starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Security audit? #395

New Issue
Open
opened 2025-12-29 01:28:14 +01:00 by adam · 11 comments
adam commented 2025-12-29 01:28:14 +01:00
Owner
Copy Link

Originally created by @marcelmindemann on GitHub (Dec 19, 2022).

Hi,
as an avid but paranoid self-hoster, I am considering hosting headscale on a cheap VPS in order to establish VPN connections between my devices. The distrust of the closed-source Tailscale coordination server has driven me in this direction. However, I realize that self-hosting headscale makes this thing a single point of failure for my network infrastructure. An authentication bypass vulnerability in headscale could allow an attacker to infiltrate my network easily.

As headscale grows in popularity, and even got endorsed by Tailscale multiple times, I wonder if a security audit would be a worthwhile undertaking? It would certainly provide a lot more trust when opening up my headscale process to the public internet. Alas, it's the only thing I cannot hide behind a VPN, for obvious chicken-and-egg reasons :)

Originally created by @marcelmindemann on GitHub (Dec 19, 2022). Hi, as an avid but paranoid self-hoster, I am considering hosting headscale on a cheap VPS in order to establish VPN connections between my devices. The distrust of the closed-source Tailscale coordination server has driven me in this direction. However, I realize that self-hosting headscale makes this thing a single point of failure for my network infrastructure. An authentication bypass vulnerability in headscale could allow an attacker to infiltrate my network easily. As headscale grows in popularity, and even got endorsed by Tailscale multiple times, I wonder if a security audit would be a worthwhile undertaking? It would certainly provide a lot more trust when opening up my headscale process to the public internet. Alas, it's the only thing I cannot hide behind a VPN, for obvious chicken-and-egg reasons :)
adam added the enhancementno-stale-bot labels 2025-12-29 01:28:14 +01:00
adam commented 2025-12-29 01:28:14 +01:00
Author
Owner
Copy Link

@jgonzm commented on GitHub (Dec 23, 2022):

Hi,

Yes, I agree with you, but in the meantime, you could filter some ports to access only by specific IP: office & datacenters.

headscale_ports

node_key is another history...

@jgonzm commented on GitHub (Dec 23, 2022): Hi, Yes, I agree with you, but in the meantime, you could filter some ports to access only by specific IP: office & datacenters. <img width="587" alt="headscale_ports" src="https://user-images.githubusercontent.com/5006794/209352816-79ec4ae5-5591-4b10-a73b-0e134ac54179.png"> node_key is another history...
adam commented 2025-12-29 01:28:15 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 27, 2023):

This issue is stale because it has been open for 180 days with no activity.

@github-actions[bot] commented on GitHub (Sep 27, 2023): This issue is stale because it has been open for 180 days with no activity.
adam commented 2025-12-29 01:28:15 +01:00
Author
Owner
Copy Link

@svenstaro commented on GitHub (Oct 1, 2023):

This shouldn't get stale botted.

@svenstaro commented on GitHub (Oct 1, 2023): This shouldn't get stale botted.
adam commented 2025-12-29 01:28:15 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 31, 2023):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Dec 31, 2023): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:28:15 +01:00
Author
Owner
Copy Link

@fortitudepub commented on GitHub (Jan 15, 2024):

maybe you can use the taillock to lock you devices

@fortitudepub commented on GitHub (Jan 15, 2024): maybe you can use the taillock to lock you devices
adam commented 2025-12-29 01:28:15 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Apr 15, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Apr 15, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:28:16 +01:00
Author
Owner
Copy Link

@marek22k commented on GitHub (Apr 15, 2024):

Anti-Stale comment

@marek22k commented on GitHub (Apr 15, 2024): Anti-Stale comment
adam commented 2025-12-29 01:28:16 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jul 15, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jul 15, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:28:16 +01:00
Author
Owner
Copy Link

@marek22k commented on GitHub (Jul 15, 2024):

Bump

@marek22k commented on GitHub (Jul 15, 2024): Bump
adam commented 2025-12-29 01:28:16 +01:00
Author
Owner
Copy Link

@GalaxySnail commented on GitHub (Jul 15, 2024):

Not stale.

(Honestly, the stale bot is annoying.)

@GalaxySnail commented on GitHub (Jul 15, 2024): Not stale. (Honestly, the stale bot is annoying.)
adam commented 2025-12-29 01:28:16 +01:00
Author
Owner
Copy Link

@marek22k commented on GitHub (Jul 15, 2024):

Stale bots are always annoying!

@marek22k commented on GitHub (Jul 15, 2024): Stale bots are always annoying!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement no-stale-bot
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#395
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?