d955cd6262
docs: replace gRPC remote-control with HTTP API
...
The remote CLI speaks HTTP to the API URL now; drop the gRPC port,
grpc_listen_addr, and #grpc anchors.
2026-06-19 05:58:10 +00:00
33774888c2
all: remove dead gRPC config, tests, and helpers
...
Drop grpc_listen_addr/grpc_allow_insecure config, the gRPC auth integration
tests, GrpcSocketDialer, and stale gRPC comments now that the API is HTTP-only.
2026-06-19 05:58:10 +00:00
8e194721b7
ci, flake: drop proto/buf lint and tooling
...
The proto/gRPC stack is gone; remove the buf lint job and the protobuf/grpc/buf
nix dev-shell inputs.
2026-06-19 05:58:10 +00:00
08885c33da
docs: mark v1-ogen conversion complete
2026-06-19 05:57:04 +00:00
b988027bb8
proto: remove the Protobuf/gRPC service and generated code
...
Delete proto/, gen/go/, gen/openapiv2/, and the buf config now that the v1 API
is served entirely by the ogen OpenAPI stack. Drop the proto lint/format targets
and refresh the vendor hash.
2026-06-19 05:57:04 +00:00
112c42af0a
integration: port tests to the ogen API types
...
Decode CLI/HTTP output into apiv1 (ogen) types instead of the proto types,
matching the new wire format. No proto package is imported outside gen/go now.
2026-06-19 05:57:04 +00:00
db6b99d414
types: drop the proto builders
...
Remove the Proto() methods and RegisterMethodToV1Enum; the v1 API builds
responses from the state views directly now.
2026-06-19 05:57:04 +00:00
8f5e2e7291
hscontrol: remove the gRPC service and server
...
Delete grpcv1.go, the TCP gRPC listener, the gRPC auth interceptor, and the
now-unused HTTP bearer middleware. The v1 API is served only over HTTP (TCP +
unix socket) by the ogen stack.
2026-06-19 05:57:04 +00:00
b5e3b4ee27
hscontrol/api/v1: build responses from state views, not proto
...
Convert directly from NodeView/UserView/PreAuthKeyView (no AsStruct copies, no
proto bridge), preserving the view types on the read path. Add UserView.Username
and drop the two state.go uses of PreAuthKey.Proto().
2026-06-19 05:57:04 +00:00
bbb171d02f
docs: reconcile v1-ogen plan with delivered state
2026-06-19 05:57:04 +00:00
e1325fbacd
serve the OpenAPI 3.0 spec at /swagger
...
Embed openapi/v1/headscale.yaml and point the Swagger UI at it, replacing the
generated Swagger 2.0 document.
2026-06-19 05:57:04 +00:00
29fc14dd73
cmd/headscale: run the CLI on the generated v1 HTTP client
...
Serve the API over the unix socket (auth bypassed; socket permissions are the
trust boundary) and convert every CLI command from the gRPC client to the
generated ogen client. Remote CLI now uses the HTTP API URL.
2026-06-19 05:57:04 +00:00
de85965bd8
hscontrol/api/v1: implement auth and policy endpoints
...
AuthRegister/Approve/Reject and GetPolicy/SetPolicy/CheckPolicy over the state
layer, completing all v1 operations. HTTP-parity tests included.
2026-06-19 05:57:04 +00:00
83fb0a4548
hscontrol/api/v1: implement node endpoints
...
Register, Get, List, Delete, Rename, Expire, SetTags, SetApprovedRoutes (with
exit-route expansion), BackfillNodeIPs, DebugCreateNode over the state layer.
Tagged nodes present as TaggedDevices; client errors map to 4xx.
2026-06-19 05:57:04 +00:00
fc26c447ec
hscontrol/api/v1: implement pre-auth key endpoints
...
CreatePreAuthKey (with ACL tag validation), ListPreAuthKeys, ExpirePreAuthKey,
DeletePreAuthKey over the state layer, with HTTP-parity tests.
2026-06-19 05:57:04 +00:00
df6876a570
hscontrol/api/v1: implement API key endpoints
...
CreateApiKey, ListApiKeys, ExpireApiKey, DeleteApiKey (by id or prefix) over
the state layer, with HTTP-parity tests.
2026-06-19 05:57:04 +00:00
fe76fe0f57
hscontrol/api/v1: implement user endpoints
...
CreateUser, ListUsers (with filters), RenameUser, DeleteUser over the state
layer; unknown users now 404. HTTP-parity tests via the generated client.
2026-06-19 05:57:04 +00:00
1eabd70567
docs: add v1-ogen migration plan and changelog
2026-06-19 05:57:04 +00:00
562fcc1401
hscontrol: serve v1 API via ogen, replace grpc-gateway facade
...
Mount the ogen-generated server at /api/v1 with bearer-auth and RFC 7807
errors backed by the state layer; gRPC servers stay for the CLI. Add a
servertest API client harness and Health parity tests.
2026-06-19 05:57:03 +00:00
01dcd4011e
gen: generate v1 API server and client with ogen
...
go generate (gen/api/v1) runs ogen against openapi/v1/headscale.yaml; ogen
added as a tool dependency. CI freshness check covers openapi/.
2026-06-19 05:57:03 +00:00
38dad226c8
openapi: add v1 API OpenAPI 3.0 specification
...
Single source of truth for the v1 HTTP API: 27 operations, native int64
ids, RFC 7807 problem responses, bearer auth.
2026-06-19 05:57:03 +00:00
a00de89c85
ci: run nix jobs with --fallback
...
cache.nixos.org intermittently serves corrupt NARs; build from source on
substitute failure instead of failing the job.
2026-06-18 21:11:14 +02:00
f5198841bd
ci: drop Docker v28 pin from release workflow
...
Engine 29 build compat is fixed in the client; the downgrade is no longer
needed.
2026-06-18 21:11:14 +02:00
dfc25f06e1
integration: pin docker client to daemon API version
...
dockertest's bundled client builds against API v1.25; Docker Engine 29
rejects it (min 1.40), surfacing as a "broken pipe" that fails every local
image build. Pin to the daemon's reported version so builds use a live path.
Closes #2937
2026-06-18 21:11:14 +02:00
74928c0241
integration: regenerate test matrix for new CLI tests
2026-06-18 15:21:11 +02:00
9aba06ec7d
integration: backfill CLI command coverage
...
Regroup the CLI tests into per-command files and cover every command
except debug/config with CRUD, flag and error permutations, asserted as
JSON.
2026-06-18 15:21:11 +02:00
00afce77b1
ci: run nixos module check with --fallback
...
cache.nixos.org intermittently serves corrupt NARs; build from source
on substitute failure instead of failing the job.
2026-06-18 14:54:44 +02:00
9f1886f587
db: preserve user_id on untagged nodes with tags='null'
...
A nil tags slice marshals to JSON `null`; the clear-tagged migration
read that as tagged and cleared user_id. Exclude it, and recover
already-detached nodes from their pre-auth key.
Fixes #3323
2026-06-18 14:54:44 +02:00
ea5165e325
util, db: generate key material as hex via tailscale rands
2026-06-17 16:12:19 +02:00
368b9e7edd
state: add regression test for NodeKey-rotation binding
2026-06-17 16:12:19 +02:00
abfd5c9236
types: reject port-bearing server_url under base_domain
2026-06-17 16:12:19 +02:00
e4cd846075
handlers: set verify Content-Type before writing the body
2026-06-17 16:12:19 +02:00
4b693a1320
oidc, types: validate pkce.method when OIDC is active
2026-06-17 16:12:19 +02:00
4f4e95fc80
all: adopt strings, errors, and os helpers
2026-06-17 16:12:19 +02:00
27468f944b
all: adopt maps and cmp helpers
2026-06-17 16:12:19 +02:00
ac725f27e4
all: adopt slices helpers
2026-06-17 16:12:19 +02:00
60f0544b78
dns, change, noise, auth, capver: misc consolidation
2026-06-17 16:12:19 +02:00
ea5e52f662
hi: consolidate doctor and stats helpers
2026-06-17 16:12:19 +02:00
722a2f1e18
integration, hsic, tsic, dockertestutil: consolidate container helpers
2026-06-17 16:12:19 +02:00
75b09cb991
servertest: consolidate harness helpers
2026-06-17 16:12:19 +02:00
0320b56911
oidc: consolidate cookie helpers and logging
2026-06-17 16:12:19 +02:00
62869f01d2
app: simplify TLS and auth setup
2026-06-17 16:12:19 +02:00
19d5d9deeb
derp: simplify DERP map handling
2026-06-17 16:12:19 +02:00
c3cfbf1cc0
grpcv1: share list-RPC response helpers
2026-06-17 16:12:19 +02:00
fdc7e26c8a
util: consolidate parsing and encoding helpers
2026-06-17 16:12:19 +02:00
45e6e90d11
types: consolidate DNS, identifier, and proto helpers
2026-06-17 16:12:19 +02:00
468f70a9e5
templates: consolidate shared page and component helpers
2026-06-17 16:12:19 +02:00
8c10a96921
hscontrol: consolidate debug-endpoint and template helpers
2026-06-17 16:12:19 +02:00
3979887d8d
mapper: consolidate builder and connection helpers
2026-06-17 16:12:19 +02:00
03e2d24c79
policy/v2, policy/matcher: consolidate alias and IP-set helpers
2026-06-17 16:12:19 +02:00
Kristoffer Dalby