starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Feature] Hashed secrets #1153

New Issue
Closed
opened 2025-12-29 02:28:35 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:28:35 +01:00
Owner
Copy Link

Originally created by @Mikilio on GitHub (Nov 19, 2025).

Use case

On a serious production environment, one may want to back up the database. In whatever operations one may want to do with these backups, everything becomes easier if that backup does not contain infrastructure critical secrets (such as api-keys and reusable pre_auth_keys in plaintext).

I believe it is possible to make the entire content of the database non-sensitive. Greatly reducing the attack surface under the assumption of a leaked backup.

Description

I would like to only store hashed versions of preauthkeys and api-keys as the headscale server only needs to verify these but doesn't actually need them itself.

Contribution

  • I can write the design doc for this feature
  • I can contribute this feature

How can it be implemented?

I'm not a go programmer, but I am a software engineer.
I should be able to do this with some help.

Originally created by @Mikilio on GitHub (Nov 19, 2025). ### Use case On a serious production environment, one may want to back up the database. In whatever operations one may want to do with these backups, everything becomes easier if that backup does not contain infrastructure critical secrets (such as api-keys and reusable pre_auth_keys in plaintext). I believe it is possible to make the entire content of the database non-sensitive. Greatly reducing the attack surface under the assumption of a leaked backup. ### Description I would like to only store hashed versions of preauthkeys and api-keys as the headscale server only needs to verify these but doesn't actually need them itself. ### Contribution - [x] I can write the design doc for this feature - [x] I can contribute this feature ### How can it be implemented? I'm not a go programmer, but I am a software engineer. I should be able to do this with some help.
adam added the enhancement label 2025-12-29 02:28:35 +01:00
adam closed this issue 2025-12-29 02:28:35 +01:00
adam commented 2025-12-29 02:28:36 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Nov 20, 2025):

preauthkeys and api-keys

api-keys are already hashed (always been)

pre auth keys will be hashed in 0.28, it was merged in https://github.com/juanfont/headscale/pull/2853

@kradalby commented on GitHub (Nov 20, 2025): > preauthkeys and api-keys api-keys are already hashed (always been) pre auth keys will be hashed in 0.28, it was merged in https://github.com/juanfont/headscale/pull/2853
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1153
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?