starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Default isolation of namespaces via config parameter #342

New Issue
Closed
opened 2025-12-29 01:27:21 +01:00 by adam · 5 comments
adam commented 2025-12-29 01:27:21 +01:00
Owner
Copy Link

Originally created by @EvilBlood on GitHub (Oct 1, 2022).

Hello everyone, I wanted to ask if there is a possibility of isolating namespaces via the config file, e.g. 'isolate_namespaces_default = true' which could be overridden using ACL.

Example UserA only sees his devices and UserB only sees his devices, but it is possible that a device from UserA is released for UserB via ACL.

My purpose for this feature is: I share a server with a few friends and we all want to switch our previous VPN solution to Headscale. For this we use an oidc backend which we also use for services. Currently I have to build a separate rule for each user in the ACL so that it works. It would be nice if there was the possibility that every user could do everything within his namespace by default without me creating a rule for him.

Originally created by @EvilBlood on GitHub (Oct 1, 2022). Hello everyone, I wanted to ask if there is a possibility of isolating namespaces via the config file, e.g. 'isolate_namespaces_default = true' which could be overridden using ACL. Example UserA only sees his devices and UserB only sees his devices, but it is possible that a device from UserA is released for UserB via ACL. My purpose for this feature is: I share a server with a few friends and we all want to switch our previous VPN solution to Headscale. For this we use an oidc backend which we also use for services. Currently I have to build a separate rule for each user in the ACL so that it works. It would be nice if there was the possibility that every user could do everything within his namespace by default without me creating a rule for him.
adam added the enhancement label 2025-12-29 01:27:21 +01:00
adam closed this issue 2025-12-29 01:27:21 +01:00
adam commented 2025-12-29 01:27:21 +01:00
Author
Owner
Copy Link

@iSchluff commented on GitHub (Nov 9, 2022):

I think the proper solution would be implementing tailscale autogroups https://tailscale.com/kb/1018/acls/#autogroups in headscale.
Then you could just express it in a simple ACL definition

@iSchluff commented on GitHub (Nov 9, 2022): I think the proper solution would be implementing tailscale autogroups https://tailscale.com/kb/1018/acls/#autogroups in headscale. Then you could just express it in a simple ACL definition
adam commented 2025-12-29 01:27:22 +01:00
Author
Owner
Copy Link

@juanfont commented on GitHub (May 10, 2023):

Please use ACLs.

@juanfont commented on GitHub (May 10, 2023): Please use ACLs.
adam commented 2025-12-29 01:27:22 +01:00
Author
Owner
Copy Link

@EvilBlood commented on GitHub (May 10, 2023):

I would like to use the ACLs but unfortunately the autogroup function does not work yet. An example would be:
{
"action": "accept",
"src": ["autogroup:members"],
"dst": ["autogroup:self"],
}

@EvilBlood commented on GitHub (May 10, 2023): I would like to use the ACLs but unfortunately the autogroup function does not work yet. An example would be: { "action": "accept", "src": ["autogroup:members"], "dst": ["autogroup:self"], }
adam commented 2025-12-29 01:27:22 +01:00
Author
Owner
Copy Link

@juanfont commented on GitHub (May 10, 2023):

Can you open a dedicated issue?

On Wed, May 10, 2023, 19:26 EvilBlood @.***> wrote:

I would like to use the ACLs but unfortunately the autogroup function does
not work yet. An example would be:
{
"action": "accept",
"src": ["autogroup:members"],
"dst": ["autogroup:self"],
}

—
Reply to this email directly, view it on GitHub
https://github.com/juanfont/headscale/issues/841#issuecomment-1542561080,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AABMGQ2M5E2YBWZSYILUBMLXFPFSZANCNFSM6AAAAAAQ2LNVQ4
.
You are receiving this because you modified the open/close state.Message
ID: @.***>

@juanfont commented on GitHub (May 10, 2023): Can you open a dedicated issue? On Wed, May 10, 2023, 19:26 EvilBlood ***@***.***> wrote: > I would like to use the ACLs but unfortunately the autogroup function does > not work yet. An example would be: > { > "action": "accept", > "src": ["autogroup:members"], > "dst": ["autogroup:self"], > } > > — > Reply to this email directly, view it on GitHub > <https://github.com/juanfont/headscale/issues/841#issuecomment-1542561080>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AABMGQ2M5E2YBWZSYILUBMLXFPFSZANCNFSM6AAAAAAQ2LNVQ4> > . > You are receiving this because you modified the open/close state.Message > ID: ***@***.***> >
adam commented 2025-12-29 01:27:22 +01:00
Author
Owner
Copy Link

@Mansarde commented on GitHub (May 11, 2023):

I would like to use the ACLs but unfortunately the autogroup function does not work yet. An example would be: { "action": "accept", "src": ["autogroup:members"], "dst": ["autogroup:self"], }

You have to add the port to the dst, like so: "dst": ["autogroup:self:*"]
Then every member of your tailnet should be able to access their own devices.

@Mansarde commented on GitHub (May 11, 2023): > I would like to use the ACLs but unfortunately the autogroup function does not work yet. An example would be: { "action": "accept", "src": ["autogroup:members"], "dst": ["autogroup:self"], } You have to add the port to the `dst`, like so: `"dst": ["autogroup:self:*"]` Then every member of your tailnet should be able to access their own devices.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#342
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?