starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Request for Configuration of --verify-clients Parameter in Built-in DERP #674

New Issue
Closed
opened 2025-12-29 02:21:53 +01:00 by adam · 13 comments
adam commented 2025-12-29 02:21:53 +01:00
Owner
Copy Link

Originally created by @zsio on GitHub (Mar 18, 2024).

I am currently using the built-in DERP in Headscale and I noticed that the --verify-clients parameter is not configurable. This situation implies that the DERP I am using could be publicly accessible, which raises security concerns.

I am writing to inquire if there is a possibility to restrict the use of the built-in DERP to my clients only. This feature will greatly enhance the security of my connections and ensure that only authorized clients can use the DERP.

Looking forward to your response and potential solutions to this issue.

Originally created by @zsio on GitHub (Mar 18, 2024). I am currently using the built-in DERP in Headscale and I noticed that the --verify-clients parameter is not configurable. This situation implies that the DERP I am using could be publicly accessible, which raises security concerns. I am writing to inquire if there is a possibility to restrict the use of the built-in DERP to my clients only. This feature will greatly enhance the security of my connections and ensure that only authorized clients can use the DERP. Looking forward to your response and potential solutions to this issue.
adam added the enhancementno-stale-bot labels 2025-12-29 02:21:53 +01:00
adam closed this issue 2025-12-29 02:21:53 +01:00
adam commented 2025-12-29 02:21:54 +01:00
Author
Owner
Copy Link

@StudyingLover commented on GitHub (Mar 21, 2024):

I am considering migrating from Tailscale to Headscale, but I hesitated when I suddenly notice this issue because I cannot tolerate others freeloading on my server without my permission.

@StudyingLover commented on GitHub (Mar 21, 2024): I am considering migrating from Tailscale to Headscale, but I hesitated when I suddenly notice this issue because I cannot tolerate others freeloading on my server without my permission.
adam commented 2025-12-29 02:21:54 +01:00
Author
Owner
Copy Link

@masterwishx commented on GitHub (Mar 23, 2024):

Also interested in this future as using my own DERP server...

@masterwishx commented on GitHub (Mar 23, 2024): Also interested in this future as using my own DERP server...
adam commented 2025-12-29 02:21:55 +01:00
Author
Owner
Copy Link

@ShadowJonathan commented on GitHub (Mar 28, 2024):

When researching tailscale I noticed this fairly subtle codepath being used for it, it requires an active embedded tailscale client to be sending peer updates to the derp server, apparantly.

@ShadowJonathan commented on GitHub (Mar 28, 2024): When researching tailscale I noticed this fairly subtle codepath being used for it, it requires an active embedded tailscale client to be sending peer updates to the derp server, apparantly.
adam commented 2025-12-29 02:21:55 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jun 27, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jun 27, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:21:55 +01:00
Author
Owner
Copy Link

@ShadowJonathan commented on GitHub (Jun 27, 2024):

No.

https://nostalebots.xyz/

@ShadowJonathan commented on GitHub (Jun 27, 2024): No. https://nostalebots.xyz/
adam commented 2025-12-29 02:21:55 +01:00
Author
Owner
Copy Link

@zsio commented on GitHub (Aug 16, 2024):

I would like to inquire if there is any new progress on this issue? This version hasn't been updated for more than a year. Will this problem be improved in the upcoming release?

@zsio commented on GitHub (Aug 16, 2024): I would like to inquire if there is any new progress on this issue? This version hasn't been updated for more than a year. Will this problem be improved in the upcoming release?
adam commented 2025-12-29 02:21:56 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Aug 16, 2024):

There are pull requests open, but we dont have the capacity to review and take in the amount of code for this release. I will try to review if to for the next cycle, but not sure if it will be included.

@kradalby commented on GitHub (Aug 16, 2024): There are pull requests open, but we dont have the capacity to review and take in the amount of code for this release. I will try to review if to for the next cycle, but not sure if it will be included.
adam commented 2025-12-29 02:21:56 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 27, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Dec 27, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:21:56 +01:00
Author
Owner
Copy Link

@zsio commented on GitHub (Dec 27, 2024):

No.

https://nostalebots.xyz/

@zsio commented on GitHub (Dec 27, 2024): No. https://nostalebots.xyz/
adam commented 2025-12-29 02:21:56 +01:00
Author
Owner
Copy Link

@Codelica commented on GitHub (Jan 23, 2025):

Since --verify-client-url seems to have made it in (#2046) will there be config to restrict the embedded DERP server explicitly or by default?

@Codelica commented on GitHub (Jan 23, 2025): Since `--verify-client-url` seems to have made it in (#2046) will there be config to restrict the embedded DERP server explicitly or by default?
adam commented 2025-12-29 02:21:56 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Jan 23, 2025):

I think what you are waiting for is https://github.com/juanfont/headscale/pull/2260, I need to circle back and check why that staled.

@kradalby commented on GitHub (Jan 23, 2025): I think what you are waiting for is https://github.com/juanfont/headscale/pull/2260, I need to circle back and check why that staled.
adam commented 2025-12-29 02:21:56 +01:00
Author
Owner
Copy Link

@hrvylein commented on GitHub (Apr 8, 2025):

any eta when this will be implemented?

@hrvylein commented on GitHub (Apr 8, 2025): any eta when this will be implemented?
adam commented 2025-12-29 02:21:57 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Aug 14, 2025):

This was merged into main as d325211617 and will be part of 0.27.0.

The related configuration setting is derp.server.verify_clients:

30cec3aa2b/config-example.yaml (L88-L89)

@nblock commented on GitHub (Aug 14, 2025): This was merged into main as https://github.com/juanfont/headscale/commit/d325211617d484bd5bfda3207decf4a7ad3c1a28 and will be part of 0.27.0. The related configuration setting is `derp.server.verify_clients`: https://github.com/juanfont/headscale/blob/30cec3aa2b422a9d8184e47a747598fbe2f9f569/config-example.yaml#L88-L89
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement no-stale-bot
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#674
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?