starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] load(migrate) policy v2 from file to database #1007

New Issue
Closed
opened 2025-12-29 02:27:23 +01:00 by adam · 6 comments
adam commented 2025-12-29 02:27:23 +01:00
Owner
Copy Link

Originally created by @IamTaoChen on GitHub (May 5, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

I configured policy.mode=database when I upgraded to version 0.26, but as you know, the service couldn’t start. So I had to switch back to file mode.
Now I have a problem: if I want to use the database mode, I need to manually modify the database to update the policy contents.
Maybe we could have a CLI command to load policy contents from a file into the database?

Expected Behavior

Maybe we could have a CLI command to load policy contents from a file into the database?

Steps To Reproduce

upgrade policy v1 to v2

Environment

- OS: docker
- Headscale version: 0.26 beta.1
- Tailscale version:

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

None

Originally created by @IamTaoChen on GitHub (May 5, 2025). ### Is this a support request? - [ ] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior I configured `policy.mode=database` when I upgraded to version 0.26, but as you know, the service couldn’t start. So I had to switch back to file mode. Now I have a problem: if I want to use the database mode, I need to manually modify the database to update the policy contents. Maybe we could have a CLI command to load policy contents from a file into the database? ### Expected Behavior Maybe we could have a CLI command to load policy contents from a file into the database? ### Steps To Reproduce upgrade policy v1 to v2 ### Environment ```markdown - OS: docker - Headscale version: 0.26 beta.1 - Tailscale version: ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [x] Headscale runs in a container ### Debug information None
adam added the bug label 2025-12-29 02:27:23 +01:00
adam closed this issue 2025-12-29 02:27:24 +01:00
adam commented 2025-12-29 02:27:24 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (May 9, 2025):

but as you know, the service couldn’t start.

Actually, I didnt know, I would expect it to start with an empty policy, and then you can load your file with headscale policy set --file

@kradalby commented on GitHub (May 9, 2025): > but as you know, the service couldn’t start. Actually, I didnt know, I would expect it to start with an empty policy, and then you can load your file with `headscale policy set --file`
adam commented 2025-12-29 02:27:24 +01:00
Author
Owner
Copy Link

@IamTaoChen commented on GitHub (May 9, 2025):

but as you know, the service couldn’t start.

Actually, I didnt know, I would expect it to start with an empty policy, and then you can load your file with headscale policy set --file

That means I need to delete the policy from the database first, am I right?

headscale  | 2025-05-09T10:03:47-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Username has to contain @, got: \"A\""
headscale exited with code 0
headscale  | 2025-05-09T10:03:48-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Username has to contain @, got: \"B\""
headscale exited with code 1
headscale  | 2025-05-09T10:03:49-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Username has to contain @, got: \"C\""

I'm using docker, so I try to run

docker compose run --rm headscale policy set --file /etc/headscale/policy.hujson 
[+] Creating 1/1
 ✔ Container headscale-nginx  Running                                                                                                                                                                  0.0s 
2025-05-09T10:12:52-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/utils.go:124 > Could not connect: context deadline exceeded error="context deadline exceeded"

And I try to set policy when the mode is file

➜  docker exec headscale headscale policy set --file /etc/headscale/policy.hujson
Failed to set ACL Policy: rpc error: code = Unknown desc = update is disabled for modes other than 'database'

Maybe, policy set --file should work in both mode, but in file mode it won't write into file and print a warning?

@IamTaoChen commented on GitHub (May 9, 2025): > > but as you know, the service couldn’t start. > > Actually, I didnt know, I would expect it to start with an empty policy, and then you can load your file with `headscale policy set --file` That means I need to delete the policy from the database first, am I right? ```bash headscale | 2025-05-09T10:03:47-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Username has to contain @, got: \"A\"" headscale exited with code 0 headscale | 2025-05-09T10:03:48-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Username has to contain @, got: \"B\"" headscale exited with code 1 headscale | 2025-05-09T10:03:49-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Username has to contain @, got: \"C\"" ``` I'm using docker, so I try to run ```bash docker compose run --rm headscale policy set --file /etc/headscale/policy.hujson [+] Creating 1/1 ✔ Container headscale-nginx Running 0.0s 2025-05-09T10:12:52-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/utils.go:124 > Could not connect: context deadline exceeded error="context deadline exceeded" ``` And I try to set policy when the mode is `file` ```bash ➜ docker exec headscale headscale policy set --file /etc/headscale/policy.hujson Failed to set ACL Policy: rpc error: code = Unknown desc = update is disabled for modes other than 'database' ``` Maybe, `policy set --file` should work in both mode, but in `file` mode it won't write into file and print a warning?
adam commented 2025-12-29 02:27:25 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (May 9, 2025):

Headscale won't start with an invalid policy and this also means that the policy can't be updated with the CLI. One may
migrate a policy stored in the database following these steps:

  • Dump the policy to a file while still running Headscale 0.25: headscale policy get > policy.json
  • Create a dummy policy: echo '{"acls":[{"action":"accept","src":["*"],"dst":["*:*"]}]}' > dummy.json
  • Load the dummy policy into Headscale 0.25: headscale policy set --file dummy.json
  • Edit policy.json and migrate to policy V2
  • Update to Headscale 0.26
  • Load the modified policy V2: headscale policy set --file policy.json
@nblock commented on GitHub (May 9, 2025): Headscale won't start with an invalid policy and this also means that the policy can't be updated with the CLI. One may migrate a policy stored in the database following these steps: * Dump the policy to a file while still running Headscale 0.25: `headscale policy get > policy.json` * Create a dummy policy: `echo '{"acls":[{"action":"accept","src":["*"],"dst":["*:*"]}]}' > dummy.json` * Load the dummy policy into Headscale 0.25: `headscale policy set --file dummy.json` * Edit `policy.json` and migrate to policy V2 * Update to Headscale 0.26 * Load the modified policy V2: `headscale policy set --file policy.json`
adam commented 2025-12-29 02:27:25 +01:00
Author
Owner
Copy Link

@IamTaoChen commented on GitHub (May 10, 2025):

Here is the new problem: I couldn't downgrade to 0.25, because of

headscale  | 2025-05-09T20:59:54-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: loading nodes from database to validate policy: SQL logic error: no such table: routes (1)"

I'll try to edit the database directly

@IamTaoChen commented on GitHub (May 10, 2025): Here is the new problem: I couldn't downgrade to 0.25, because of ```bash headscale | 2025-05-09T20:59:54-04:00 FTL home/runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="failed to load ACL policy: loading nodes from database to validate policy: SQL logic error: no such table: routes (1)" ``` I'll try to edit the database directly
adam commented 2025-12-29 02:27:25 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (May 10, 2025):

I'll try to edit the database directly

I found an easier way to migrate just using Headscale 0.26:

  • Start Headscale 0.26 with the environment variable HEADSCALE_POLICY_V1=1 set. You can check that Headscale picked up the environment variable via the INF message: Using policy manager version: 1
  • Dump the policy to a file: headscale policy get > policy.json
  • Edit policy.json and migrate to policy V2 (check with: headscale policy check --file policy.json).
  • Load the modified policy: headscale policy set --file policy.json
  • Restart Headscale without the environment variable HEADSCALE_POLICY_V1. You should see a INFO message: Using policy manager version: 2.
@nblock commented on GitHub (May 10, 2025): > I'll try to edit the database directly I found an easier way to migrate just using Headscale 0.26: * Start Headscale 0.26 with the environment variable `HEADSCALE_POLICY_V1=1` set. You can check that Headscale picked up the environment variable via the INF message: `Using policy manager version: 1` * Dump the policy to a file: `headscale policy get > policy.json` * Edit `policy.json` and migrate to policy V2 (check with: `headscale policy check --file policy.json`). * Load the modified policy: `headscale policy set --file policy.json` * Restart Headscale **without** the environment variable `HEADSCALE_POLICY_V1`. You should see a INFO message: `Using policy manager version: 2`.
adam commented 2025-12-29 02:27:25 +01:00
Author
Owner
Copy Link

@agarzon-orangerine commented on GitHub (May 20, 2025):

  • HEADSCALE_POLICY_V1=1

Thank you. That worked for me, That allowed me to start the container, adjust the ACL and then run it again as usual.

Image

@agarzon-orangerine commented on GitHub (May 20, 2025): > * HEADSCALE_POLICY_V1=1 Thank you. That worked for me, That allowed me to start the container, adjust the ACL and then run it again as usual. ![Image](https://github.com/user-attachments/assets/04b32d2f-1048-46b6-95ff-c2d32c059857)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1007
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?