public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 04:34:07 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,392 Commits 106 Branches 177 Tags
02b1528025609f0cd714532585cee23cc75ef7e4
Commit Graph
4392 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby 02b1528025 policy: pin SSH forwarding behavior and recommend upgrades 
Updates #3601
(cherry picked from commit 998c4b061, CHANGELOG dropped)
 2026-10-30 10:33:17 +01:00
Kristoffer Dalby 2d881c5e56 noise: restrict metrics to the metrics listener 
Updates #3571
(cherry picked from commit cd66e2414, CHANGELOG dropped, slices import added)
 2026-10-30 10:33:17 +01:00
Kristoffer Dalby 9318ce4df2 release: retry existing tags without the Docker downgrade 2026-10-24 09:27:09 +00:00
Kristoffer Dalby a2b1d78639 CHANGELOG: set the 0.29.6 release date v0.29.6 2026-10-24 09:21:24 +00:00
Kristoffer Dalby ee74ce4568 CHANGELOG: document the 0.29.6 security and patch release 
Updates #3579 and #3549.
 2026-10-24 11:15:00 +02:00
Kristoffer Dalby 941d7ff9ae poll: end stopped map sessions without resetting active streams 
Backport 371674de9 and 73dd39982 from #3575.
 2026-10-24 11:15:00 +02:00
Kristoffer Dalby f1499ce280 mapper: avoid refiltering broadcast recipients 
Backport 648905480 from #3568.
 2026-10-24 11:15:00 +02:00
Kristoffer Dalby c32e8e4c97 db: return database-open errors for 0.29.6 
Backport #3496.
 2026-10-24 11:15:00 +02:00
Kristoffer Dalby c6181989b1 policy: backport peer-map optimizations for 0.29.6 
Backport #3556 and #3557. Updates #3549.
 2026-10-24 11:15:00 +02:00
Kristoffer Dalby 981f2eb1b5 lint: retain the exhaustruct exclusion with the updated toolchain 2026-10-24 11:15:00 +02:00
Kristoffer Dalby f2b5f45836 all: prepare 0.29.6 security updates 
Updates #3579
 2026-10-24 11:15:00 +02:00
Kristoffer Dalby 0f7d1e536b docs: warn about audit-log attributes with logtail disabled 
Updates #3522

(cherry picked from commit cced8a0ab, docs only)
(cherry picked from commit 7d8cfe13f)
v0.29.5 		2026-10-13 14:35:52 +02:00
Kristoffer Dalby fb619274a9 mkdocs: bump version 2026-10-13 14:35:52 +02:00
Kristoffer Dalby d0cb5a5a44 go.mod: update dependencies 
chi v5.4.0, x/sync v0.24.0, creachadair/command v0.2.12; no code changes.

(cherry picked from commit 641a8af640, adapted)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 755e6a1e2d all: build with Go 1.26.8 
Docker images take 1.26.9; nixpkgs 26.05 ships 1.26.8.
Go 1.27 needs the newer tailscale.com that main carries.
 2026-10-13 14:35:52 +02:00
github-actions[bot] ceac1c14cd Dockerfile: bump rust 1.95-trixie to 1.99-trixie 
(cherry picked from commit 911f57792f, adapted from 1.98)
 2026-10-13 14:35:52 +02:00
github-actions[bot] e279de9cd3 Dockerfile: bump golang builders to 1.27.2 / 1.27.1 
(cherry picked from commit 547905baf1)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 733d544b1c docker: let the tailscale builders fetch a newer toolchain 
Both stages compile a tailscale tree cloned from an unpinned branch. The
golang images set GOTOOLCHAIN=local, so the moment upstream raises its go
directive the build fails outright instead of fetching a toolchain.

(cherry picked from commit e40f47abbf)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby a4f854f721 mapper: preserve node pings when a full update is queued 
Updates #3523

(cherry picked from commit 17cb110892)
(cherry picked from commit 7c2260c602)
(cherry picked from commit 6875c4bc8, test only)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 6ed6dd8db5 policy/v2: stop ViaRoutesForPeer appending into pm.pol.Grants 
Updates #3515

(cherry picked from commit 5cadfa16eb)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby d03d3a0231 mapper: retain the logtail instruction across client restarts 
Updates #3522

(cherry picked from commit 52a7f8c89c)
(cherry picked from commit 0c9186d4a3)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 940260cfdc servertest: bound fixture batching and await observable state 
Updates #3544
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby b16b705c13 servertest: wait for stable via-route netmaps 
Updates #3524

(cherry picked from commit f1293a805a)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby f624180bf8 docs: record the 0.29.5 backports 
Updates #3492, #3495, #3501, #3515, #3516, #3517, #3518, #3522, #3523, #3526, #3527, #3538, #3539, #3541
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 8d2ac4ab9a ci: regenerate the release integration test matrix 
Updates #3517, #3541
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 5c25a66983 state: send relogins as whole nodes when peers need them 
Updates #3541, #3531

Adapted: #3525 is not backported, so the inline pre-auth key
re-registration path reports keysOnly, and NodeView.IsExpiredAt comes
along from it.

(cherry picked from commit a8d6f5be81)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 5fb2d4e089 policy/v2: revoke stale SSH access and recheck authentication 
Updates #3517, #3508

(cherry picked from commit 4fd4da75f2)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 00f670213a mapper: retain reconnect removals until delivery 
Updates #3527

(cherry picked from commit b4d5cdd6aa)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 98ce49defd mapper: deliver peer removals as separate deltas 
Updates #3492

(cherry picked from commit eeaac680be)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 929e3337f4 mapper: refresh self when approved routes change 
Updates #3502, #3518

(cherry picked from commit 48046dc9c5)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby a4e56d7bf1 policy/v2: skip route resolution without via grants 
Updates #3512, #3538

(cherry picked from commit f8018f177a)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 0a207969e7 hscontrol: preserve ephemeral nodes with live sessions 
Updates #3535, #3539

(cherry picked from commit 8798c9af83)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 4d42bc62ec noise: reject reused SSH check verdicts 
Updates #3526

(cherry picked from commit 00d64db9ef)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby f079cf7a59 policy/v2: resolve unregistered users to an empty set 
Updates #3513, #3516

(cherry picked from commit 2dcd5c876e)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby bd8b8ce757 policy/v2: invalidate per-node filters when users change 
Updates #3501

(cherry picked from commit edf5cc994e)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 5ec1a5abb8 policy/v2: restore the live policy after a rejected update 
Updates #3501

(cherry picked from commit 9ce160ed5b)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 711d00d5ba policy/v2: preserve via exit steering across unrelated rules 
Updates #3495

(cherry picked from commit 3417e4cb77)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 52e01807db ci: reuse compiled integration tests and prebuilt images 
Updates #3542

(cherry picked from commit c9852c43da)
 2026-10-13 14:35:52 +02:00
Kristoffer Dalby 8106636c7f CHANGELOG: add 0.29.4 v0.29.4 2026-09-23 21:19:22 +02:00
Kristoffer Dalby 6a0f67d56e state: resolve changed peers through adjacency 
ListPeers now filters named peers against the recipient's adjacency, so
a node the policy hides is never delivered.

Updates #3417

(cherry picked from commit 4c6a2dff52)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby 237dc74e73 state: reuse peer adjacency for payload-only writes 
A write that cannot move visibility carries the previous adjacency
forward; policy and user changes rebuild it explicitly.

Updates #3417

(cherry picked from commit e3c4c81b18)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby 938c2bd753 policy,state: key the peer map by node ID 
Adjacency becomes immutable, so a snapshot can resolve peers through its
own fresh views instead of storing them.

Updates #3417

(cherry picked from commit 95ba787417)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby 9fbf7b9b60 mapper: take peer visibility from the peer map only 
Fixes #3408

0.29's BuildPeerMap returns node views, not node IDs, so the peer map
assertion compares IDs read off the views.

(cherry picked from commit e48bc46cc6)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby 5aded15bf2 policy/v2: suggest approved exit nodes by default 
Matches SaaS; Apple clients hide the exit-node list without a suggestion.

Fixes #3415

0.29's tailscale has no tailcfg/nodecap package, so the constant keeps its
tailcfg name here and in the test.

(cherry picked from commit c604874dba)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby c7d9d03500 hscontrol: replace tailscale line refs with doc links 
Line numbers drift on every upstream bump.

0.29's tailscale has no tailcfg/nodecap package, so the constants keep their
tailcfg names here.

(cherry picked from commit 06fa3075da)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby 694bafee0a policy/v2: compare peer CapMap against SaaS route captures 
SaaS stamps suggest-exit-node on approved exit peers without nodeAttrs.

Updates #3415

(cherry picked from commit 0e8a3bba54)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby 8490631f06 policy/v2: add via exit node capture 
Updates #3408

(cherry picked from commit 5861005ef6)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby a7f7e6a401 servertest: compare user-owned nodes in via compat tests 
Updates #3408

(cherry picked from commit 23f7eedac6)
 2026-09-23 21:19:22 +02:00
Andrei Korviakov ebe18cebff hscontrol: keep the ACME error body readable in acmeLogger 
acmeLogger drained and closed the body of every ACME error response before
handing the response back to golang.org/x/crypto/acme. The client parses that
body to classify errors, so badNonce was no longer recognised: isBadNonce
returned false, clearNonces was never called and Client.post treated the 400 as
non-retriable.

One badNonce reply therefore stops certificate renewal for good. autocert
retries every 30-60 minutes, each attempt reuses a nonce stored from the
previous failed response, that nonce has already expired, and the loop repeats
until the process is restarted or the certificate expires.

Restore the body with a fresh reader after logging it.

(cherry picked from commit 7472e98f6c)
 2026-09-23 21:19:22 +02:00
Kristoffer Dalby aa4c952bca policy: ignore '#' metadata fields across the whole policy 
The filter lived in ACL.UnmarshalJSON, so grants, ssh and nodeAttrs still
hit RejectUnknownMembers. Strip the members in the HuJSON AST instead, at
the single decode entrypoint. Grant "app" payloads are left untouched.

Fixes #3479

(cherry picked from commit 5401edb6a8)
 2026-09-23 21:19:22 +02:00