3341 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Florian Preinstorfer	8c09afe20c	Headscale implements a single tailnet ... Separate the term "tailnet" from user and be more explicit about providing a single tailnet. Also be more explicit about users. Refer to "headscale users" when mentioning commandline invocations and use the term "local users" when discussing unix accounts. Fixes: #2335	2025-02-05 11:05:03 +01:00
Kristoffer Dalby	8b92c017ec	add 1.80 to capver and update deps (#2394)	2025-02-05 07:17:51 +01:00
github-actions[bot]	9a7890d56b	flake.lock: Update (#2402)	2025-02-02 07:58:12 +00:00
Kristoffer Dalby	45752db0f6	Return better web errors to the user (#2398) ... * add dedicated http error to propagate to user Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * classify user errors in http handlers Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * move validation of pre auth key out of db This move separates the logic a bit and allow us to write specific errors for the caller, in this case the web layer so we can present the user with the correct error codes without bleeding web stuff into a generic validate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-01 15:25:18 +01:00
Kristoffer Dalby	1c7f3bc440	no edit of oidc users, minimum hostname length (#2393) ... * return an error when renaming users from OIDC * set minimum hostname length of 2	2025-02-01 09:40:37 +00:00
Kristoffer Dalby	9bd143852f	do not allow preauth keys to be deleted if assigned to node (#2396) ... * do not allow preauth keys to be deleted if assigned to node Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-01 10:31:13 +01:00
Kristoffer Dalby	d57a55c024	Rewrite authentication flow (#2374)	2025-02-01 09:16:51 +00:00
Kristoffer Dalby	e172c29360	initial capver packet tracking version (#2391) ... * initial capver packet tracking version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * Log the minimum version as client version, not only capver Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove old versions Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use capver for integration tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * patch through m and n key Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-30 21:49:09 +00:00
Kristoffer Dalby	cd3b8e68ff	clean up handler methods, common logging (#2384) ... * clean up handler methods, common logging Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * streamline http.Error calls Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-30 22:40:29 +01:00
nblock	f44b1d37c4	Remove routes without a node_id (#2386) ... The routes table has a NOT NULL constraint on node_id. Fixes: #2376	2025-01-30 14:57:06 +01:00
Kristoffer Dalby	7ba6ad3489	simplify findUserByToken in ACL, add missing testcases (#2388) ... * update users doc on unique constraints Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * simplify finduser func Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add initial tests for findUserFromToken Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-30 11:35:49 +01:00
Kristoffer Dalby	2c279e0a7b	create and rename usernames validated by new func (#2381) ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-27 22:58:10 +01:00
Kristoffer Dalby	4c8e847f47	use dedicated registration ID for auth flow (#2337)	2025-01-26 22:20:11 +01:00
github-actions[bot]	97e5d95399	flake.lock: Update (#2378)	2025-01-26 15:33:51 +00:00
Kristoffer Dalby	d1dbe4ece9	fix panic if derp update is 0 (#2368) ... * fix panic if derp update is 0 Fixes #2362 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-23 16:16:12 +01:00
Kristoffer Dalby	9e3f945eda	fix postgres migration issue with 0.24 (#2367) ... * fix postgres migration issue with 0.24 Fixes #2351 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add postgres migration test for 2351 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-23 14:58:42 +01:00
Kristoffer Dalby	615ee5df75	make it harder to insert invalid routes (#2371) ... * make it harder to insert invalid routes Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * dont panic if node is not available for route Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-23 13:40:23 +01:00
Kristoffer Dalby	c1f42cdf4b	relax user validation to allow emails, add tests from various oidc providers (#2364) ... * relax user validation to allow emails, add tests from various oidc providers Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-22 18:10:15 +01:00
github-actions[bot]	aa76980b43	flake.lock: Update (#2353)	2025-01-19 09:59:29 +00:00
Kristoffer Dalby	5b986ed0a7	set oidc.map_legacy_users false (#2350)	2025-01-17 14:44:04 +00:00
Kristoffer Dalby	8076c94444	Release docs 0.24 (#2349) ... * correct changelog date Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update docs version and copyright Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix deprecated goreleaser key and DRY Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-17 12:57:13 +00:00
Kristoffer Dalby	e88406e837	set changelog date (#2347)	2025-01-17 12:01:06 +01:00
Kristoffer Dalby	e4a3dcc3b8	use headscale server url as domain instead of base_domain (#2338)	2025-01-16 18:05:20 +01:00
Kristoffer Dalby	caad5c613d	fix nil pointer deref (#2339)	2025-01-16 18:05:05 +01:00
Kristoffer Dalby	38aef77e54	allow @ and Log if OIDC username is not consider valid (#2340)	2025-01-16 18:04:54 +01:00
Dmitry Gordin	1ab7b315a2	Update apple.md for latest version of iOS (#2321) ... The official iOS app now has a simpler login process for custom instances, directly within the app.	2025-01-13 12:09:53 +00:00
github-actions[bot]	610597bfb7	flake.lock: Update (#2342)	2025-01-12 18:54:59 +00:00
Stefan Majer	ede4f97a16	Fix typos	2025-01-09 10:38:25 +01:00
Kristoffer Dalby	fa641e38b8	Set CSRF cookies for OIDC (#2328) ... * set state and nounce in oidc to prevent csrf Fixes #2276 * try to fix new postgres issue Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-08 16:29:37 +01:00
github-actions[bot]	41bad2b9fd	flake.lock: Update (#2324)	2025-01-05 07:35:18 +00:00
github-actions[bot]	f9bbfa5eab	flake.lock: Update (#2320)	2024-12-29 11:41:52 +00:00
Rorical	b81420bef1	feat: Add PKCE Verifier for OIDC (#2314) ... * feat: add PKCE verifier for OIDC * Update CHANGELOG.md	2024-12-22 16:46:36 +00:00
github-actions[bot]	9313e5b058	flake.lock: Update (#2313)	2024-12-22 07:07:26 +00:00
Kristoffer Dalby	770f3dcb93	fix tags not resolving to username if email is present (#2309) ... * ensure valid tags is populated on user gets too Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * ensure forced tags are added Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove unused envvar in test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * debug log auth/unauth tags in policy man Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * defer shutdown in tags test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add tag test with groups Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add email, display name, picture to create user Updates #2166 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add ability to set display and email to cli Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add email to test users in integration Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix issue where tags were only assigned to email, not username Fixes #2300 Fixes #2307 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * expand principles to correct login name and if fix an issue where nodeip principles might not expand to all relevant IPs instead of taking the first in a prefix. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix ssh unit test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update cli and oauth tests for users with email Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * index by test email Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix last test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-19 13:10:10 +01:00
Kristoffer Dalby	af4508b9dc	bump deps (#2308) ... * Bump go crypto Closes #2281 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * upgrade tailscale Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * upgrade rest Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * nix: flake update --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-17 15:35:42 +01:00
Florian Preinstorfer	bbc93a90a2	Set title for code listings	2024-12-17 14:08:34 +01:00
Florian Preinstorfer	0acb2b5647	Misc doc updates	2024-12-17 14:08:34 +01:00
Florian Preinstorfer	3269cfdca0	Mention reload and SIGHUP when editing the ACL policy file ... Fixes: #2284	2024-12-17 14:08:34 +01:00
Florian Preinstorfer	319ce67c87	Update DNS documentation for dns.extra_records_path ... * Describe both ways to add extra DNS records * Use "extra" instead of "custom" to align with the configuration file * Include dns.extra_records_path in the configuration file	2024-12-17 14:08:34 +01:00
Florian Preinstorfer	47b405d6c6	Changelog: support client verify for DERP ... and fix some links Ref: #2304	2024-12-17 14:08:34 +01:00
Florian Preinstorfer	65304a0ce7	Remove sealos documentation ... The referenced version is outdated (0.23.0-beta1) and seems unmaintained.	2024-12-17 14:08:34 +01:00
Dongjun Na	e270169c13	Add -race Flag to GitHub Action and Fix Data Race in CreateTailscaleNodesInUser (#2038) ... * Add -race flag to Makefile and integration tests; fix data race in CreateTailscaleNodesInUser * Fix data race in ExecuteCommand by using local buffers and mutex Signed-off-by: Dongjun Na <kmu5544616@gmail.com> * lint Signed-off-by: Dongjun Na <kmu5544616@gmail.com> --------- Signed-off-by: Dongjun Na <kmu5544616@gmail.com>	2024-12-17 14:06:57 +01:00
Shaw Drastin	7d937c6bd0	Correct macOS GUI connect guide because there's no ALT key on a mac (#2306) ... * Correct macOS GUI connect guide because there's no ALT key on a mac * also correct macOS GUI connect in hscontrol text	2024-12-17 12:11:27 +00:00
Kristoffer Dalby	ccc895b4c6	fixes to extra-record file watcher (#2298) ... * Fix excess error message during writes Fixes #2290 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * retry filewatcher on removed files This should handled if files are deleted and added again, and for rename scenarios. Fixes #2289 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * test more write and remove in filewatcher Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-16 11:26:56 +01:00
Kristoffer Dalby	5345f19693	fix issue where some oidc claim bools are sent as string (#2297) ... Jumpcloud send invalid json, so we need to handle it. Fixes #2293 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-16 11:26:32 +01:00
Kristoffer Dalby	ec8729b772	fix sighup issue with empty acl (#2296) ... Fixes #2291 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-16 07:48:19 +01:00
github-actions[bot]	e00b9d9a91	flake.lock: Update (#2294)	2024-12-15 06:46:14 +00:00
Kristoffer Dalby	58d089ce0a	fix deletion of exit routes without nodes (#2286) ... Fixes #2259 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-13 20:15:24 +01:00
Kristoffer Dalby	76d26a7eec	update oidc part of changelog for 0.24.0 (#2285)	2024-12-13 12:35:24 +00:00
Kristoffer Dalby	380fcdba17	Add worker reading extra_records_path from file (#2271) ... * consolidate scheduled tasks into one goroutine Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename Tailcfg dns struct Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add dns.extra_records_path option Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * prettier lint Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * go-fmt Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-13 07:52:40 +00:00