5176dd23a9
cmd/headscale: wait for the local socket while the server starts
...
A CLI command issued right after startup can beat headscale to binding
its unix socket. Retry the dial until the CLI timeout, matching the old
blocking gRPC dial, instead of failing on a missing socket file.
2026-06-19 05:58:10 +00:00
d955cd6262
docs: replace gRPC remote-control with HTTP API
...
The remote CLI speaks HTTP to the API URL now; drop the gRPC port,
grpc_listen_addr, and #grpc anchors.
2026-06-19 05:58:10 +00:00
33774888c2
all: remove dead gRPC config, tests, and helpers
...
Drop grpc_listen_addr/grpc_allow_insecure config, the gRPC auth integration
tests, GrpcSocketDialer, and stale gRPC comments now that the API is HTTP-only.
2026-06-19 05:58:10 +00:00
8e194721b7
ci, flake: drop proto/buf lint and tooling
...
The proto/gRPC stack is gone; remove the buf lint job and the protobuf/grpc/buf
nix dev-shell inputs.
2026-06-19 05:58:10 +00:00
08885c33da
docs: mark v1-ogen conversion complete
2026-06-19 05:57:04 +00:00
b988027bb8
proto: remove the Protobuf/gRPC service and generated code
...
Delete proto/, gen/go/, gen/openapiv2/, and the buf config now that the v1 API
is served entirely by the ogen OpenAPI stack. Drop the proto lint/format targets
and refresh the vendor hash.
2026-06-19 05:57:04 +00:00
112c42af0a
integration: port tests to the ogen API types
...
Decode CLI/HTTP output into apiv1 (ogen) types instead of the proto types,
matching the new wire format. No proto package is imported outside gen/go now.
2026-06-19 05:57:04 +00:00
db6b99d414
types: drop the proto builders
...
Remove the Proto() methods and RegisterMethodToV1Enum; the v1 API builds
responses from the state views directly now.
2026-06-19 05:57:04 +00:00
8f5e2e7291
hscontrol: remove the gRPC service and server
...
Delete grpcv1.go, the TCP gRPC listener, the gRPC auth interceptor, and the
now-unused HTTP bearer middleware. The v1 API is served only over HTTP (TCP +
unix socket) by the ogen stack.
2026-06-19 05:57:04 +00:00
b5e3b4ee27
hscontrol/api/v1: build responses from state views, not proto
...
Convert directly from NodeView/UserView/PreAuthKeyView (no AsStruct copies, no
proto bridge), preserving the view types on the read path. Add UserView.Username
and drop the two state.go uses of PreAuthKey.Proto().
2026-06-19 05:57:04 +00:00
bbb171d02f
docs: reconcile v1-ogen plan with delivered state
2026-06-19 05:57:04 +00:00
e1325fbacd
serve the OpenAPI 3.0 spec at /swagger
...
Embed openapi/v1/headscale.yaml and point the Swagger UI at it, replacing the
generated Swagger 2.0 document.
2026-06-19 05:57:04 +00:00
29fc14dd73
cmd/headscale: run the CLI on the generated v1 HTTP client
...
Serve the API over the unix socket (auth bypassed; socket permissions are the
trust boundary) and convert every CLI command from the gRPC client to the
generated ogen client. Remote CLI now uses the HTTP API URL.
2026-06-19 05:57:04 +00:00
de85965bd8
hscontrol/api/v1: implement auth and policy endpoints
...
AuthRegister/Approve/Reject and GetPolicy/SetPolicy/CheckPolicy over the state
layer, completing all v1 operations. HTTP-parity tests included.
2026-06-19 05:57:04 +00:00
83fb0a4548
hscontrol/api/v1: implement node endpoints
...
Register, Get, List, Delete, Rename, Expire, SetTags, SetApprovedRoutes (with
exit-route expansion), BackfillNodeIPs, DebugCreateNode over the state layer.
Tagged nodes present as TaggedDevices; client errors map to 4xx.
2026-06-19 05:57:04 +00:00
fc26c447ec
hscontrol/api/v1: implement pre-auth key endpoints
...
CreatePreAuthKey (with ACL tag validation), ListPreAuthKeys, ExpirePreAuthKey,
DeletePreAuthKey over the state layer, with HTTP-parity tests.
2026-06-19 05:57:04 +00:00
df6876a570
hscontrol/api/v1: implement API key endpoints
...
CreateApiKey, ListApiKeys, ExpireApiKey, DeleteApiKey (by id or prefix) over
the state layer, with HTTP-parity tests.
2026-06-19 05:57:04 +00:00
fe76fe0f57
hscontrol/api/v1: implement user endpoints
...
CreateUser, ListUsers (with filters), RenameUser, DeleteUser over the state
layer; unknown users now 404. HTTP-parity tests via the generated client.
2026-06-19 05:57:04 +00:00
1eabd70567
docs: add v1-ogen migration plan and changelog
2026-06-19 05:57:04 +00:00
562fcc1401
hscontrol: serve v1 API via ogen, replace grpc-gateway facade
...
Mount the ogen-generated server at /api/v1 with bearer-auth and RFC 7807
errors backed by the state layer; gRPC servers stay for the CLI. Add a
servertest API client harness and Health parity tests.
2026-06-19 05:57:03 +00:00
01dcd4011e
gen: generate v1 API server and client with ogen
...
go generate (gen/api/v1) runs ogen against openapi/v1/headscale.yaml; ogen
added as a tool dependency. CI freshness check covers openapi/.
2026-06-19 05:57:03 +00:00
38dad226c8
openapi: add v1 API OpenAPI 3.0 specification
...
Single source of truth for the v1 HTTP API: 27 operations, native int64
ids, RFC 7807 problem responses, bearer auth.
2026-06-19 05:57:03 +00:00
a00de89c85
ci: run nix jobs with --fallback
...
cache.nixos.org intermittently serves corrupt NARs; build from source on
substitute failure instead of failing the job.
2026-06-18 21:11:14 +02:00
f5198841bd
ci: drop Docker v28 pin from release workflow
...
Engine 29 build compat is fixed in the client; the downgrade is no longer
needed.
2026-06-18 21:11:14 +02:00
dfc25f06e1
integration: pin docker client to daemon API version
...
dockertest's bundled client builds against API v1.25; Docker Engine 29
rejects it (min 1.40), surfacing as a "broken pipe" that fails every local
image build. Pin to the daemon's reported version so builds use a live path.
Closes #2937
2026-06-18 21:11:14 +02:00
74928c0241
integration: regenerate test matrix for new CLI tests
2026-06-18 15:21:11 +02:00
9aba06ec7d
integration: backfill CLI command coverage
...
Regroup the CLI tests into per-command files and cover every command
except debug/config with CRUD, flag and error permutations, asserted as
JSON.
2026-06-18 15:21:11 +02:00
00afce77b1
ci: run nixos module check with --fallback
...
cache.nixos.org intermittently serves corrupt NARs; build from source
on substitute failure instead of failing the job.
2026-06-18 14:54:44 +02:00
9f1886f587
db: preserve user_id on untagged nodes with tags='null'
...
A nil tags slice marshals to JSON `null`; the clear-tagged migration
read that as tagged and cleared user_id. Exclude it, and recover
already-detached nodes from their pre-auth key.
Fixes #3323
2026-06-18 14:54:44 +02:00
ea5165e325
util, db: generate key material as hex via tailscale rands
2026-06-17 16:12:19 +02:00
368b9e7edd
state: add regression test for NodeKey-rotation binding
2026-06-17 16:12:19 +02:00
abfd5c9236
types: reject port-bearing server_url under base_domain
2026-06-17 16:12:19 +02:00
e4cd846075
handlers: set verify Content-Type before writing the body
2026-06-17 16:12:19 +02:00
4b693a1320
oidc, types: validate pkce.method when OIDC is active
2026-06-17 16:12:19 +02:00
4f4e95fc80
all: adopt strings, errors, and os helpers
2026-06-17 16:12:19 +02:00
27468f944b
all: adopt maps and cmp helpers
2026-06-17 16:12:19 +02:00
ac725f27e4
all: adopt slices helpers
2026-06-17 16:12:19 +02:00
60f0544b78
dns, change, noise, auth, capver: misc consolidation
2026-06-17 16:12:19 +02:00
ea5e52f662
hi: consolidate doctor and stats helpers
2026-06-17 16:12:19 +02:00
722a2f1e18
integration, hsic, tsic, dockertestutil: consolidate container helpers
2026-06-17 16:12:19 +02:00
75b09cb991
servertest: consolidate harness helpers
2026-06-17 16:12:19 +02:00
0320b56911
oidc: consolidate cookie helpers and logging
2026-06-17 16:12:19 +02:00
62869f01d2
app: simplify TLS and auth setup
2026-06-17 16:12:19 +02:00
19d5d9deeb
derp: simplify DERP map handling
2026-06-17 16:12:19 +02:00
c3cfbf1cc0
grpcv1: share list-RPC response helpers
2026-06-17 16:12:19 +02:00
fdc7e26c8a
util: consolidate parsing and encoding helpers
2026-06-17 16:12:19 +02:00
45e6e90d11
types: consolidate DNS, identifier, and proto helpers
2026-06-17 16:12:19 +02:00
468f70a9e5
templates: consolidate shared page and component helpers
2026-06-17 16:12:19 +02:00
8c10a96921
hscontrol: consolidate debug-endpoint and template helpers
2026-06-17 16:12:19 +02:00
3979887d8d
mapper: consolidate builder and connection helpers
2026-06-17 16:12:19 +02:00
Kristoffer Dalby