starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] failed to bind to TCP address: listen tcp 0.0.0.0:443: bind: permission denied #782

New Issue
Closed
opened 2025-12-29 02:23:57 +01:00 by adam · 4 comments
adam commented 2025-12-29 02:23:57 +01:00
Owner
Copy Link

Originally created by @tirenparo on GitHub (Aug 31, 2024).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

I'm running headscale on Alpinelinux.

rc-service headscale start logs the following on /var/log/headscale.log:

An updated version of Headscale has been found (0.23.0-beta3 vs. your current v0.22.3). Check it out https://github.com/juanfont/headscale/releases
2024-08-31T05:26:44Z INF Setting up a DERPMap update worker frequency=86400000
2024-08-31T05:26:44Z FTL github.com/juanfont/headscale/cmd/headscale/cli/server.go:26 > Error starting server error="failed to bind to TCP address: listen tcp 0.0.0.0:443: bind: permission denied"
An updated version of Headscale has been found (0.23.0-beta3 vs. your current v0.22.3). Check it out https://github.com/juanfont/headscale/releases
2024-08-31T05:26:47Z INF Setting up a DERPMap update worker frequency=86400000
2024-08-31T05:26:47Z FTL github.com/juanfont/headscale/cmd/headscale/cli/server.go:26 > Error starting server error="failed to bind to TCP address: listen tcp 0.0.0.0:443: bind: permission denied"

The only changes in my config.yaml:

server_url: http://127.0.0.1:443
listen_addr: 0.0.0.0:443

Using headscale serve doesn't hit the error.

Expected Behavior

rc-service headscale start should start the service without errors.

Steps To Reproduce

apk add headscale --repository=https://dl-cdn.alpinelinux.org/alpine/edge/testing

vi /etc/headscale/config.yaml # change port to 443 on server_url and listen_addr

rc-service headscale start

Environment

- OS: Alpinelinux x86_64
- Headscale version: 0.22.3
- Tailscale version: -

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

No response

Originally created by @tirenparo on GitHub (Aug 31, 2024). ### Is this a support request? - [X] This is not a support request ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current Behavior I'm running headscale on Alpinelinux. `rc-service headscale start` logs the following on /var/log/headscale.log: ``` An updated version of Headscale has been found (0.23.0-beta3 vs. your current v0.22.3). Check it out https://github.com/juanfont/headscale/releases 2024-08-31T05:26:44Z INF Setting up a DERPMap update worker frequency=86400000 2024-08-31T05:26:44Z FTL github.com/juanfont/headscale/cmd/headscale/cli/server.go:26 > Error starting server error="failed to bind to TCP address: listen tcp 0.0.0.0:443: bind: permission denied" An updated version of Headscale has been found (0.23.0-beta3 vs. your current v0.22.3). Check it out https://github.com/juanfont/headscale/releases 2024-08-31T05:26:47Z INF Setting up a DERPMap update worker frequency=86400000 2024-08-31T05:26:47Z FTL github.com/juanfont/headscale/cmd/headscale/cli/server.go:26 > Error starting server error="failed to bind to TCP address: listen tcp 0.0.0.0:443: bind: permission denied" ``` The only changes in my config.yaml: ```yml server_url: http://127.0.0.1:443 listen_addr: 0.0.0.0:443 ``` Using `headscale serve` doesn't hit the error. ### Expected Behavior `rc-service headscale start` should start the service without errors. ### Steps To Reproduce ``` apk add headscale --repository=https://dl-cdn.alpinelinux.org/alpine/edge/testing vi /etc/headscale/config.yaml # change port to 443 on server_url and listen_addr rc-service headscale start ``` ### Environment ```markdown - OS: Alpinelinux x86_64 - Headscale version: 0.22.3 - Tailscale version: - ``` ### Runtime environment - [ ] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Anything else? _No response_
adam added the bug label 2025-12-29 02:23:57 +01:00
adam closed this issue 2025-12-29 02:23:57 +01:00
adam commented 2025-12-29 02:23:58 +01:00
Author
Owner
Copy Link

@tirenparo commented on GitHub (Aug 31, 2024):

hi bro, to fix your trouble try this fix, i see it in another issue,

This is obviously phishing.

@tirenparo commented on GitHub (Aug 31, 2024): > hi bro, to fix your trouble try this fix, i see it in another issue, This is obviously phishing.
adam commented 2025-12-29 02:23:58 +01:00
Author
Owner
Copy Link

@juanfont commented on GitHub (Aug 31, 2024):

I have deleted both comments.

@juanfont commented on GitHub (Aug 31, 2024): I have deleted both comments.
adam commented 2025-12-29 02:23:58 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Aug 31, 2024):

This sounds like the

rc-service headscale start

Service code is ran with a user or as a process that lack the capability to bind to the ports typically requiring root etc.

Since this is packaged by the alpine people, it's out of our control, so you will need to raise it with them.

You can confirm my theory by trying to run headscale serve as root with your config

@kradalby commented on GitHub (Aug 31, 2024): This sounds like the rc-service headscale start Service code is ran with a user or as a process that lack the capability to bind to the ports typically requiring root etc. Since this is packaged by the alpine people, it's out of our control, so you will need to raise it with them. You can confirm my theory by trying to run headscale serve as root with your config
adam commented 2025-12-29 02:23:58 +01:00
Author
Owner
Copy Link

@tirenparo commented on GitHub (Sep 2, 2024):

Yes, the problem was that the rc-service is running headscale with user headscale so unprivileged ports work fine. There are several ways to workaround this, I choose to use a port forwarding rule.

doas iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-ports 8443

You can also stick to use a custom port https://your-domain:8443, use nginx or other reverse proxy, or grant low-numbered port access to the headscale process.

@tirenparo commented on GitHub (Sep 2, 2024): Yes, the problem was that the rc-service is running headscale with user `headscale` so unprivileged ports work fine. There are several ways to workaround this, I choose to use a [port forwarding rule](https://superuser.com/a/1334552). ``` doas iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-ports 8443 ``` You can also stick to use a custom port https://your-domain:8443, use nginx or other reverse proxy, or grant low-numbered port access to the headscale process.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#782
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?