#high-availability title="Permanent link">¶</a></h2> <p>Headscale supports high availability routing. Multiple subnet routers with overlapping routes or multiple exit nodes can be used to provide high availability for users. If one router node goes offline, another one can serve the same routes to clients. Please see the official <a href=https://tailscale.com/docs/how-to/set-up-high-availability#subnet-router-high-availability>Tailscale documentation on high availability</a> for details.</p> <p>This feature is enabled by default when at least two nodes advertise the same prefix. See the configuration options <code>node.routes.ha</code> in the <a href=../configuration/ >configuration file</a> for details.</p> <p>Of the routers that are online, healthy and not expired, the one connected to Headscale the longest serves a route. A router that reconnects becomes a standby, while a router that stays connected takes its routes back once it is approved, healthy or unexpired again. When none is available, the route stays with the router that served it last.</p> <h2 id=troubleshooting>Troubleshooting<a class=headerlink href=#troubleshooting title="Permanent link">¶</a></h2> <h3 id=enable-ip-forwarding>Enable IP forwarding<a class=headerlink href=#enable-ip-forwarding title="Permanent link">¶</a></h3> <p>A subnet router or exit node is routing traffic on behalf of other nodes and thus requires IP forwarding. Check the official <a href=https://tailscale.com/docs/features/subnet-routers#enable-ip-forwarding>Tailscale documentation</a> for how to enable IP forwarding.</p> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <div class=md-top data-md-component=top hidden> <div class=md-top__center> <button type=button class="md-top__button md-top__button--main" data-md-action=top> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> <span>Back to top</span> </button> <label class="md-top__button md-top__side md-top__side--nav" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg fill=none stroke=currentColor stroke-linecap=round stroke-linejoin=round stroke-width=2 class="lucide lucide-panel-left" viewbox="0 0 24 24"><rect width=18 height=18 x=3 y=3 rx=2 /><path d="M9 3v18"/></svg> </label> <label class="md-top__button md-top__side md-top__side--toc" for=__toc> <svg xmlns=http://www.w3.org/2000/svg fill=none stroke=currentColor stroke-linecap=round stroke-linejoin=round stroke-width=2 class="lucide lucide-panel-right" viewbox="0 0 24 24"><rect width=18 height=18 x=3 y=3 rx=2 /><path d="M15 3v18"/></svg> </label> </div> </div> </main> <footer class=md-footer> <nav class="md-footer__inner md-grid" aria-label=Footer> <a href=../oidc/ class="md-footer__link md-footer__link--prev" aria-label="Previous: OpenID Connect"> <div class="md-footer__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class=md-footer__title> <span class=md-footer__direction> Previous </span> <div class=md-ellipsis> OpenID Connect </div> </div> </a> <a href=../tls/ class="md-footer__link md-footer__link--next" aria-label="Next: TLS"> <div class=md-footer__title> <span class=md-footer__direction> Next </span> <div class=md-ellipsis> TLS </div> </div> <div class="md-footer__button md-icon"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class=md-copyright> <div class=md-copyright__highlight> Copyright © 2026 Headscale authors </div> Made with <a href=https://jaywhj.github.io/mkdocs-materialx/ target=_blank rel=noopener> MaterialX </a> </div> <div class=md-social> <a href=https://github.com/juanfont/headscale target=_blank rel=noopener title=github.com class=md-social__link> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 512 512"><!-- Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M173.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M252.8 8C114.1 8 8 113.Line truncated
|
||||
@@ -1 +1 @@
|
||||
{"config":{"lang":["en"],"separator":"[\\s\\-,:!=\\[\\]()\"`/]+|\\.(?!\\d)|&[lg]t;|(?!\\b)(?=[A-Z][a-z])","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"Welcome to headscale","text":"<p>Headscale is an open source, self-hosted implementation of the Tailscale control server.</p> <p>This page contains the documentation for the latest version of headscale. Please also check our FAQ.</p> <p>Join our Discord server for a chat and community support.</p>"},{"location":"#design-goal","title":"Design goal","text":"<p>Headscale aims to implement a self-hosted, open source alternative to the Tailscale control server. Headscale's goal is to provide self-hosters and hobbyists with an open-source server they can use for their projects and labs. It implements a narrow scope, a single Tailscale network (tailnet), suitable for a personal use, or a small open-source organisation.</p>"},{"location":"#supporting-headscale","title":"Supporting headscale","text":"<p>Please see Sponsor for more information.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>Headscale is \"Open Source, acknowledged contribution\", this means that any contribution will have to be discussed with the Maintainers before being submitted.</p> <p>Please see Contributing for more information.</p>"},{"location":"#about","title":"About","text":"<p>Headscale is maintained by Kristoffer Dalby and Juan Font.</p>"},{"location":"about/clients/","title":"Client and operating system support","text":"<p>We aim to support the last 10 releases of the Tailscale client on all provided operating systems and platforms. Some platforms might require additional configuration to connect with headscale.</p> OS Supports headscale Linux Yes OpenBSD Yes FreeBSD Yes Windows Yes (see docs and <code>/windows</code> on your headscale for more information) Android Yes (see docs for more information) macOS Yes (see docs and <code>/apple</code> on your headscale for more information) iOS Yes (see docs and <code>/apple</code> on your headscale for more information) tvOS Yes (see docs and <code>/apple</code> on your headscale for more information)"},{"location":"about/contributing/","title":"Contributing","text":"<p>Headscale is \"Open Source, acknowledged contribution\", this means that any contribution will have to be discussed with the maintainers before being added to the project. This model has been chosen to reduce the risk of burnout by limiting the maintenance overhead of reviewing and validating third-party code.</p>"},{"location":"about/contributing/#why-do-we-have-this-model","title":"Why do we have this model?","text":"<p>Headscale has a small maintainer team that tries to balance working on the project, fixing bugs and reviewing contributions.</p> <p>When we work on issues ourselves, we develop first hand knowledge of the code and it makes it possible for us to maintain and own the code as the project develops.</p> <p>Code contributions are seen as a positive thing. People enjoy and engage with our project, but it also comes with some challenges; we have to understand the code, we have to understand the feature, we might have to become familiar with external libraries or services and we think about security implications. All those steps are required during the reviewing process. After the code has been merged, the feature has to be maintained. Any changes reliant on external services must be updated and expanded accordingly.</p> <p>The review and day-1 maintenance adds a significant burden on the maintainers. Often we hope that the contributor will help out, but we found that most of the time, they disappear after their new feature was added.</p> <p>This means that when someone contributes, we are mostly happy about it, but we do have to run it through a series of checks to establish if we actually can maintain this feature.</p>"},{"location":"about/contributing/#what-do-we-require","title":"What do we require?","text":"<p>A general description is provided here and an explicit list is provided in our pull request template.</p> <p>All new features have to start out with a design document, which should be discussed on the issue tracker (not discord). It should include a use case for the feature, how it can be implemented, who will implement it and a plan for maintaining it.</p> <p>All features have to be end-to-end tested (integration tests) and have good unit test coverage to ensure that they work as expected. This will also ensure that the feature continues to work as expected over time. If a change cannot be tested, a strong case for why this is not possible needs to be presented.</p> <p>The contributor should help to maintain the feature over time. In case the feature is not maintained probably, the maintainers reserve themselves the right to remove features they redeem as unmaintainable. This should help to improve the quality of the software and keep it iLine truncated
|
||||
{"config":{"lang":["en"],"separator":"[\\s\\-,:!=\\[\\]()\"`/]+|\\.(?!\\d)|&[lg]t;|(?!\\b)(?=[A-Z][a-z])","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"Welcome to headscale","text":"<p>Headscale is an open source, self-hosted implementation of the Tailscale control server.</p> <p>This page contains the documentation for the latest version of headscale. Please also check our FAQ.</p> <p>Join our Discord server for a chat and community support.</p>"},{"location":"#design-goal","title":"Design goal","text":"<p>Headscale aims to implement a self-hosted, open source alternative to the Tailscale control server. Headscale's goal is to provide self-hosters and hobbyists with an open-source server they can use for their projects and labs. It implements a narrow scope, a single Tailscale network (tailnet), suitable for a personal use, or a small open-source organisation.</p>"},{"location":"#supporting-headscale","title":"Supporting headscale","text":"<p>Please see Sponsor for more information.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>Headscale is \"Open Source, acknowledged contribution\", this means that any contribution will have to be discussed with the Maintainers before being submitted.</p> <p>Please see Contributing for more information.</p>"},{"location":"#about","title":"About","text":"<p>Headscale is maintained by Kristoffer Dalby and Juan Font.</p>"},{"location":"about/clients/","title":"Client and operating system support","text":"<p>We aim to support the last 10 releases of the Tailscale client on all provided operating systems and platforms. Some platforms might require additional configuration to connect with headscale.</p> OS Supports headscale Linux Yes OpenBSD Yes FreeBSD Yes Windows Yes (see docs and <code>/windows</code> on your headscale for more information) Android Yes (see docs for more information) macOS Yes (see docs and <code>/apple</code> on your headscale for more information) iOS Yes (see docs and <code>/apple</code> on your headscale for more information) tvOS Yes (see docs and <code>/apple</code> on your headscale for more information)"},{"location":"about/contributing/","title":"Contributing","text":"<p>Headscale is \"Open Source, acknowledged contribution\", this means that any contribution will have to be discussed with the maintainers before being added to the project. This model has been chosen to reduce the risk of burnout by limiting the maintenance overhead of reviewing and validating third-party code.</p>"},{"location":"about/contributing/#why-do-we-have-this-model","title":"Why do we have this model?","text":"<p>Headscale has a small maintainer team that tries to balance working on the project, fixing bugs and reviewing contributions.</p> <p>When we work on issues ourselves, we develop first hand knowledge of the code and it makes it possible for us to maintain and own the code as the project develops.</p> <p>Code contributions are seen as a positive thing. People enjoy and engage with our project, but it also comes with some challenges; we have to understand the code, we have to understand the feature, we might have to become familiar with external libraries or services and we think about security implications. All those steps are required during the reviewing process. After the code has been merged, the feature has to be maintained. Any changes reliant on external services must be updated and expanded accordingly.</p> <p>The review and day-1 maintenance adds a significant burden on the maintainers. Often we hope that the contributor will help out, but we found that most of the time, they disappear after their new feature was added.</p> <p>This means that when someone contributes, we are mostly happy about it, but we do have to run it through a series of checks to establish if we actually can maintain this feature.</p>"},{"location":"about/contributing/#what-do-we-require","title":"What do we require?","text":"<p>A general description is provided here and an explicit list is provided in our pull request template.</p> <p>All new features have to start out with a design document, which should be discussed on the issue tracker (not discord). It should include a use case for the feature, how it can be implemented, who will implement it and a plan for maintaining it.</p> <p>All features have to be end-to-end tested (integration tests) and have good unit test coverage to ensure that they work as expected. This will also ensure that the feature continues to work as expected over time. If a change cannot be tested, a strong case for why this is not possible needs to be presented.</p> <p>The contributor should help to maintain the feature over time. In case the feature is not maintained probably, the maintainers reserve themselves the right to remove features they redeem as unmaintainable. This should help to improve the quality of the software and keep it iLine truncated
|
||||
+33
-33
@@ -2,167 +2,167 @@
|
||||
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/about/clients/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/about/contributing/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/about/faq/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/about/features/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/about/help/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/about/releases/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/about/sponsor/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/api/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/configuration/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/debug/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/derp/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/dns/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/oidc/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/policy/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/registration/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/routes/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/tags/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/tls/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/integration/reverse-proxy/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/integration/tools/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/ref/integration/web-ui/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/setup/requirements/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/setup/upgrade/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/setup/install/community/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/setup/install/container/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/setup/install/main/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/setup/install/official/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/setup/install/source/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/usage/getting-started/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/usage/connect/android/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/usage/connect/apple/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
<url>
|
||||
<loc>https://juanfont.github.io/headscale/development/usage/connect/windows/</loc>
|
||||
<lastmod>2026-10-29</lastmod>
|
||||
<lastmod>2026-11-02</lastmod>
|
||||
<changefreq>daily</changefreq>
|
||||
</url>
|
||||
</urlset>
|
||||
Binary file not shown.
+2
-2
@@ -10,8 +10,8 @@
|
||||
"version": "0.29.7",
|
||||
"title": "0.29.7",
|
||||
"aliases": [
|
||||
"stable",
|
||||
"latest"
|
||||
"latest",
|
||||
"stable"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
Reference in new issue
Block a user