starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-13 04:40:29 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Feature] Multi-tenancy, multiple tailnets and fine grained api authorization support #1073

New Issue
Closed
opened 2025-12-29 02:28:07 +01:00 by adam · 2 comments
adam commented 2025-12-29 02:28:07 +01:00
Owner
Copy Link

Originally created by @randycylonix on GitHub (Jul 30, 2025).

Use case

I understand that the stated goal of Headscale is to be single tailnet and hence keep it very simple. I have forked to to support a fully open sourced alternative to Tailscale and with additional exit node features for firewall, sdwan routing et al aka Cylonix. All cylonix specific changes other than the stated features in the title are encapsulated in the interfaces at node_handler and ip_allocator interfaces. The code is at headscale ts branch and tagged with CYLONIX_MOD.

Description

  1. Namespace support for multi-tenancy
  2. Network Domain support for multiple tailnets
  3. Fine grained auth check for api access: All aka sysadmin, Namespace aka tenant admin, Network aka network domain admin within a namespace, and User, total 4 levels.

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

  • DB types to add network and namespace field
  • APIs to include network, user, and namespace fields
  • Interfaces to support node events and allocate ip addresses (namespace may have different address pools)

The code is already at headscale ts branch and tagged with CYLONIX_MOD.

Originally created by @randycylonix on GitHub (Jul 30, 2025). ### Use case I understand that the stated goal of Headscale is to be single tailnet and hence keep it very simple. I have forked to to support a fully open sourced alternative to Tailscale and with additional exit node features for firewall, sdwan routing et al aka [Cylonix](https://github.com/cylonix). All cylonix specific changes other than the stated features in the title are encapsulated in the interfaces at node_handler and ip_allocator interfaces. The code is at [headscale ts branch](https://github.com/cylonix/headscale/tree/ts) and tagged with __CYLONIX_MOD__. ### Description 1. Namespace support for multi-tenancy 2. Network Domain support for multiple tailnets 3. Fine grained auth check for api access: All aka sysadmin, Namespace aka tenant admin, Network aka network domain admin within a namespace, and User, total 4 levels. ### Contribution - [x] I can write the design doc for this feature - [x] I can contribute this feature ### How can it be implemented? - DB types to add network and namespace field - APIs to include network, user, and namespace fields - Interfaces to support node events and allocate ip addresses (namespace may have different address pools) The code is already at [headscale ts branch](https://github.com/cylonix/headscale/tree/ts) and tagged with __CYLONIX_MOD__.
adam added the enhancement label 2025-12-29 02:28:07 +01:00
adam closed this issue 2025-12-29 02:28:07 +01:00
adam commented 2025-12-29 02:28:07 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Jul 31, 2025):

Per now, we will not focus on adding this. The concept of multi tenancy was previously removed (https://github.com/juanfont/headscale/pull/357) as it was not implemented correctly in comparison to upstream Tailscale and it made every bug one dimension harder to debug.

We are currently focused on fixing the many fundamental bugs we have and taking away from that focus would not be beneficial. We have a subject-to-change roadmap (https://github.com/juanfont/headscale/milestones), and while it might change, we will try to work on it in order to get the project where we wish for it to be.

While this presumably is a working implementation, we would have to take a lot of steps back and really design this feature so we do not end up with one more implementation with edge cases complicating the maintenance for our small team.

There are definitively interesting work in your fork, but at the moment it does not fit in our roadmap as it would steal a lot of focus and undoubtedly introduce new bugs or bugs will be harder to debug.

Very cool that you work on it tho and use it, we can chat again later, but for now this would be too much change.

@kradalby commented on GitHub (Jul 31, 2025): Per now, we will not focus on adding this. The concept of multi tenancy was previously removed (https://github.com/juanfont/headscale/pull/357) as it was not implemented correctly in comparison to upstream Tailscale and it made every bug one dimension harder to debug. We are currently focused on fixing the many fundamental bugs we have and taking away from that focus would not be beneficial. We have a subject-to-change roadmap (https://github.com/juanfont/headscale/milestones), and while it might change, we will try to work on it in order to get the project where we wish for it to be. While this presumably is a working implementation, we would have to take a lot of steps back and really design this feature so we do not end up with one more implementation with edge cases complicating the maintenance for our small team. There are definitively interesting work in your fork, but at the moment it does not fit in our roadmap as it would steal a lot of focus and undoubtedly introduce new bugs or bugs will be harder to debug. Very cool that you work on it tho and use it, we can chat again later, but for now this would be too much change.
adam commented 2025-12-29 02:28:08 +01:00
Author
Owner
Copy Link

@randycylonix commented on GitHub (Aug 1, 2025):

Sounds good. Thanks for taking the time for the detailed reasoning and the related information. Really appreciate it. I will look into helping out on the priorities you listed too. Regards, Randy

@randycylonix commented on GitHub (Aug 1, 2025): Sounds good. Thanks for taking the time for the detailed reasoning and the related information. Really appreciate it. I will look into helping out on the priorities you listed too. Regards, Randy
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1073
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?