starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Cannot Set forcedTags to Empty Array via API or CLI #680

New Issue
Closed
opened 2025-12-29 02:21:59 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:21:59 +01:00
Owner
Copy Link

Originally created by @GoodiesHQ on GitHub (Mar 25, 2024).

Bug description

It does not seem to be possible to set the forcedTags to an empty array in the 0.23.0-alpha5 variant. This behavior does work in the 0.22.3 version, and I have not tried other alphas in between.

Environment

  • Headscale version 0.23.0-alpha5

This bug is server-side and is isolated to headscale and its API. Specifically, the forcedTags attribute of the Node objects. No client or node is relevant other than the fact that you need a node so it can have tags applied, but that is all. The client behaves properly. The server cannot remove all tags.

To Reproduce

Enivonrment variables:

  • APIAUTH is "Authorization: Bearer <APIKEY>" generated via headscale apikey create
  • APIURL is the API path on the domain on which headscale is hosted (https://headscale.example.com/api/v1)

I can set the tags with an array:

$ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{"tags": ["tag:ok"]}' | jq '.node.forcedTags'
[
  "tag:ok"
]

And I can overwrite the tags with a new array:

$ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{"tags": ["tag:test"]}' | jq '.node.forcedTags'
[
  "tag:test"
]

However, when I try to set it to an empty array, it does nothing and maintains the previous list of tags:

$ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{"tags": []}' | jq '.node.forcedTags' 
[
  "tag:test"
]

I also tried submitting an empty and undefined object to the same endpoint with the same results:

$ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{}' | jq '.node.forcedTags' 
[
  "tag:test"
]
$ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST | jq '.node.forcedTags' 
[
  "tag:test"
]

No other request types such as DELETE are supported, so this does not remove them either.

Logs and attachments

This is independent of the configuration. Advertised tags seem to work perfectly fine in that I can use tailscale up --advertise-tags=tag:test to advertise tags, then tailscale down to bring it down, then another tailscale up with an empty --advertise-tags= and it correctly removes them. This is only related to forcedTags.

I can't even seem to do so within the CLI:

$ headscale nodes tags -i 1 -t ''
2024-03-25T15:00:52-07:00 TRC DNS configuration loaded dns_config={"Nameservers":["1.1.1.1","1.0.0.1"],"Proxied":true,"Resolvers":[{"Addr":"1.1.1.1"},{"Addr":"1.0.0.1"}]}
Node updated

$ headscale headscale nodes list -t
2024-03-25T15:02:18-07:00 TRC DNS configuration loaded dns_config={"Nameservers":["1.1.1.1","1.0.0.1"],"Proxied":true,"Resolvers":[{"Addr":"1.1.1.1"},{"Addr":"1.0.0.1"}]}
ID | Hostname     | Name         | MachineKey | NodeKey | User | IP addresses                       | Ephemeral | Last seen           | Expiration          | Connected | Expired | ForcedTags | InvalidTags | ValidTags
1  | vm-appserver | vm-appserver | [3/8wD]    | [h/QUQ] | dln  | 100.73.0.1, fd7a:115c:a1e0:7373::1 | false     | 2024-03-25 22:01:44 | 0001-01-01 00:00:00 | online    | no      | tag:test   | tag:server  |
Originally created by @GoodiesHQ on GitHub (Mar 25, 2024). ## Bug description It does not seem to be possible to set the forcedTags to an empty array in the 0.23.0-alpha5 variant. This behavior does work in the 0.22.3 version, and I have not tried other alphas in between. ## Environment - Headscale version 0.23.0-alpha5 This bug is server-side and is isolated to headscale and its API. Specifically, the `forcedTags` attribute of the `Node` objects. No client or node is relevant other than the fact that you need a node so it can have tags applied, but that is all. The client behaves properly. The server cannot remove all tags. ## To Reproduce Enivonrment variables: - `APIAUTH` is `"Authorization: Bearer <APIKEY>"` generated via `headscale apikey create` - `APIURL` is the API path on the domain on which headscale is hosted (`https://headscale.example.com/api/v1`) I can set the tags with an array: ``` $ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{"tags": ["tag:ok"]}' | jq '.node.forcedTags' [ "tag:ok" ] ``` And I can overwrite the tags with a new array: ``` $ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{"tags": ["tag:test"]}' | jq '.node.forcedTags' [ "tag:test" ] ``` However, when I try to set it to an empty array, it does nothing and maintains the previous list of tags: ``` $ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{"tags": []}' | jq '.node.forcedTags' [ "tag:test" ] ``` I also tried submitting an empty and undefined object to the same endpoint with the same results: ``` $ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST -d '{}' | jq '.node.forcedTags' [ "tag:test" ] $ curl -s -H "${APIAUTH}" ${APIURL}/node/1/tags -X POST | jq '.node.forcedTags' [ "tag:test" ] ``` No other request types such as `DELETE` are supported, so this does not remove them either. ## Logs and attachments This is independent of the configuration. Advertised tags seem to work perfectly fine in that I can use `tailscale up --advertise-tags=tag:test` to advertise tags, then `tailscale down` to bring it down, then another `tailscale up` with an empty `--advertise-tags=` and it correctly removes them. This is only related to `forcedTags`. I can't even seem to do so within the CLI: ``` $ headscale nodes tags -i 1 -t '' 2024-03-25T15:00:52-07:00 TRC DNS configuration loaded dns_config={"Nameservers":["1.1.1.1","1.0.0.1"],"Proxied":true,"Resolvers":[{"Addr":"1.1.1.1"},{"Addr":"1.0.0.1"}]} Node updated $ headscale headscale nodes list -t 2024-03-25T15:02:18-07:00 TRC DNS configuration loaded dns_config={"Nameservers":["1.1.1.1","1.0.0.1"],"Proxied":true,"Resolvers":[{"Addr":"1.1.1.1"},{"Addr":"1.0.0.1"}]} ID | Hostname | Name | MachineKey | NodeKey | User | IP addresses | Ephemeral | Last seen | Expiration | Connected | Expired | ForcedTags | InvalidTags | ValidTags 1 | vm-appserver | vm-appserver | [3/8wD] | [h/QUQ] | dln | 100.73.0.1, fd7a:115c:a1e0:7373::1 | false | 2024-03-25 22:01:44 | 0001-01-01 00:00:00 | online | no | tag:test | tag:server | ```
adam added the buggood first issuewell described ❤️ labels 2025-12-29 02:21:59 +01:00
adam closed this issue 2025-12-29 02:21:59 +01:00
adam commented 2025-12-29 02:21:59 +01:00
Author
Owner
Copy Link

@Snuupy commented on GitHub (Apr 16, 2024):

am able to reproduce, thought I was going mad

@Snuupy commented on GitHub (Apr 16, 2024): am able to reproduce, thought I was going mad
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug good first issue well described ❤️
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#680
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?