starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

tailscale client cannot register/login when setup headscale behind istio #347

New Issue
Closed
opened 2025-12-29 01:27:26 +01:00 by adam · 10 comments
adam commented 2025-12-29 01:27:26 +01:00
Owner
Copy Link

Originally created by @kevin1sMe on GitHub (Oct 9, 2022).

Headscale is a great project ! !

I face a problem when setup headscale behind istio ingress( reverse proxy).
When I try to login:

tailscale up --login-server=<https://headscale.example.com> --accept-routes=true --accept-dns=false

No responsed.

Look at envoy debug log:

S11933942887229510821] request headers complete (end_stream=false):
':authority', 'headscale.example.com',
':path', '/ts2021'
':method', 'POST'
'user-agent', 'Go-http-client/1.1'
'content-length', '0'
'connection', 'upgrade'
'upgrade', 'tailscale-control-protocol'
'x-tailscale-handshake', 'ACkBAG.....'

...
2022-10-09T05:04:25.470382Z	debug	envoy connection	[C795] current connecting state: false
2022-10-09T05:04:25.470435Z	debug	envoy http	[C795][S11933942887229510821] Sending local reply with details upgrade_failed
2022-10-09T05:04:25.470458Z	debug	envoy http	[C795][S11933942887229510821] closing connection due to connection close header

Expect login succ.

Context info

Originally created by @kevin1sMe on GitHub (Oct 9, 2022). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the bug report in this language. --> Headscale is a great project ! ! I face a problem when **setup headscale behind istio ingress( reverse proxy)**. When I try to login: ```bash tailscale up --login-server=<https://headscale.example.com> --accept-routes=true --accept-dns=false ``` No responsed. Look at envoy debug log: ```log S11933942887229510821] request headers complete (end_stream=false): ':authority', 'headscale.example.com', ':path', '/ts2021' ':method', 'POST' 'user-agent', 'Go-http-client/1.1' 'content-length', '0' 'connection', 'upgrade' 'upgrade', 'tailscale-control-protocol' 'x-tailscale-handshake', 'ACkBAG.....' ... 2022-10-09T05:04:25.470382Z debug envoy connection [C795] current connecting state: false 2022-10-09T05:04:25.470435Z debug envoy http [C795][S11933942887229510821] Sending local reply with details upgrade_failed 2022-10-09T05:04:25.470458Z debug envoy http [C795][S11933942887229510821] closing connection due to connection close header ``` <!-- A clear and concise description of what the bug is. Describe the expected bahavior and how it is currently different. If you are unsure if it is a bug, consider discussing it on our Discord server first. --> Expect login succ. <!-- Steps to reproduce the behavior. --> **Context info** <!-- Please add relevant information about your system. For example: - Version of headscale used - Version of tailscale client - OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version - Kernel version - The relevant config parameters you used - Log output -->
adam added the bug label 2025-12-29 01:27:26 +01:00
adam closed this issue 2025-12-29 01:27:26 +01:00
adam commented 2025-12-29 01:27:26 +01:00
Author
Owner
Copy Link

@rjmalagon commented on GitHub (Oct 12, 2022):

I had an issue with another reverse proxy (cloudflared), because it does not support upgrade a https connection to wss on same port/connection. I had to scrape that reverse proxy configuration.

Your reverse proxy configuration supports websocket upgrades?

@rjmalagon commented on GitHub (Oct 12, 2022): I had an issue with another reverse proxy (cloudflared), because it does not support upgrade a https connection to wss on same port/connection. I had to scrape that reverse proxy configuration. Your reverse proxy configuration supports websocket upgrades?
adam commented 2025-12-29 01:27:26 +01:00
Author
Owner
Copy Link

@clarkmcc commented on GitHub (Oct 14, 2022):

What does your virtual service look like?

@clarkmcc commented on GitHub (Oct 14, 2022): What does your virtual service look like?
adam commented 2025-12-29 01:27:27 +01:00
Author
Owner
Copy Link

@kevin1sMe commented on GitHub (Oct 14, 2022):

Yes . Istio's data plane is envoy. http/upgrades

@kevin1sMe commented on GitHub (Oct 14, 2022): > Yes . Istio's data plane is envoy. [http/upgrades](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/http/upgrades)
adam commented 2025-12-29 01:27:27 +01:00
Author
Owner
Copy Link

@kevin1sMe commented on GitHub (Oct 14, 2022):

What does your virtual service look like?

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: headscale
spec:
  hosts:
    - "headscale.xxxx"
  gateways:
    - istio-ingress/xxx-gateway
    - mesh
  http:
    - name: to-headscale
      route:
        - destination:
            host: headscale.headscale.svc.cluster.local
            port:
              number: 8080
@kevin1sMe commented on GitHub (Oct 14, 2022): > What does your virtual service look like? ```yaml apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: headscale spec: hosts: - "headscale.xxxx" gateways: - istio-ingress/xxx-gateway - mesh http: - name: to-headscale route: - destination: host: headscale.headscale.svc.cluster.local port: number: 8080 ```
adam commented 2025-12-29 01:27:27 +01:00
Author
Owner
Copy Link

@juanfont commented on GitHub (Jan 13, 2023):

Are you still having this?

@juanfont commented on GitHub (Jan 13, 2023): Are you still having this?
adam commented 2025-12-29 01:27:27 +01:00
Author
Owner
Copy Link

@clarkmcc commented on GitHub (Jan 13, 2023):

@kevin1sMe sorry, didn't see the notification. Have you tried a TCP virtual service? Something along these lines?

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: headscale.xxxx
spec:
  hosts:
  - headscale.headscale.svc.cluster.local
  gateways:
    - istio-ingress/xxx-gateway
    - mesh
  tcp:
  - match:
    - port: 8080
    route:
    - destination:
        host: headscale.headscale.svc.cluster.local
        port:
          number: 8080
@clarkmcc commented on GitHub (Jan 13, 2023): @kevin1sMe sorry, didn't see the notification. Have you tried a TCP virtual service? Something along these lines? ```yaml apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: headscale.xxxx spec: hosts: - headscale.headscale.svc.cluster.local gateways: - istio-ingress/xxx-gateway - mesh tcp: - match: - port: 8080 route: - destination: host: headscale.headscale.svc.cluster.local port: number: 8080 ```
adam commented 2025-12-29 01:27:28 +01:00
Author
Owner
Copy Link

@mihirsamdarshi commented on GitHub (Feb 12, 2023):

I am having similar problems when running headscale behind a Cloudflare tunnel - I don't know how to debug the Tailscale client's actions. I think this issue might be related to mine:

https://github.com/cloudflare/cloudflared/issues/883

@mihirsamdarshi commented on GitHub (Feb 12, 2023): I am having similar problems when running headscale behind a Cloudflare tunnel - I don't know how to debug the Tailscale client's actions. I think this issue might be related to mine: https://github.com/cloudflare/cloudflared/issues/883
adam commented 2025-12-29 01:27:28 +01:00
Author
Owner
Copy Link

@juanfont commented on GitHub (Feb 12, 2023):

Cloudflare does not forward websockets in their free tier.

Headscale will not work.

On Sun, Feb 12, 2023, 05:54 Mihir Samdarshi @.***>
wrote:

I am having similar problems when running headscale behind a Cloudflare
tunnel - I don't know how to debug the Tailscale client's actions

—
Reply to this email directly, view it on GitHub
https://github.com/juanfont/headscale/issues/851#issuecomment-1426942907,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AABMGQ6LMZHFYU4C7RQMRQTWXBUG7ANCNFSM6AAAAAARAUTLJE
.
You are receiving this because you commented.Message ID:
@.***>

@juanfont commented on GitHub (Feb 12, 2023): Cloudflare does not forward websockets in their free tier. Headscale will not work. On Sun, Feb 12, 2023, 05:54 Mihir Samdarshi ***@***.***> wrote: > I am having similar problems when running headscale behind a Cloudflare > tunnel - I don't know how to debug the Tailscale client's actions > > — > Reply to this email directly, view it on GitHub > <https://github.com/juanfont/headscale/issues/851#issuecomment-1426942907>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AABMGQ6LMZHFYU4C7RQMRQTWXBUG7ANCNFSM6AAAAAARAUTLJE> > . > You are receiving this because you commented.Message ID: > ***@***.***> >
adam commented 2025-12-29 01:27:28 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Feb 12, 2023):

We do not officially support having headscale behind a proxy, some user have managed to and they are usually happy to help on Discord. Please continue support questions there.

@kradalby commented on GitHub (Feb 12, 2023): We do not officially support having headscale behind a proxy, some user have managed to and they are usually happy to help on Discord. Please continue support questions there.
adam commented 2025-12-29 01:27:29 +01:00
Author
Owner
Copy Link

@isaac-mcfadyen commented on GitHub (Mar 9, 2023):

Cloudflare does not forward websockets in their free tier.

They actually do, as long as you have them turned on in the Zone settings:
https://support.cloudflare.com/hc/en-us/articles/200169466-Using-Cloudflare-with-WebSockets

@isaac-mcfadyen commented on GitHub (Mar 9, 2023): > Cloudflare does not forward websockets in their free tier. They actually do, as long as you have them turned on in the Zone settings: https://support.cloudflare.com/hc/en-us/articles/200169466-Using-Cloudflare-with-WebSockets
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#347
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?