public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-10-24 15:26:49 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,711 Commits 84 Branches 175 Tags
a928125afab800b6c6d03609236fcf9078ed5b10
Commit Graph
4711 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby a928125afa state: lowercase renames and refresh self DNS config on rename 
"Foo" and "foo" could share one DNS name; collisions now ignore case.
A rename never resent the node its own DNS config, so CertDomains lagged.

Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 0efe4b7798 types: add dns.challenge and dns.certificates config 
dns.challenge.provider builds a libdns provider at load, so configtest
catches typos. dns.certificates gates node certs; zone defaults to base_domain.

Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 6cb950cd9e dns: add ACME challenge tracker and propagation check 
Exact appends and deletes; values go 10m after last use or on Close.
Limits per node, one lock for provider writes. Waits for every
authoritative NS and holds a new value until the CA cache has expired.

Updates #2137
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 24cf63294c dns: add libdns provider registry 
Curated cloudflare, gigahost, hetzner, powerdns and rfc2136.
Settings decode via json tags; env per field, <field>_path for secrets.

Updates #2137
 2026-10-18 20:53:18 +02:00
Serhii Matsyshyn a777969027 CHANGELOG: one peer map build per policy write 2026-10-18 13:18:48 +02:00
Serhii Matsyshyn 8f3ba2d8cd state: rebuild peer maps in ReloadPolicy only when the policy changed 
The SetPolicy API handler calls State.SetPolicy, which already rebuilds the peer map when the policy changed, and then ReloadPolicy, which rebuilt it again even when nothing changed. So every policy write built the peer map twice.

ReloadPolicy now rebuilds only when the policy really changed. A test checks one build per changed write and none for an unchanged reload.

Part of #3549
 2026-10-18 13:18:48 +02:00
github-actions[bot] 362cdaeef8 Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3562#issuecomment-6249089869
 2026-10-18 13:10:17 +02:00
github-actions[bot] 9314f4e778 Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3559#issuecomment-6249075866
 2026-10-18 13:09:02 +02:00
github-actions[bot] fc97593bce Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3549#issuecomment-6193920631
 2026-10-15 16:04:19 +02:00
Kristoffer Dalby 9f074ac15b policy/v2: keep comments in a policy set through the v2 API 
hujson.Parse aliases its input, so Standardize blanked the comments in
the caller's buffer, which api/v2 then stored.
 2026-10-15 13:28:12 +02:00
Kristoffer Dalby 380d1b0d0a tools/bump: carry hand-pushed commits instead of pausing 
Open PR with commits by others: rebase onto base, build on top, push
with lease. Rebase conflict pauses and comments once.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 920b6fb8cd CHANGELOG: raise minimum Tailscale client to v1.84.0 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 1077a9ff6a capver: regenerate for Tailscale v1.104 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 3e5c07c95c go.mod: update dependencies dropped by the bump bot 
tailscale.com (gvisor), sqlite (libc), x/net, x/tools and friends.
tailscale.com now requires go 1.27.2.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 89be098f76 integration/tsic: drop unused watchIPN 
ipn.Notify.NetMap is gone upstream; nothing called it.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby 627145644e noise: serve ts2021 via net/http unencrypted HTTP/2 
x/net/http2.Server is deprecated and now wraps net/http anyway.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby fd09dd86f2 tools/bump: upgrade modules behind tool directives 
x/tools is indirect, so never moved; v0.49.0 cannot read Go 1.27.2
export data and viewer emits invalid types, failing go generate.
 2026-10-15 10:50:32 +02:00
Kristoffer Dalby bf63feb320 tools/bump: stop commenting when applied areas change 
Description already carries the outcome; the comment was noise.
 2026-10-15 10:50:32 +02:00
github-actions[bot] a2e4451fcf Dockerfile: bump golang builders to 1.27.2 / 1.27.2 2026-10-15 10:50:32 +02:00
github-actions[bot] b867810279 go.mod: update dependencies 2026-10-15 10:50:32 +02:00
github-actions[bot] d2dd5ed77f flake.lock: update flake-utils_2, nixpkgs 2026-10-15 10:50:32 +02:00
Kristoffer Dalby efe18a89cd mkdocs: bump version 2026-10-13 14:38:29 +02:00
Kristoffer Dalby b6ac75a343 CHANGELOG: move 0.29.5 backports out of 0.30.0 
Align the 0.29.5 section with the release branch.
 2026-10-13 14:38:29 +02:00
github-actions[bot] cee9066e91 .github: bump 3 action pins 2026-10-13 12:02:59 +02:00
github-actions[bot] 586a78357a Dockerfile: bump rust 1.98-trixie to 1.99-trixie 2026-10-13 12:02:59 +02:00
github-actions[bot] cdb0a5e58e Dockerfile: bump golang builders to 1.27.2 / 1.27.1 2026-10-13 12:02:59 +02:00
github-actions[bot] c3f83b6c05 go.mod: update dependencies 2026-10-13 12:02:59 +02:00
github-actions[bot] a1dd3172f9 flake.lock: update nixpkgs 2026-10-13 12:02:59 +02:00
Martin -nexus- Mlynář a8d6f5be81 state: send a relogin as a whole node unless only its keys changed 
A PeerChange patch cannot clear a peer's Expired flag or carry the
Hostinfo the relogin stored.

Fixes #3531
 2026-10-09 11:44:37 +02:00
Kristoffer Dalby 49b848a83d state: compare peer-visible Hostinfo through views 
Field by field: no allocation, no reflection.

Updates #3531
 2026-10-09 11:44:37 +02:00
Kristoffer Dalby 9c764e5a99 state: return the replaced node from NodeStore updates 
UpdateNodeDiff hands back the pre-update clone the writer already makes.

Updates #3531
 2026-10-09 11:44:37 +02:00
LuoChen aaf4ccd8c9 util, types: parse unix_socket_permission strictly 
Default "0o770" failed the base-8 parse and silently became 0700.
Invalid, unquoted or above-0777 values now fail config load.

Fixes #3529
 2026-10-09 11:42:53 +02:00
Kristoffer Dalby c9852c43da ci: distribute the compiled integration test binary 2026-10-09 11:41:09 +02:00
Kristoffer Dalby bcc71f9b57 integration: reuse images and remove redundant scenario setup 2026-10-09 11:41:09 +02:00
Kristoffer Dalby 47653f06fb integration: avoid toolchain work and login waits in CI 2026-10-09 11:41:09 +02:00
Jonas Schwartz 519b4621f3 policy/v2: add Grant.HasVia and tighten the changelog entry 2026-10-08 12:43:45 +02:00
Jonas Schwartz 9d5ce0752f policy/v2: resolve via-route grants lazily 
With a via grant in the policy, ViaRoutesForPeer still resolved every
grant's sources and destinations up front. Non-via grants are only read
once a via grant has matched the peer, which is rare (the peer must
advertise a covered route), and destinations only for grants whose
sources match the viewer. Resolve each grant on first use instead.

BenchmarkViaRoutesForPeer, mean per peer (Apple M3 Pro):

	policy     nodes  before    after
	via-mixed  100    9.5us     2.1us
	via-mixed  1000   69.0us    11.6us
	via        1000   8.1us     8.6us
 2026-10-08 12:43:45 +02:00
Jonas Schwartz f8018f177a policy/v2: skip via resolution when the policy has no via grants 
ViaRoutesForPeer runs for every peer of every map response. Before it
looks at Via, it converts every ACL to grants and resolves each grant's
sources and destinations against the whole node set. Only via grants
can add to the result and ACLs never carry via, so without a via grant
all of that work was discarded. On large tailnets it dominated map
generation. Return early instead.

BenchmarkViaRoutesForPeer, mean per peer (Apple M3 Pro):

	policy     nodes  before    after
	global     1000   21.8us    9ns, 0 allocs
	self       1000   45.0us    9ns, 0 allocs
	via        1000   8.1us     unchanged
	via-mixed  1000   69.0us    unchanged

Fixes #3512
 2026-10-08 12:43:45 +02:00
Dan Cunningham 8798c9af83 hscontrol: never garbage collect an ephemeral node with a live session 
A session arming the GC after a reconnect cancelled it left a stale timer.

Fixes #3535
Signed-off-by: Dan Cunningham <dan@digitaldan.com>
 2026-10-08 12:14:58 +02:00
Kristoffer Dalby 4fd4da75f2 hscontrol: fix formatting after combining SSH policy changes 
Updates #3517
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 8c66b76353 integration: block reused HA ping callback connections 
Updates #3517
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby b8146aa7cd tests: preserve SSH regressions after combining policy fixes 
Updates #3517
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby b7aa328e0c CHANGELOG: note SSH rule removal fix 
Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 785ba22c65 mapper: send SSHPolicy only when it changes for the connection 
Any non-nil SSHPolicy forces a full client netmap rebuild; the empty
policy now sent to every node made each policy change one.

Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 41c137bb3b noise: drop unused ErrNoAuthSession 
Kept separate so the check-rule fix cherry-picks to 0.29.

Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 9de8e9103f ci: regenerate integration test list 
Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 16c0e6b75a integration: test SSH is denied once its rules are removed 
Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 957a332d5d policy/v2: match the login user in SSHCheckParams 
The client picks the check rule by login user; the server took the
first rule for the node pair, so a root login could get a 12h
localpart period instead of "always", or be approved after its rule
was removed while another user's rule remained. Hold URLs now carry
the concrete user: tailssh never expanded the encoded $LOCAL_USER.

Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby dceb584c89 noise: reject SSH checks the policy no longer requires 
A stale check rule still held and accepted after login. Deny with a 200
Reject (tailssh retries errors); re-check after the verdict.

Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 03e723c611 policy/v2: find SSH check params for localpart self-access 
compileSSHPolicy sends these check rules; SSHCheckParams missed them,
so they never auto-approved within checkPeriod.

Updates #3508
 2026-10-08 10:29:23 +02:00