109 Commits

Include renames

Author	SHA1	Message	Date
Kristoffer Dalby	1bce65a236	policy/v2: name ssh-behavior-v1 a deliberate difference ... SaaS stamps it on every node. Sending it would change existing users' login environment, so it stays a nodeAttr. Document that and pin it.	2026-11-03 17:05:00 +01:00
Kristoffer Dalby	b3ffec4269	hscontrol: reload manual TLS certificate on SIGHUP ... Files that fail to load or are not valid now keep the previous certificate. Fixes #3027 Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h	2026-11-03 15:52:52 +01:00
Igor Serganov	d0e10f2d46	util: read .json files as HuJSON in UnmarshalByExt (#3634) ... dns.extra_records_path and derp.paths files ending in .json were decoded with encoding/json, so a comment or trailing comma in otherwise valid JSON made headscale refuse to load the file. Policy files already accept HuJSON regardless of extension. HuJSON is a superset of JSON, so standardizing .json input the same way as .hujson keeps every valid JSON file decoding exactly as before. Add tests for comments and trailing commas in extra records, in generic .json decoding and in ACL policies, and for comment markers inside string values. Fixes #3627	2026-11-02 20:35:24 +01:00
Kristoffer Dalby	4e946edb08	api/v2: enforce and document OAuth tag permissions ... Retagging requires all current and requested tags; disallowed tags return 400. Token responses list tags only when the token may assign them.	2026-11-02 19:15:40 +01:00
Kristoffer Dalby	9979be140e	db: keep at most 1000 access tokens per OAuth client ... Minting needs only the client secret, whatever its scopes, and added one row per mint. Each mint now ends tokens past the newest 1000.	2026-11-02 19:15:40 +01:00
Kristoffer Dalby	75e2377f25	debug: refuse requests addressed to unknown host names	2026-11-02 19:15:40 +01:00
Kristoffer Dalby	5dff6ca432	policy/v2: resolve user references consistently across updates ... Prefer email owners over usernames and validate grants and nodeAttrs on write. Reject ambiguous writes; log and match nobody on reload. Bare @ matches nobody.	2026-11-02 19:15:40 +01:00
Kristoffer Dalby	14baf55421	state, oidc: persist user changes and refresh nodes and clients ... Write cleared user columns, discard OIDC email the provider no longer vouches for, refresh NodeStore users, and notify clients from the callback. Fixes #3471	2026-11-02 19:15:40 +01:00
Kristoffer Dalby	4342883bd4	policy/v2, state: elect primaries by oldest control session ... A router that reconnects joins as a standby; one that kept its session takes its routes back once available again, as on Tailscale. Both the global and the via election use it, in place of anti-flap stickiness.	2026-11-02 19:15:40 +01:00
Kristoffer Dalby	c0925962c2	hscontrol: bound pending authentication without evicting sessions	2026-10-29 20:51:50 +01:00
Kristoffer Dalby	2e8611c159	docs: use tls block keys and describe CertMagic ... Updates #2527	2026-10-18 20:53:18 +02:00
Sandro	5f03627408	Update link to node attributes	2026-10-06 05:30:26 +02:00
yuwk	3486ab2fc2	docs: fix "is may be" grammar in policy reference ... Signed-off-by: yuwk <1729065730@qq.com>	2026-09-29 18:30:38 +02:00
yuwk	32939914d3	docs: fix "specfic" typo in policy reference ... Signed-off-by: yuwk <1729065730@qq.com>	2026-09-29 18:30:38 +02:00
Kristoffer Dalby	62f89ca25d	cli: accept a user name in preauthkeys create --user ... Resolved through lookupUser like the users commands, so scripts skip the users list round trip. Digit-only values stay IDs.	2026-09-28 21:42:19 +02:00
Kristoffer Dalby	906016beb4	dns: pick the extra_records_path format by file extension ... HuJSON and YAML records work too; an unknown extension fails instead of being parsed as JSON.	2026-09-28 21:42:19 +02:00
Kristoffer Dalby	dd8ce695cf	derp: pick the derp.paths format by file extension ... Adds JSON and HuJSON maps. JSON read as YAML decoded to an empty map; unknown extensions and empty maps now fail at startup.	2026-09-28 21:42:19 +02:00
Kristoffer Dalby	eebeab3c1e	docs: document joining nodes with an OAuth client ... Prefix swap, baseURL, every attribute; examples for tailscale up, container, tsnet, GitHub Action.	2026-09-25 17:09:19 +02:00
Kristoffer Dalby	616c9b6495	docs: warn about listen_addr / ACME port collision ... Add a callout under the HTTP-01 docs so operators see the constraint before they hit the validation error at startup. Updates #3227	2026-09-23 15:18:34 +02:00
Florian Preinstorfer	38722e5eeb	Document automatic exit node selection and related node attributes ... - Add "Automatic exit node selection" to route docs - Add suggest-exit-node and suggest-exit-node-ui as supported nodeAttrs Fixes: #3444	2026-09-08 10:32:27 +02:00
Lukas Wolfsteiner	89fa72e08f	docs: add repository star count and activity badges to web UI list	2026-09-02 13:33:22 +02:00
Florian Preinstorfer	a066a06bef	Fix invalid ip syntax ... The "ip" field needs to be a list.	2026-06-24 08:27:33 +02:00
Florian Preinstorfer	3c504af2be	Fix placeholder in curl example	2026-06-20 10:41:57 +02:00
Florian Preinstorfer	7af39a6798	Add headscale-panel to webui docs	2026-06-20 10:41:57 +02:00
Florian Preinstorfer	d7150755d4	TLS is not strictly required	2026-06-19 18:52:30 +02:00
Florian Preinstorfer	88234d4046	Replace /swagger with /api/v1/docs	2026-06-19 18:52:30 +02:00
Kristoffer Dalby	72adc5ff2a	docs: add changelog and refresh the API reference for the v1 API	2026-06-19 15:21:00 +02:00
Florian Preinstorfer	6777a82ee6	Rewrite reverse proxy documentation ... - Restructure and cleanup reverse proxy docs - Update examples for Apache, Caddy, Nginx - Provide some basic usage examples	2026-06-04 09:59:19 +02:00
Florian Preinstorfer	f3f84a5a63	Add docs for policy-wide options and node attributes	2026-05-18 17:21:58 +02:00
Kristoffer Dalby	963daf8908	docs: document trusted_proxies config option ... Cover the option in config-example.yaml, the reverse-proxy integration guide, and the 0.29.0 CHANGELOG.	2026-05-18 17:17:55 +02:00
Florian Preinstorfer	109bfc404c	Refresh docs for Grants ... - Mention policy as generic term that covers ACLs or Grants - Refresh routes policy examples - Remove Headscale specific exit node separation. Use via instead. Fixes: #3087	2026-05-12 14:12:29 +02:00
Florian Preinstorfer	edb7ad0f81	Rewrite ACL docs as policy ... - Rename from acl.md to policy.md and setup redirect links - Mention both ACLs and Grants - Remove most old ACL docs and replace with links to Tailscale docs - Add "Getting started" section - Add section about notable differences	2026-05-12 14:12:29 +02:00
Florian Preinstorfer	e13f0458bb	Remove redundant prefix	2026-05-12 14:12:29 +02:00
Florian Preinstorfer	c7f221dd0a	Fix typo and wording	2026-05-12 14:12:29 +02:00
MunMunMiao	e597f4c8a0	Add Headscale UI to web UI documentation	2026-05-09 05:02:44 +02:00
Florian Preinstorfer	f1494a32ce	Update links to Tailscale documentation	2026-04-18 09:33:41 +02:00
Florian Preinstorfer	7e6c7924ad	Document availability of autgroup:internet	2026-04-18 09:33:41 +02:00
Florian Preinstorfer	813eb2d733	Update docs for new HA tracking ... Also shorten the description in config-example.yaml a bit.	2026-04-17 16:59:57 +02:00
Kristoffer Dalby	4d0b273b90	types: add node.expiry config, deprecate oidc.expiry ... Introduce a structured NodeConfig that replaces the flat EphemeralNodeInactivityTimeout field with a nested Node section. Add node.expiry config (default: no expiry) as the unified default key expiry for all non-tagged nodes regardless of registration method. Remove oidc.expiry entirely — node.expiry now applies to OIDC nodes the same as all other registration methods. Using oidc.expiry in the config is a hard error. determineNodeExpiry() returns nil (no expiry) unless use_expiry_from_token is enabled, letting state.go apply the node.expiry default uniformly. The old ephemeral_node_inactivity_timeout key is preserved for backwards compatibility. Updates #1711	2026-04-08 13:00:22 +01:00
Florian Preinstorfer	efd83da14e	Explicitly mention that a headscale username should *not* end with @ ... See: #3149	2026-03-20 19:44:33 +01:00
Florian Preinstorfer	9baa795ddb	Update docs for auth-id changes ... - Replace "headscale nodes register" with "headscale auth register" - Update from registration key to Auth ID - Fix API example to register a node	2026-03-01 13:38:22 +01:00
Florian Preinstorfer	acddd73183	Reformat docs with mdformat	2026-03-01 09:24:52 +01:00
Stefan Bethke	0f12e414a6	Explain one approach to update OIDC provider info ... See #3112	2026-02-27 10:06:50 +01:00
Stefan Bethke	df339cd290	Add a link to Authentik's integration guide	2026-02-27 09:56:18 +01:00
Florian Preinstorfer	faf55f5e8f	Document how to use the provider identifier in the policy	2026-02-18 10:24:05 +01:00
Florian Preinstorfer	e3323b65e5	Describe how to set username instead of SPN for Kanidm	2026-02-18 10:24:05 +01:00
Florian Preinstorfer	890a044ef6	Add more UIs	2026-02-16 15:22:46 +01:00
Florian Preinstorfer	8028fa5483	No longer consider autogroup:self experimental	2026-02-16 15:22:46 +01:00
Florian Preinstorfer	5d300273dc	Add a tags page and describe a few common operations	2026-01-28 15:52:57 +01:00
Florian Preinstorfer	7f003ecaff	Add a page to describe supported registration methods	2026-01-28 15:52:57 +01:00