starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

add --verify-clients environment variable to docker version #309

New Issue
Closed
opened 2025-12-29 01:26:29 +01:00 by adam · 14 comments
adam commented 2025-12-29 01:26:29 +01:00
Owner
Copy Link

Originally created by @vampywiz17 on GitHub (Aug 15, 2022).

Feature request

PLease add option to set private option to embedded DERP server in docker container.

Originally created by @vampywiz17 on GitHub (Aug 15, 2022). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the feature request in this language. --> **Feature request** PLease add option to set private option to embedded DERP server in docker container.
adam added the enhancementhelp wantedgood first issueno-stale-bot labels 2025-12-29 01:26:29 +01:00
adam closed this issue 2025-12-29 01:26:29 +01:00
adam commented 2025-12-29 01:26:30 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Sep 8, 2022):

Hi, can you please try to reword and explain this feature request?

Edit: I think I understand, We would be very happy to take a PR for this, but we do not officially support the docker setup, so it will not be prioritised for now.

@kradalby commented on GitHub (Sep 8, 2022): Hi, can you please try to reword and explain this feature request? Edit: I think I understand, We would be very happy to take a PR for this, but we do not officially support the docker setup, so it will not be prioritised for now.
adam commented 2025-12-29 01:26:30 +01:00
Author
Owner
Copy Link

@christian-heusel commented on GitHub (Nov 13, 2022):

.... but we do not officially support the docker setup, so it will not be prioritised for now.

@kradalby this is a general feature request, not specific for docker 😊
See https://tailscale.com/kb/1118/custom-derp-servers/#optional-restricting-client-access-to-your-derp-node for reference

@christian-heusel commented on GitHub (Nov 13, 2022): > .... but we do not officially support the docker setup, so it will not be prioritised for now. @kradalby this is a general feature request, not specific for docker 😊 See https://tailscale.com/kb/1118/custom-derp-servers/#optional-restricting-client-access-to-your-derp-node for reference
adam commented 2025-12-29 01:26:31 +01:00
Author
Owner
Copy Link

@joejose97 commented on GitHub (Sep 16, 2023):

@juanfont

The tailscale derp server gets the valid client list by sending a GET request to http://local-tailscaled.sock/localapi/v0/status
I'm thinking of emulating what the tailscale client does by creating a http listener on the said socket.

If this is acceptable, I'll open a PR with the same.

@joejose97 commented on GitHub (Sep 16, 2023): @juanfont The tailscale derp server gets the valid client list by sending a GET request to http://local-tailscaled.sock/localapi/v0/status I'm thinking of emulating what the tailscale client does by creating a http listener on the said socket. If this is acceptable, I'll open a PR with the same.
adam commented 2025-12-29 01:26:31 +01:00
Author
Owner
Copy Link

@icb- commented on GitHub (Oct 2, 2023):

Emulating the tailscale control socket API doesn't sound very straightforward, and would come with some downsides (like not being able to easily run tailscale on the headscale system).

It may be better to see about factoring out how the DERP server validates node keys (https://github.com/tailscale/tailscale/blob/main/derp/derp_server.go#L1126-L1142) and make it possible to pull those from headscale rather than the tailscale client socket.

Maybe passing a Verifier function, rather than setting a boolean for whether to verify?

I don't know if that sort of change could be made in a way that would be accepted upstream, or if it would mean maintaining a fork of the derp server.

@icb- commented on GitHub (Oct 2, 2023): Emulating the tailscale control socket API doesn't sound very straightforward, and would come with some downsides (like not being able to easily run tailscale on the headscale system). It may be better to see about factoring out how the DERP server validates node keys (https://github.com/tailscale/tailscale/blob/main/derp/derp_server.go#L1126-L1142) and make it possible to pull those from headscale rather than the tailscale client socket. Maybe passing a `Verifier` function, rather than setting a boolean for whether to verify? I don't know if that sort of change could be made in a way that would be accepted upstream, or if it would mean maintaining a fork of the derp server.
adam commented 2025-12-29 01:26:31 +01:00
Author
Owner
Copy Link

@mritd commented on GitHub (Oct 21, 2023):

@icb- After reading the derper code, it is feasible to simulate the API; I have created a branch and tested it; derper successfully completed the verification of the Client.

image
  • 1、Derper's verification of its client is mainly completed through the node public key in the status struct.
  • 2、Node public key is obtained from local socket api status request
  • 3、We only need to simulate a local status api and return the public keys of all nodes.
  • 4、After setting up client authentication, derper will automatically connect to this API to obtain the public keys of all nodes.
@mritd commented on GitHub (Oct 21, 2023): @icb- After reading the derper code, it is feasible to simulate the API; I have created a [branch](https://github.com/mritd/headscale/tree/feat/derp-verify-client) and tested it; derper successfully completed the verification of the Client. <img width="2558" alt="image" src="https://github.com/juanfont/headscale/assets/13043245/93251b64-c434-4545-92ca-7ed538467d93"> - 1、Derper's verification of its client is mainly completed through [the node public key in the `status` struct](https://github.com/tailscale/tailscale/blob/f398712c006a8afeb165942baae9e7c526de7a9e/derp/derp_server.go#L1130). - 2、Node public key is obtained from [local socket api status request](https://github.com/tailscale/tailscale/blob/f398712c006a8afeb165942baae9e7c526de7a9e/ipn/localapi/localapi.go#L105) - 3、We only need to simulate a local status api and return the public keys of all nodes. - 4、After setting up client authentication, derper will automatically connect to this API to obtain the public keys of all nodes.
adam commented 2025-12-29 01:26:32 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jan 20, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jan 20, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:26:32 +01:00
Author
Owner
Copy Link

@christian-heusel commented on GitHub (Jan 20, 2024):

This is a feature request, therefore the stale bot is a bit out of place here 😄

@christian-heusel commented on GitHub (Jan 20, 2024): This is a feature request, therefore the stale bot is a bit out of place here 😄
adam commented 2025-12-29 01:26:32 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Apr 21, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Apr 21, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:26:33 +01:00
Author
Owner
Copy Link

@6ixfalls commented on GitHub (Apr 21, 2024):

not stale

@6ixfalls commented on GitHub (Apr 21, 2024): not stale
adam commented 2025-12-29 01:26:33 +01:00
Author
Owner
Copy Link

@huanshiwushuang commented on GitHub (Jun 21, 2024):

This is a very important feature and we look forward to implementing it soon

@huanshiwushuang commented on GitHub (Jun 21, 2024): This is a very important feature and we look forward to implementing it soon
adam commented 2025-12-29 01:26:33 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 20, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Sep 20, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:26:33 +01:00
Author
Owner
Copy Link

@cavoirom commented on GitHub (Sep 20, 2024):

not stale

@cavoirom commented on GitHub (Sep 20, 2024): not stale
adam commented 2025-12-29 01:26:33 +01:00
Author
Owner
Copy Link

@viveksupe commented on GitHub (Jan 18, 2025):

Given now verify urls are implemented in headscale --verify-client-url.

https://github.com/juanfont/headscale/pull/2046

We should enable this option for embedded derp server to use those endpoints either as default or via explicit config.

@viveksupe commented on GitHub (Jan 18, 2025): Given now verify urls are implemented in headscale `--verify-client-url`. https://github.com/juanfont/headscale/pull/2046 We should enable this option for embedded derp server to use those endpoints either as default or via explicit config.
adam commented 2025-12-29 01:26:34 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Aug 18, 2025):

Closing, as everything seems to be in place for 0.27.0. Please reopen or file a new issue if needed.

@nblock commented on GitHub (Aug 18, 2025): Closing, as everything seems to be in place for 0.27.0. Please reopen or file a new issue if needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement good first issue help wanted no-stale-bot
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#309
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?