public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 12:39:25 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,970 Commits 106 Branches 177 Tags
c6723fa103835de68886f8ac0e1c12a43e118e88
Commit Graph
414 Commits
Author SHA1 Message Date
Kristoffer Dalby 4e946edb08 api/v2: enforce and document OAuth tag permissions 
Retagging requires all current and requested tags; disallowed tags return
400. Token responses list tags only when the token may assign them.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 9979be140e db: keep at most 1000 access tokens per OAuth client 
Minting needs only the client secret, whatever its scopes, and
added one row per mint. Each mint now ends tokens past the newest 1000.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 75e2377f25 debug: refuse requests addressed to unknown host names 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 5dff6ca432 policy/v2: resolve user references consistently across updates 
Prefer email owners over usernames and validate grants and nodeAttrs on
write. Reject ambiguous writes; log and match nobody on reload. Bare @
matches nobody.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 14baf55421 state, oidc: persist user changes and refresh nodes and clients 
Write cleared user columns, discard OIDC email the provider no longer
vouches for, refresh NodeStore users, and notify clients from the callback.

Fixes #3471
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 4342883bd4 policy/v2, state: elect primaries by oldest control session 
A router that reconnects joins as a standby; one that kept its session
takes its routes back once available again, as on Tailscale. Both the
global and the via election use it, in place of anti-flap stickiness.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby c0925962c2 hscontrol: bound pending authentication without evicting sessions 2026-10-29 20:51:50 +01:00
Kristoffer Dalby 2e8611c159 docs: use tls block keys and describe CertMagic 
Updates #2527
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 694587bfa0 docs: mark Serve as supported 
HTTPS serve needs dns.certificates; Funnel and Services stay unsupported.

Updates #1921
 2026-10-18 20:53:18 +02:00
Kristoffer Dalby 29e18d80b4 docs: note the audit-log shutdown lasts until tailscale up 
Clients that opt out of logging themselves hit it whatever logtail.enabled says.
 2026-10-07 18:11:07 +02:00
Kristoffer Dalby 52a7f8c89c mapper: send the logtail instruction on every full map 
Full maps moved to buildFromChange and lost WithDebugConfig, so no
frame told clients to disable log upload. Enabled logtail sends nil.
 2026-10-07 18:11:07 +02:00
Sandro 5f03627408 Update link to node attributes 2026-10-06 05:30:26 +02:00
yuwk 3486ab2fc2 docs: fix "is may be" grammar in policy reference 
Signed-off-by: yuwk <1729065730@qq.com>
 2026-09-29 18:30:38 +02:00
yuwk 32939914d3 docs: fix "specfic" typo in policy reference 
Signed-off-by: yuwk <1729065730@qq.com>
 2026-09-29 18:30:38 +02:00
Kristoffer Dalby 62f89ca25d cli: accept a user name in preauthkeys create --user 
Resolved through lookupUser like the users commands, so scripts skip the
users list round trip. Digit-only values stay IDs.
 2026-09-28 21:42:19 +02:00
Kristoffer Dalby 906016beb4 dns: pick the extra_records_path format by file extension 
HuJSON and YAML records work too; an unknown extension fails instead of being
parsed as JSON.
 2026-09-28 21:42:19 +02:00
Kristoffer Dalby dd8ce695cf derp: pick the derp.paths format by file extension 
Adds JSON and HuJSON maps. JSON read as YAML decoded to an empty map; unknown
extensions and empty maps now fail at startup.
 2026-09-28 21:42:19 +02:00
github-actions[bot] 8548583f0e docs: raise 3 docs requirement floors 2026-09-28 07:28:19 +02:00
Kristoffer Dalby eebeab3c1e docs: document joining nodes with an OAuth client 
Prefix swap, baseURL, every attribute; examples for tailscale up,
container, tsnet, GitHub Action.
 2026-09-25 17:09:19 +02:00
Kristoffer Dalby 616c9b6495 docs: warn about listen_addr / ACME port collision 
Add a callout under the HTTP-01 docs so operators see the
constraint before they hit the validation error at startup.

Updates #3227
 2026-09-23 15:18:34 +02:00
Florian Preinstorfer 4087d1fee9 Use tmpfs for /tmp 
This is relevant when docker is used as container runtime as it does not
set /tmp as tmpfs. With podman /tmp is mounted as tmpfs due to
`--read-only-tmpfs` (enabled by default).

Fixes: #3463
 2026-09-10 14:12:53 +02:00
Florian Preinstorfer 38722e5eeb Document automatic exit node selection and related node attributes 
- Add "Automatic exit node selection" to route docs
- Add suggest-exit-node and suggest-exit-node-ui as supported nodeAttrs

Fixes: #3444
 2026-09-08 10:32:27 +02:00
Florian Preinstorfer febe3ee341 Document how to disable remote client logging on mobile 2026-09-08 10:32:27 +02:00
Lukas Wolfsteiner 89fa72e08f docs: add repository star count and activity badges to web UI list 2026-09-02 13:33:22 +02:00
Igor Bernstein cbe30304dc docs: reword the tvOS warning to match the new step order 
The steps now open the Tailscale app first to install the VPN
configuration, which contradicted the warning against opening the app
after installation. The actual constraint is not signing in before the
headscale URL is set.
 2026-08-29 18:18:35 +02:00
igorbernstein fad937c062 Update AppleTV configuration steps 
The instructions didn't work for tvOS 26.6 / Tailscale 1.102.2. When the `ALTERNATE COORDINATION SERVER URL` is set, the `Install VPN Configuration` breaks. 
Clicking does nothing and the tvOS app logs showed `addUser: backendManager does not exist`.

Instead I first started tailscale and installed the vpn profile and then add the headscale url and then signed. Which seemed to have worked
 2026-08-29 18:18:35 +02:00
Kristoffer Dalby f06ff1cf81 all: build with Go 1.27 
Bump every remaining toolchain reference: images, goreleaser, the hi
runner fallback and docs.
 2026-08-25 21:59:00 +02:00
Baptiste Fontaine ec0cb6f63a docs: fix typos 2026-06-24 11:23:20 +02:00
Florian Preinstorfer a066a06bef Fix invalid ip syntax 
The "ip" field needs to be a list.
 2026-06-24 08:27:33 +02:00
Florian Preinstorfer 3c504af2be Fix placeholder in curl example 2026-06-20 10:41:57 +02:00
Florian Preinstorfer 7af39a6798 Add headscale-panel to webui docs 2026-06-20 10:41:57 +02:00
Florian Preinstorfer d7150755d4 TLS is not strictly required 2026-06-19 18:52:30 +02:00
Florian Preinstorfer 88234d4046 Replace /swagger with /api/v1/docs 2026-06-19 18:52:30 +02:00
Kristoffer Dalby 72adc5ff2a docs: add changelog and refresh the API reference for the v1 API 2026-06-19 15:21:00 +02:00
Florian Preinstorfer 6777a82ee6 Rewrite reverse proxy documentation 
- Restructure and cleanup reverse proxy docs
- Update examples for Apache, Caddy, Nginx
- Provide some basic usage examples
 2026-06-04 09:59:19 +02:00
Florian Preinstorfer e285f3c932 The headscale service is enabled by default 2026-05-18 17:21:58 +02:00
Florian Preinstorfer f3f84a5a63 Add docs for policy-wide options and node attributes 2026-05-18 17:21:58 +02:00
Florian Preinstorfer 4eb5899154 Add taildrive, tests, sshTests as supported features 2026-05-18 17:21:58 +02:00
Kristoffer Dalby 963daf8908 docs: document trusted_proxies config option 
Cover the option in config-example.yaml, the reverse-proxy
integration guide, and the 0.29.0 CHANGELOG.
 2026-05-18 17:17:55 +02:00
Florian Preinstorfer c4ab267c36 Refresh features page 2026-05-12 14:12:29 +02:00
Florian Preinstorfer 109bfc404c Refresh docs for Grants 
- Mention policy as generic term that covers ACLs or Grants
- Refresh routes policy examples
- Remove Headscale specific exit node separation. Use via instead.

Fixes: #3087
 2026-05-12 14:12:29 +02:00
Florian Preinstorfer 1a64d950fd Document supported autogroups once 2026-05-12 14:12:29 +02:00
Florian Preinstorfer edb7ad0f81 Rewrite ACL docs as policy 
- Rename from acl.md to policy.md and setup redirect links
- Mention both ACLs and Grants
- Remove most old ACL docs and replace with links to Tailscale docs
- Add "Getting started" section
- Add section about notable differences
 2026-05-12 14:12:29 +02:00
Florian Preinstorfer e13f0458bb Remove redundant prefix 2026-05-12 14:12:29 +02:00
Florian Preinstorfer 68b0014871 Use distroless without quotes 2026-05-12 14:12:29 +02:00
Florian Preinstorfer 484462898b Remove link to sqlite 
Other mentions of SQLite don't link either.
 2026-05-12 14:12:29 +02:00
Florian Preinstorfer 45b698dbac Shorten container introduction 2026-05-12 14:12:29 +02:00
Florian Preinstorfer 14ce7e9106 Remove link to Arch AUR headscale-git 
Its outdated and unmaintained.
 2026-05-12 14:12:29 +02:00
Florian Preinstorfer 84c7f0d450 Link to development builds 2026-05-12 14:12:29 +02:00
Florian Preinstorfer c7f221dd0a Fix typo and wording 2026-05-12 14:12:29 +02:00