public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-10-26 00:06:53 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,725 Commits 84 Branches 176 Tags
691ef56329854e952efed5e3c81ea600f46a58b5
Commit Graph
4725 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby 691ef56329 AGENTS: keep libdns providers and certmagic on one libdns major 
Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 2ba21d2f8d CHANGELOG: add tls block and certmagic 
Updates #2527
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 2e8611c159 docs: use tls block keys and describe CertMagic 
Updates #2527
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby ed854650f0 nix: declare nested tls options 
Old settings.tls_* keys pass through to headscale, which still reads them;
new options default to null so they do not shadow them.

Updates #2527
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 5d15cc930d hscontrol: replace autocert with certmagic 
Adds DNS-01 for headscale's own certificate through dns.challenge.provider,
with the same propagation check as node certificates. Storage format
changes: first start gets a new account and certificate.

Updates #2527
Updates #504
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby dcc01dc2b0 types: move TLS config under tls with legacy fallback 
tls.cert_path, tls.key_path and tls.acme.* replace the flat keys, which
still work. Warn on them only when they turn TLS on: NixOS always sets them.

Updates #2527
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby ee47638787 CHANGELOG: add TLS certificates for nodes 
Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 7ed3dead3e nix: add dns.certificates and dns.challenge options 
Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 694587bfa0 docs: mark Serve as supported 
HTTPS serve needs dns.certificates; Funnel and Services stay unsupported.

Updates #1921
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby d8bcaca066 github: add TestTailscaleCert to integration workflow 
Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 2a30fb6b3b integration: add tailscale cert test 
Every client version gets a certificate from Pebble through rfc2136 and
a TSIG-checked DNS server in the test process, then runs each serve
mode; identity headers name the requesting user.

Updates #2137
Updates #1921
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby eef0d1fe47 dns: add acme-dns provider 
_acme-challenge is CNAMEd once to an acme-dns registration, so headscale
needs no DNS credentials. Node certificates need one registration per
name; CNAME chains are followed and writes never evict a live value.

Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby f16d5e1857 noise: implement /machine/set-dns 
A node may publish only its own _acme-challenge TXT value; any other
request is rejected before the provider is called. Answers once all
authoritative nameservers serve the value; 503 while shutting down.

Fixes #2137
Fixes #1921
Fixes #2527
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 3f6e54cbd5 mapper: send CertDomains and https cap when certificates are enabled 
Both gate tailscale cert and serve HTTPS on the client; httpsEnabled
follows, as in Tailscale. No certificate when an operator extra record
sits at or below the name: a wildcard would cover it.

Updates #2137
Updates #1921
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby a928125afa state: lowercase renames and refresh self DNS config on rename 
"Foo" and "foo" could share one DNS name; collisions now ignore case.
A rename never resent the node its own DNS config, so CertDomains lagged.

Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 0efe4b7798 types: add dns.challenge and dns.certificates config 
dns.challenge.provider builds a libdns provider at load, so configtest
catches typos. dns.certificates gates node certs; zone defaults to base_domain.

Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 6cb950cd9e dns: add ACME challenge tracker and propagation check 
Exact appends and deletes; values go 10m after last use or on Close.
Limits per node, one lock for provider writes. Waits for every
authoritative NS and holds a new value until the CA cache has expired.

Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 24cf63294c dns: add libdns provider registry 
Curated cloudflare, gigahost, hetzner, powerdns and rfc2136.
Settings decode via json tags; env per field, <field>_path for secrets.

Updates #2137
 2026-10-18 20:53:18 +02:00
Serhii Matsyshyn a777969027 CHANGELOG: one peer map build per policy write 2026-10-18 13:18:48 +02:00
Serhii Matsyshyn 8f3ba2d8cd state: rebuild peer maps in ReloadPolicy only when the policy changed 
The SetPolicy API handler calls State.SetPolicy, which already rebuilds the peer map when the policy changed, and then ReloadPolicy, which rebuilt it again even when nothing changed. So every policy write built the peer map twice.

ReloadPolicy now rebuilds only when the policy really changed. A test checks one build per changed write and none for an unchanged reload.

Part of #3549
 2026-10-18 13:18:48 +02:00
github-actions[bot] 362cdaeef8 Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3562#issuecomment-6249089869
 2026-10-18 13:10:17 +02:00
github-actions[bot] 9314f4e778 Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3559#issuecomment-6249075866
 2026-10-18 13:09:02 +02:00
github-actions[bot] fc97593bce Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3549#issuecomment-6193920631
 2026-10-15 16:04:19 +02:00
Kristoffer Dalby 9f074ac15b policy/v2: keep comments in a policy set through the v2 API 
hujson.Parse aliases its input, so Standardize blanked the comments in
the caller's buffer, which api/v2 then stored.
 2026-10-15 13:28:12 +02:00
Kristoffer Dalby 380d1b0d0a tools/bump: carry hand-pushed commits instead of pausing 
Open PR with commits by others: rebase onto base, build on top, push
with lease. Rebase conflict pauses and comments once.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 920b6fb8cd CHANGELOG: raise minimum Tailscale client to v1.84.0 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 1077a9ff6a capver: regenerate for Tailscale v1.104 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 3e5c07c95c go.mod: update dependencies dropped by the bump bot 
tailscale.com (gvisor), sqlite (libc), x/net, x/tools and friends.
tailscale.com now requires go 1.27.2.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 89be098f76 integration/tsic: drop unused watchIPN 
ipn.Notify.NetMap is gone upstream; nothing called it.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 627145644e noise: serve ts2021 via net/http unencrypted HTTP/2 
x/net/http2.Server is deprecated and now wraps net/http anyway.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby fd09dd86f2 tools/bump: upgrade modules behind tool directives 
x/tools is indirect, so never moved; v0.49.0 cannot read Go 1.27.2
export data and viewer emits invalid types, failing go generate.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby bf63feb320 tools/bump: stop commenting when applied areas change 
Description already carries the outcome; the comment was noise.
 2026-10-15 10:50:32 +02:00
github-actions[bot] a2e4451fcf Dockerfile: bump golang builders to 1.27.2 / 1.27.2 2026-10-15 10:50:32 +02:00
github-actions[bot] b867810279 go.mod: update dependencies 2026-10-15 10:50:32 +02:00
github-actions[bot] d2dd5ed77f flake.lock: update flake-utils_2, nixpkgs 2026-10-15 10:50:32 +02:00
Kristoffer Dalby efe18a89cd mkdocs: bump version 2026-10-13 14:38:29 +02:00
Kristoffer Dalby b6ac75a343 CHANGELOG: move 0.29.5 backports out of 0.30.0 
Align the 0.29.5 section with the release branch.
 2026-10-13 14:38:29 +02:00
github-actions[bot] cee9066e91 .github: bump 3 action pins 2026-10-13 12:02:59 +02:00
github-actions[bot] 586a78357a Dockerfile: bump rust 1.98-trixie to 1.99-trixie 2026-10-13 12:02:59 +02:00
github-actions[bot] cdb0a5e58e Dockerfile: bump golang builders to 1.27.2 / 1.27.1 2026-10-13 12:02:59 +02:00
github-actions[bot] c3f83b6c05 go.mod: update dependencies 2026-10-13 12:02:59 +02:00
github-actions[bot] a1dd3172f9 flake.lock: update nixpkgs 2026-10-13 12:02:59 +02:00
Martin -nexus- Mlynář a8d6f5be81 state: send a relogin as a whole node unless only its keys changed 
A PeerChange patch cannot clear a peer's Expired flag or carry the
Hostinfo the relogin stored.

Fixes #3531
 2026-10-09 11:44:37 +02:00
Kristoffer Dalby 49b848a83d state: compare peer-visible Hostinfo through views 
Field by field: no allocation, no reflection.

Updates #3531
 2026-10-09 11:44:37 +02:00
Kristoffer Dalby 9c764e5a99 state: return the replaced node from NodeStore updates 
UpdateNodeDiff hands back the pre-update clone the writer already makes.

Updates #3531
 2026-10-09 11:44:37 +02:00
LuoChen aaf4ccd8c9 util, types: parse unix_socket_permission strictly 
Default "0o770" failed the base-8 parse and silently became 0700.
Invalid, unquoted or above-0777 values now fail config load.

Fixes #3529
 2026-10-09 11:42:53 +02:00
Kristoffer Dalby c9852c43da ci: distribute the compiled integration test binary 2026-10-09 11:41:09 +02:00
Kristoffer Dalby bcc71f9b57 integration: reuse images and remove redundant scenario setup 2026-10-09 11:41:09 +02:00
Kristoffer Dalby 47653f06fb integration: avoid toolchain work and login waits in CI 2026-10-09 11:41:09 +02:00
Jonas Schwartz 519b4621f3 policy/v2: add Grant.HasVia and tighten the changelog entry 2026-10-08 12:43:45 +02:00