starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Allow to specify initial API key as a flag for serve command #283

New Issue
Closed
opened 2025-12-29 01:26:02 +01:00 by adam · 5 comments
adam commented 2025-12-29 01:26:02 +01:00
Owner
Copy Link

Originally created by @GrigoriyMikhalkin on GitHub (Jun 24, 2022).

Feature request

It's probably somewhat controversial feature request. But it would be really useful if it would be possible to specify API key as a flag for headscale serve command.

Example of a case when it would be useful: there's is a service that serves as an intermediary between headscale server and tailscale clients(distributes auth keys). Predefined API key would be useful to simplify deployment of the whole setup. As without it, the only solution i see is a bit complex setup with SSH client built inside a service.

Is there some security concerns why it shouldn't be done or maybe some other known solutions for this case?

Originally created by @GrigoriyMikhalkin on GitHub (Jun 24, 2022). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the feature request in this language. --> **Feature request** It's probably somewhat controversial feature request. But it would be really useful if it would be possible to specify API key as a flag for `headscale serve` command. Example of a case when it would be useful: there's is a service that serves as an intermediary between headscale server and tailscale clients(distributes auth keys). Predefined API key would be useful to simplify deployment of the whole setup. As without it, the only solution i see is a bit complex setup with SSH client built inside a service. Is there some security concerns why it shouldn't be done or maybe some other known solutions for this case?
adam added the enhancement label 2025-12-29 01:26:02 +01:00
adam closed this issue 2025-12-29 01:26:02 +01:00
adam commented 2025-12-29 01:26:02 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Jul 10, 2022):

Hi

I dont think allowing arbitrary keys to be set is ideal, it seems to be going against common practices of how API keys are generated.

If this is for provisioning, why can you not use the provisioning tool to create the API key on the server, then read it back?

I know this can be done with Ansible at least?

@kradalby commented on GitHub (Jul 10, 2022): Hi I dont think allowing arbitrary keys to be set is ideal, it seems to be going against common practices of how API keys are generated. If this is for provisioning, why can you not use the provisioning tool to create the API key on the server, then read it back? I know this can be done with Ansible at least?
adam commented 2025-12-29 01:26:03 +01:00
Author
Owner
Copy Link

@GrigoriyMikhalkin commented on GitHub (Jul 10, 2022):

@kradalby Thanks! I didn't find a way to do that for Ansible. So it should be possible there to generate API key and pass it later to another role somehow?

@GrigoriyMikhalkin commented on GitHub (Jul 10, 2022): @kradalby Thanks! I didn't find a way to do that for Ansible. So it should be possible there to generate API key and pass it later to another role somehow?
adam commented 2025-12-29 01:26:03 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Jul 31, 2022):

Yes, Ansible can execute commands on the server and read stdout, so it should have no problems with excuting the creating of a apikey and reading it into a variable, have a look at this stack overflow.

@kradalby commented on GitHub (Jul 31, 2022): Yes, Ansible can execute commands on the server and read stdout, so it should have no problems with excuting the creating of a apikey and reading it into a variable, [have a look at this stack overflow](https://stackoverflow.com/a/36060102).
adam commented 2025-12-29 01:26:04 +01:00
Author
Owner
Copy Link

@juanfont commented on GitHub (Aug 12, 2022):

Going to close this for the time being.

@juanfont commented on GitHub (Aug 12, 2022): Going to close this for the time being.
adam commented 2025-12-29 01:26:04 +01:00
Author
Owner
Copy Link

@dimaqq commented on GitHub (Oct 31, 2022):

I too would like provision "fixed" keys.

That would make orchestrating our stack so much easier, when tailscale / headscale is a very small part of the stack.

Ideally, I'd like to be able to launch headscale in the cloud, some edge device and tailscale-enabled containers all in one go.

Today, I have to make sure that headscale starts up first, use script to read the preauth keys out, pass those as env vars to edge and containers, and only then I can start the edge device and the tailscale-enabled containers. I find that confusing and brittle.

@dimaqq commented on GitHub (Oct 31, 2022): I too would like provision "fixed" keys. That would make orchestrating our stack so much easier, when `tailscale` / `headscale` is a very small part of the stack. Ideally, I'd like to be able to launch headscale in the cloud, some edge device and tailscale-enabled containers all in one go. Today, I have to make sure that headscale starts up first, use script to read the preauth keys out, pass those as env vars to edge and containers, and only then I can start the edge device and the tailscale-enabled containers. I find that confusing and brittle.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#283
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?