public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 20:49:24 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,970 Commits 106 Branches 177 Tags
8ea774564d02a3f703ea46b2f7b0ffbbce2a8b82
Commit Graph
104 Commits
Author SHA1 Message Date
Kristoffer Dalby bba7252ec5 db: keep at most 1000 access tokens per OAuth client 
Minting needs only the client secret, whatever its scopes, and
added one row per mint. Each mint now ends tokens past the newest 1000.
 2026-10-28 18:28:23 +00:00
Kristoffer Dalby 0fabc27a0d debug: refuse requests addressed to unknown host names 2026-10-28 18:28:23 +00:00
Kristoffer Dalby 86578c5fbf policy/v2: prefer the user owning an email over a username match 2026-10-28 18:28:23 +00:00
Kristoffer Dalby 148fc208f9 types: drop a stored OIDC email the login no longer vouches for 2026-10-28 18:28:23 +00:00
Kristoffer Dalby 3ce5bf5d9a policy/v2, state: elect primaries by oldest control session 
A router that reconnects joins as a standby; one that kept its session
takes its routes back once available again, as on Tailscale. Both the
global and the via election use it, in place of anti-flap stickiness.
 2026-10-28 18:28:22 +00:00
Kristoffer Dalby 2e8611c159 docs: use tls block keys and describe CertMagic 
Updates #2527
 2026-10-18 20:53:18 +02:00
Sandro 5f03627408 Update link to node attributes 2026-10-06 05:30:26 +02:00
yuwk 3486ab2fc2 docs: fix "is may be" grammar in policy reference 
Signed-off-by: yuwk <1729065730@qq.com>
 2026-09-29 18:30:38 +02:00
yuwk 32939914d3 docs: fix "specfic" typo in policy reference 
Signed-off-by: yuwk <1729065730@qq.com>
 2026-09-29 18:30:38 +02:00
Kristoffer Dalby 62f89ca25d cli: accept a user name in preauthkeys create --user 
Resolved through lookupUser like the users commands, so scripts skip the
users list round trip. Digit-only values stay IDs.
 2026-09-28 21:42:19 +02:00
Kristoffer Dalby 906016beb4 dns: pick the extra_records_path format by file extension 
HuJSON and YAML records work too; an unknown extension fails instead of being
parsed as JSON.
 2026-09-28 21:42:19 +02:00
Kristoffer Dalby dd8ce695cf derp: pick the derp.paths format by file extension 
Adds JSON and HuJSON maps. JSON read as YAML decoded to an empty map; unknown
extensions and empty maps now fail at startup.
 2026-09-28 21:42:19 +02:00
Kristoffer Dalby eebeab3c1e docs: document joining nodes with an OAuth client 
Prefix swap, baseURL, every attribute; examples for tailscale up,
container, tsnet, GitHub Action.
 2026-09-25 17:09:19 +02:00
Kristoffer Dalby 616c9b6495 docs: warn about listen_addr / ACME port collision 
Add a callout under the HTTP-01 docs so operators see the
constraint before they hit the validation error at startup.

Updates #3227
 2026-09-23 15:18:34 +02:00
Florian Preinstorfer 38722e5eeb Document automatic exit node selection and related node attributes 
- Add "Automatic exit node selection" to route docs
- Add suggest-exit-node and suggest-exit-node-ui as supported nodeAttrs

Fixes: #3444
 2026-09-08 10:32:27 +02:00
Lukas Wolfsteiner 89fa72e08f docs: add repository star count and activity badges to web UI list 2026-09-02 13:33:22 +02:00
Florian Preinstorfer a066a06bef Fix invalid ip syntax 
The "ip" field needs to be a list.
 2026-06-24 08:27:33 +02:00
Florian Preinstorfer 3c504af2be Fix placeholder in curl example 2026-06-20 10:41:57 +02:00
Florian Preinstorfer 7af39a6798 Add headscale-panel to webui docs 2026-06-20 10:41:57 +02:00
Florian Preinstorfer d7150755d4 TLS is not strictly required 2026-06-19 18:52:30 +02:00
Florian Preinstorfer 88234d4046 Replace /swagger with /api/v1/docs 2026-06-19 18:52:30 +02:00
Kristoffer Dalby 72adc5ff2a docs: add changelog and refresh the API reference for the v1 API 2026-06-19 15:21:00 +02:00
Florian Preinstorfer 6777a82ee6 Rewrite reverse proxy documentation 
- Restructure and cleanup reverse proxy docs
- Update examples for Apache, Caddy, Nginx
- Provide some basic usage examples
 2026-06-04 09:59:19 +02:00
Florian Preinstorfer f3f84a5a63 Add docs for policy-wide options and node attributes 2026-05-18 17:21:58 +02:00
Kristoffer Dalby 963daf8908 docs: document trusted_proxies config option 
Cover the option in config-example.yaml, the reverse-proxy
integration guide, and the 0.29.0 CHANGELOG.
 2026-05-18 17:17:55 +02:00
Florian Preinstorfer 109bfc404c Refresh docs for Grants 
- Mention policy as generic term that covers ACLs or Grants
- Refresh routes policy examples
- Remove Headscale specific exit node separation. Use via instead.

Fixes: #3087
 2026-05-12 14:12:29 +02:00
Florian Preinstorfer edb7ad0f81 Rewrite ACL docs as policy 
- Rename from acl.md to policy.md and setup redirect links
- Mention both ACLs and Grants
- Remove most old ACL docs and replace with links to Tailscale docs
- Add "Getting started" section
- Add section about notable differences
 2026-05-12 14:12:29 +02:00
Florian Preinstorfer e13f0458bb Remove redundant prefix 2026-05-12 14:12:29 +02:00
Florian Preinstorfer c7f221dd0a Fix typo and wording 2026-05-12 14:12:29 +02:00
MunMunMiao e597f4c8a0 Add Headscale UI to web UI documentation 2026-05-09 05:02:44 +02:00
Florian Preinstorfer f1494a32ce Update links to Tailscale documentation 2026-04-18 09:33:41 +02:00
Florian Preinstorfer 7e6c7924ad Document availability of autgroup:internet 2026-04-18 09:33:41 +02:00
Florian Preinstorfer 813eb2d733 Update docs for new HA tracking 
Also shorten the description in config-example.yaml a bit.
 2026-04-17 16:59:57 +02:00
Kristoffer Dalby 4d0b273b90 types: add node.expiry config, deprecate oidc.expiry 
Introduce a structured NodeConfig that replaces the flat
EphemeralNodeInactivityTimeout field with a nested Node section.

Add node.expiry config (default: no expiry) as the unified default key
expiry for all non-tagged nodes regardless of registration method.

Remove oidc.expiry entirely — node.expiry now applies to OIDC nodes
the same as all other registration methods. Using oidc.expiry in the
config is a hard error. determineNodeExpiry() returns nil (no expiry)
unless use_expiry_from_token is enabled, letting state.go apply the
node.expiry default uniformly.

The old ephemeral_node_inactivity_timeout key is preserved for
backwards compatibility.

Updates #1711
 2026-04-08 13:00:22 +01:00
Florian Preinstorfer efd83da14e Explicitly mention that a headscale username should *not* end with @ 
See: #3149
 2026-03-20 19:44:33 +01:00
Florian Preinstorfer 9baa795ddb Update docs for auth-id changes
Build / build-nix (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=linux) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=linux) (push) Has been cancelled
Check Generated Files / check-generated (push) Has been cancelled
Deploy docs / deploy (push) Has been cancelled
NixOS Module Tests / nix-module-check (push) Has been cancelled
Tests / test (push) Has been cancelled
Needs More Info - Timer / remove-label-on-response (push) Has been cancelled
Needs More Info - Timer / close-stale (push) Has been cancelled
Close inactive issues / close-issues (push) Has been cancelled 
- Replace "headscale nodes register" with "headscale auth register"
- Update from registration key to Auth ID
- Fix API example to register a node
 2026-03-01 13:38:22 +01:00
Florian Preinstorfer acddd73183 Reformat docs with mdformat 2026-03-01 09:24:52 +01:00
Stefan Bethke 0f12e414a6 Explain one approach to update OIDC provider info
Build / build-nix (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=linux) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=linux) (push) Has been cancelled
Check Generated Files / check-generated (push) Has been cancelled
NixOS Module Tests / nix-module-check (push) Has been cancelled
Tests / test (push) Has been cancelled
Deploy docs / deploy (push) Has been cancelled 
See #3112
 2026-02-27 10:06:50 +01:00
Stefan Bethke df339cd290 Add a link to Authentik's integration guide 2026-02-27 09:56:18 +01:00
Florian Preinstorfer faf55f5e8f Document how to use the provider identifier in the policy
Build / build-nix (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=linux) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=linux) (push) Has been cancelled
Check Generated Files / check-generated (push) Has been cancelled
NixOS Module Tests / nix-module-check (push) Has been cancelled
Tests / test (push) Has been cancelled
Deploy docs / deploy (push) Has been cancelled
Needs More Info - Timer / remove-label-on-response (push) Has been cancelled
Needs More Info - Timer / close-stale (push) Has been cancelled
Close inactive issues / close-issues (push) Has been cancelled
2026-02-18 10:24:05 +01:00
Florian Preinstorfer e3323b65e5 Describe how to set username instead of SPN for Kanidm 2026-02-18 10:24:05 +01:00
Florian Preinstorfer 890a044ef6 Add more UIs 2026-02-16 15:22:46 +01:00
Florian Preinstorfer 8028fa5483 No longer consider autogroup:self experimental 2026-02-16 15:22:46 +01:00
Florian Preinstorfer 5d300273dc Add a tags page and describe a few common operations
Build / build-nix (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=amd64 GOOS=linux) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=darwin) (push) Has been cancelled
Build / build-cross (GOARCH=arm64 GOOS=linux) (push) Has been cancelled
Check Generated Files / check-generated (push) Has been cancelled
Deploy docs / deploy (push) Has been cancelled
NixOS Module Tests / nix-module-check (push) Has been cancelled
Tests / test (push) Has been cancelled
Close inactive issues / close-issues (push) Has been cancelled
update-flake-lock / lockfile (push) Has been cancelled
GitHub Actions Version Updater / build (push) Has been cancelled
2026-01-28 15:52:57 +01:00
Florian Preinstorfer 7f003ecaff Add a page to describe supported registration methods 2026-01-28 15:52:57 +01:00
Florian Preinstorfer 2695d1527e Use registration key instead of machine key 2026-01-28 15:52:57 +01:00
Florian Preinstorfer d32f6707f7 Add missing words 2026-01-28 15:52:57 +01:00
Florian Preinstorfer 8387c9cd82 Fix ownership description for auto approved routers/exits 
Just the tags tag:router and tag:exit are owned by alice. Upon join,
those nodes will have their ownership transferred from alice to the
system user "tagged-devices".
 2026-01-16 14:54:04 +01:00
Florian Preinstorfer 183a38715c Fix list-routes examples 2026-01-16 14:54:04 +01:00
Florian Preinstorfer 99d35fbbbc Document oidc.email_verification_required 2026-01-16 14:54:04 +01:00