From f7d8bb8b3f37813f2a616e313a171721ccc31bf3 Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@dalby.cc>
Date: Thu, 9 Apr 2026 17:48:41 +0000
Subject: [PATCH] app: remove gRPC reflection from remote server

Reflection is a streaming RPC and bypasses the unary auth
interceptor on the remote (TCP) gRPC server. Remove it there;
the unix-socket server retains it for local debugging.
---
 hscontrol/app.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hscontrol/app.go b/hscontrol/app.go
index b2152914..c86277c5 100644
--- a/hscontrol/app.go
+++ b/hscontrol/app.go
@@ -727,7 +727,6 @@ func (h *Headscale) Serve() error {
 		grpcServer = grpc.NewServer(grpcOptions...)
 
 		v1.RegisterHeadscaleServiceServer(grpcServer, newHeadscaleV1APIServer(h))
-		reflection.Register(grpcServer)
 
 		grpcListener, err = new(net.ListenConfig).Listen(context.Background(), "tcp", h.cfg.GRPCAddr)
 		if err != nil {