Juan Font Alonso
323a7d9c2e
Do not expose the general API router over the Noise connection
...
And do not expose the Noise API over the regular connection. Plus,
there are (more) changes coming to the API... so let's have different
API codebases.
2022-03-27 21:33:31 +02:00
Juan Font Alonso
55ba3021f1
TS2021: Add Noise upgrade handler
...
We have more code that we should, as Tailscale has a nice AcceptHTTP()
method that should be able to use. However Gin is doing something different.
We should have a look later on.
2022-03-27 11:52:53 +02:00
Juan Font Alonso
be59e8cc3c
Generate and read the Noise private key
...
For TS2021 we need a new private key. It must be different from
the one used in the original protocol, as told by Tailscale's Dave Anderson
https://github.com/juanfont/headscale/issues/526#issuecomment-1079795935 .
2022-03-27 11:32:33 +02:00
Juan Font Alonso
db9ba17920
Added missing file
2022-03-18 13:10:35 +01:00
Juan Font Alonso
8f5875efe4
Reorg errors
2022-03-16 19:46:59 +01:00
Juan Font
98ac88d5ef
Changed comment position
...
Co-authored-by: Kristoffer Dalby <kradalby@kradalby.no>
2022-03-16 18:45:34 +01:00
Kristoffer Dalby
d13338a9fb
Merge branch 'main' into mandatory-stun
2022-03-16 07:18:18 +00:00
bravechamp
0bfa5302a7
Fix API access
...
By allowing API keys to be validated
2022-03-15 16:05:56 +03:00
Juan Font Alonso
b8aad5451d
Make STUN run by default when embedded DERP is enabled
...
This commit also allows to set an external STUN server, while running the embedded DERP server (without embedded STUN)
2022-03-15 13:22:25 +01:00
Juan Font Alonso
eb06054a7b
Make DERP Region configurable
2022-03-06 17:25:21 +01:00
Juan Font Alonso
eb500155e8
Make STUN server configurable
2022-03-06 17:00:56 +01:00
Juan Font Alonso
54c3e00a1f
Merge local DERP server region with other configured DERP sources
2022-03-05 20:04:31 +01:00
Juan Font Alonso
237f7f1027
Merge branch 'main' into embedded-derp
2022-03-05 19:42:29 +01:00
Juan Font Alonso
df37d1a639
Do not offer the option to be DERP insecure
...
Websockets, in which DERP is based, requires a TLS certificate. At the same time,
if we use a certificate it must be valid... otherwise Tailscale wont connect (does not
have an Insecure option). So there is no option to expose insecure here
2022-03-05 19:19:21 +01:00
Juan Font Alonso
758b1ba1cb
Renamed configuration items of the DERP server
2022-03-05 16:22:02 +01:00
Juan Font Alonso
607c1eb316
Be consistent with uppercase DERP
2022-03-04 11:31:41 +01:00
e-zk
12a50ac8ac
feat(windows): add /windows endpoint for Windows configuration
...
- registry file /windows/tailscale.reg is generated, filling in the
associated control server URL
- also includes CLI instructions
- fix /apple incorrect template: 'Url' is supposed to be '.URL'
2022-03-04 19:53:44 +10:00
e-zk
b342cf0240
feat(windows): cleanup /apple endpoint
...
- rename the gin function to AppleConfigMessage
- use <pre> + <code> for code blocks
- add headscale heading
- reword some sections
2022-03-04 19:53:29 +10:00
Juan Font Alonso
23cde8445f
Merge branch 'main' into embedded-derp
2022-03-04 00:04:59 +01:00
Juan Font Alonso
897d480f4d
Add an embedded DERP server to Headscale
...
This series of commit will be adding an embedded DERP server (and STUN) to Headscale,
thus making it completely self-contained and not dependant in other infrastructure.
2022-03-04 00:01:31 +01:00
Kristoffer Dalby
b61500670c
Merge branch 'main' into metrics-listen
2022-03-02 11:35:33 +00:00
Kristoffer Dalby
7c63412df5
Remove todo
2022-02-28 23:02:41 +00:00
Kristoffer Dalby
5e92ddad43
Remove redundant caches
...
This commit removes the two extra caches (oidc, requested time) and uses
the new central registration cache instead. The requested time is
unified into the main machine object and the oidc key is just added to
the same cache, as a string with the state as a key instead of machine
key.
2022-02-28 22:42:30 +00:00
Nico Rey
9a61725e9f
Metrics: Disable toggle. Set default port to 9090
2022-02-28 10:40:02 -03:00
Kristoffer Dalby
6126d6d9b5
Merge branch 'main' into metrics-listen
2022-02-28 14:24:25 +01:00
Kristoffer Dalby
469551bc5d
Register new machines needing callback in memory
...
This commit stores temporary registration data in cache, instead of
memory allowing us to only have actually registered machines in the
database.
2022-02-28 08:06:39 +00:00
Nico Rey
06e6c29a5b
metrics: make metrics endpoint toggleable
2022-02-25 18:36:03 -03:00
Adrien Raffin-Caboisse
b39faa124a
Merge remote-tracking branch 'origin/main' into feat-oidc-login-as-namespace
2022-02-25 11:28:17 +01:00
Nico
d55c79e75b
Merge branch 'main' into metrics-listen
2022-02-24 10:41:07 -03:00
Kristoffer Dalby
eda0a9f88a
Lock allocation of IP address
...
current logic is not safe as it will allow an IP that isnt persisted to
the DB to be given out multiple times if machines joins in quick
succession.
This adds a lock around the "get ip" and machine registration and save
to DB so we ensure thiis isnt happning.
Currently this had to be done three places, which is silly, and outlined
in #294 .
2022-02-24 13:18:18 +00:00
Kristoffer Dalby
aa506503e2
Merge branch 'main' into feat-oidc-login-as-namespace
2022-02-24 11:40:34 +00:00
Adrien Raffin-Caboisse
4f1f235a2e
feat: add strip_email_domain to normalization of namespace
2022-02-23 14:03:07 +01:00
Adrien Raffin-Caboisse
717250adb3
feat: removing matchmap from headscale
2022-02-22 20:58:08 +01:00
Nico Rey
e3bcc88880
Linter: make linter happy
2022-02-21 15:22:36 -03:00
Nico Rey
d5fd7a5c00
metrics: add a new router and listener for Prometheus' metrics endpoint
2022-02-21 12:50:15 -03:00
Justin Angel
daa75da277
Linting and updating tests
2022-02-21 10:09:23 -05:00
Kristoffer Dalby
7bf2a91dd0
Merge branch 'main' into configurable-mtls
2022-02-20 14:33:23 +00:00
Justin Angel
385dd9cc34
refactoring
2022-02-20 09:06:14 -05:00
Kristoffer Dalby
b2b2954545
Merge branch 'main' into apiwork
2022-02-14 22:29:20 +00:00
Kristoffer Dalby
4e54796384
Allow gRPC server to run insecure
2022-02-13 09:08:46 +00:00
Kristoffer Dalby
0018a78d5a
Add insecure option
...
Add option to not _validate_ if the certificate served from headscale is
trusted.
2022-02-13 08:41:49 +00:00
Kristoffer Dalby
2bc8051ae5
Remove kv-namespace-worker
...
This commit removes the namespace kv worker and related code, now that
we talk over gRPC to the server, and not directly to the DB, we should
not need this anymore.
2022-02-12 20:46:05 +00:00
Kristoffer Dalby
d79ccfc05a
Add comment on why grpc is on its own port, replace deprecated
2022-02-12 19:50:12 +00:00
Kristoffer Dalby
315ff9daf0
Remove insecure, only allow valid certs
2022-02-12 19:35:55 +00:00
Kristoffer Dalby
4078e75b50
Correct log message
2022-02-12 19:30:25 +00:00
Kristoffer Dalby
531298fa59
Fix import
2022-02-12 17:13:51 +00:00
Kristoffer Dalby
30a2ccd975
Add tls certs as creds for grpc
2022-02-12 17:05:30 +00:00
Kristoffer Dalby
59e48993f2
Change the http listener
2022-02-12 16:33:18 +00:00
Kristoffer Dalby
bfc6f6e0eb
Split grpc and http
2022-02-12 16:15:26 +00:00
Kristoffer Dalby
2aba37d2ef
Try to support plaintext http2 after termination
2022-02-12 14:42:23 +00:00
