starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Policy: autogroup support #1032

New Issue
Closed
opened 2025-12-29 02:27:49 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:27:49 +01:00
Owner
Copy Link

Originally created by @kradalby on GitHub (May 21, 2025).

This is tracking issue for autogroup support in the headscale Policy, it supersedes #657.

From the Tailscale docs:

An autogroup is a special group that automatically includes users, destinations, or usernames with the same properties.

Headscale aims to implement a subset of the Tailscale autogroups, currently supported autogroups are checked:

  • autogroup:self
  • autogroup:internet
  • autogroup:member (as of #2572)
  • autogroup:tagged (as of #2572)
  • autogroup:nonroot

autogroup:self is a bit more complicated, the goal would be to get it in as part of this release cycle, but it needs some more thinking as it cannot be resolved as part of the policy and a list of nodes. It needs the information about the self (node or user) as well.

Some autogroups are more complicated, and we dont consider them essential for now, which means we might do them later:

  • user:*@<domain>
  • localpart:*@<domain>

Not relevant as these describe roles in Tailscale, which does not exist in headscale:

  • autogroup:owner
  • autogroup:admin
  • autogroup:auditor
  • autogroup:billing-admin
  • autogroup:it-admin
  • autogroup:network-admin

Not relevant as headscale only has one tailnet:

  • autogroup:shared
Originally created by @kradalby on GitHub (May 21, 2025). This is tracking issue for `autogroup` support in the headscale Policy, it supersedes #657. From the [Tailscale docs](https://tailscale.com/kb/1337/acl-syntax#autogroups): > An [autogroup](https://tailscale.com/kb/1396/targets#autogroups) is a special group that automatically includes users, destinations, or usernames with the same properties. Headscale aims to implement a subset of the Tailscale `autogroups`, currently supported autogroups are checked: - [ ] `autogroup:self` - [x] `autogroup:internet` - [x] `autogroup:member` (as of #2572) - [x] `autogroup:tagged` (as of #2572) - [x] `autogroup:nonroot` `autogroup:self` is a bit more complicated, the goal would be to get it in as part of this release cycle, but it needs some more thinking as it cannot be resolved as part of the policy and a list of nodes. It needs the information about the `self` (node or user) as well. Some autogroups are more complicated, and we dont consider them essential for now, which means we might do them later: - `user:*@<domain>` - `localpart:*@<domain>` Not relevant as these describe roles in Tailscale, which does not exist in headscale: - `autogroup:owner` - `autogroup:admin` - `autogroup:auditor` - `autogroup:billing-admin` - `autogroup:it-admin` - `autogroup:network-admin` Not relevant as headscale only has one tailnet: - `autogroup:shared`
adam added the no-stale-botpolicy 📝 labels 2025-12-29 02:27:49 +01:00
adam closed this issue 2025-12-29 02:27:49 +01:00
adam commented 2025-12-29 02:27:50 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Sep 12, 2025):

@vdovhanych has some promising work for autogroup:self but we will push it one release to not hold up this one.

@kradalby commented on GitHub (Sep 12, 2025): @vdovhanych has some promising work for `autogroup:self` but we will push it one release to not hold up this one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label no-stale-bot policy 📝
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1032
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?