starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-13 12:50:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Feature] Raise on reference to invalid group in policy #1009

New Issue
Closed
opened 2025-12-29 02:27:25 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:27:25 +01:00
Owner
Copy Link

Originally created by @nblock on GitHub (May 6, 2025).

Use case

With policy v2 and headscale policy check --file PATH policy errors can be detected early on.

Description

The group group:does-not-exist is not defined in the groups section:

{
  "groups": {
    "group:users": [
      "alice@",
    ]
  },
  "tagOwners": {
    "tag:exit-nodes": [
      // this group reference does not exist
      "group:does-not-exist"
    ]
  },
  "autoApprovers": {
    "exitNode": [
      "tag:exit-nodes"
    ]
  },
  "acls": [
    {
      "action": "accept",
      "src": [
        "*"
      ],
      "dst": [
        "*:*"
      ]
    }
  ]
}

This silently breaks automatic approval of exit nodes (note the empty ValidTags column):

$ headscale node list --tags
ID | Hostname | Name | MachineKey | NodeKey | User  | IP addresses                  | Ephemeral | Last seen | Expiration | Connected | Expired | ForcedTags | InvalidTags | ValidTags
1  | n1       | n1   | [Ql7be]    | [rH2IO] | alice | 100.64.0.1, fd7a:115c:a1e0::1 | false     |           | N/A        | online    | no      |            |             |

$ headscale node list-routes
ID | Hostname | Approved | Available       | Serving (Primary)
1  | n1       |          | 0.0.0.0/0, ::/0 |

Tailscale:

$ sudo tailscale up \
    --login-server https://headscale.example.net \
    --advertise-tags=tag:exit-nodes \
    --advertise-exit-node=true

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

No response

Originally created by @nblock on GitHub (May 6, 2025). ### Use case With policy v2 and `headscale policy check --file PATH` policy errors can be detected early on. ### Description The group `group:does-not-exist` is not defined in the `groups` section: ```json { "groups": { "group:users": [ "alice@", ] }, "tagOwners": { "tag:exit-nodes": [ // this group reference does not exist "group:does-not-exist" ] }, "autoApprovers": { "exitNode": [ "tag:exit-nodes" ] }, "acls": [ { "action": "accept", "src": [ "*" ], "dst": [ "*:*" ] } ] } ``` This silently breaks automatic approval of exit nodes (note the empty `ValidTags` column): ```console $ headscale node list --tags ID | Hostname | Name | MachineKey | NodeKey | User | IP addresses | Ephemeral | Last seen | Expiration | Connected | Expired | ForcedTags | InvalidTags | ValidTags 1 | n1 | n1 | [Ql7be] | [rH2IO] | alice | 100.64.0.1, fd7a:115c:a1e0::1 | false | | N/A | online | no | | | ``` ```console $ headscale node list-routes ID | Hostname | Approved | Available | Serving (Primary) 1 | n1 | | 0.0.0.0/0, ::/0 | ``` Tailscale: ```console $ sudo tailscale up \ --login-server https://headscale.example.net \ --advertise-tags=tag:exit-nodes \ --advertise-exit-node=true ``` ### Contribution - [ ] I can write the design doc for this feature - [ ] I can contribute this feature ### How can it be implemented? _No response_
adam added the enhancementpolicy 📝 labels 2025-12-29 02:27:25 +01:00
adam closed this issue 2025-12-29 02:27:25 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement policy 📝
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1009
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?