#2176 Added support a manual approval new nodes

.github/workflows/test-integration.yaml

@@ -19,6 +19,7 @@ jobs:
           - TestACLNamedHostsCanReach
           - TestACLDevice1CanAccessDevice2
           - TestPolicyUpdateWhileRunningWithCLIInDatabase
+          - TestAuthNodeApproval
           - TestOIDCAuthenticationPingAll
           - TestOIDCExpireNodesBasedOnTokenExpiry
           - TestAuthWebFlowAuthenticationPingAll
@@ -27,12 +28,14 @@ jobs:
           - TestPreAuthKeyCommand
           - TestPreAuthKeyCommandWithoutExpiry
           - TestPreAuthKeyCommandReusableEphemeral
+          - TestPreAuthKeyCommandPreApproved
           - TestPreAuthKeyCorrectUserLoggedInCommand
           - TestApiKeyCommand
           - TestNodeTagCommand
           - TestNodeAdvertiseTagNoACLCommand
           - TestNodeAdvertiseTagWithACLCommand
           - TestNodeCommand
+          - TestNodeApproveCommand
           - TestNodeExpireCommand
           - TestNodeRenameCommand
           - TestNodeMoveCommand

CHANGELOG.md

@@ -19,7 +19,7 @@
 
 - Improved compatibilty of built-in DERP server with clients connecting over WebSocket.
 - Allow nodes to use SSH agent forwarding [#2145](https://github.com/juanfont/headscale/pull/2145)
-
+- Added manual approval of nodes in the network
 
 ## 0.23.0 (2024-09-18)
 

cmd/headscale/cli/nodes.go

@@ -48,6 +48,13 @@ func init() {
 	}
 	nodeCmd.AddCommand(registerNodeCmd)
 
+	approveNodeCmd.Flags().Uint64P("identifier", "i", 0, "Node identifier (ID)")
+	err = approveNodeCmd.MarkFlagRequired("identifier")
+	if err != nil {
+		log.Fatalf(err.Error())
+	}
+	nodeCmd.AddCommand(approveNodeCmd)
+
 	expireNodeCmd.Flags().Uint64P("identifier", "i", 0, "Node identifier (ID)")
 	err = expireNodeCmd.MarkFlagRequired("identifier")
 	if err != nil {
@@ -206,6 +213,43 @@ var listNodesCmd = &cobra.Command{
 	},
 }
 
+var approveNodeCmd = &cobra.Command{
+	Use:     "approve",
+	Short:   "Approve a node in your network",
+	Aliases: []string{"a"},
+	Run: func(cmd *cobra.Command, args []string) {
+		output, _ := cmd.Flags().GetString("output")
+		identifier, err := cmd.Flags().GetUint64("identifier")
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error converting ID to integer: %s", err),
+				output,
+			)
+			return
+		}
+		ctx, client, conn, cancel := newHeadscaleCLIWithConfig()
+		defer cancel()
+		defer conn.Close()
+		request := &v1.ApproveNodeRequest{
+			NodeId: identifier,
+		}
+		response, err := client.ApproveNode(ctx, request)
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf(
+					"Cannot expire node: %s\n",
+					status.Convert(err).Message(),
+				),
+				output,
+			)
+			return
+		}
+		SuccessOutput(response.GetNode(), "Node approved", output)
+	},
+}
+
 var expireNodeCmd = &cobra.Command{
 	Use:     "expire",
 	Short:   "Expire (log out) a node in your network",
@@ -529,6 +573,7 @@ func nodesToPtables(
 		"Ephemeral",
 		"Last seen",
 		"Expiration",
+		"Approved",
 		"Connected",
 		"Expired",
 	}
@@ -554,6 +599,13 @@ func nodesToPtables(
 			lastSeenTime = lastSeen.Format("2006-01-02 15:04:05")
 		}
 
+		var approved string
+		if node.GetApproved() {
+			approved = pterm.LightGreen("yes")
+		} else {
+			approved = pterm.LightRed("no")
+		}
+
 		var expiry time.Time
 		var expiryTime string
 		if node.GetExpiry() != nil {
@@ -642,6 +694,7 @@ func nodesToPtables(
 			strconv.FormatBool(ephemeral),
 			lastSeenTime,
 			expiryTime,
+			approved,
 			online,
 			expired,
 		}

cmd/headscale/cli/preauthkeys.go

@@ -38,6 +38,8 @@ func init() {
 		Bool("reusable", false, "Make the preauthkey reusable")
 	createPreAuthKeyCmd.PersistentFlags().
 		Bool("ephemeral", false, "Preauthkey for ephemeral nodes")
+	createPreAuthKeyCmd.PersistentFlags().
+		Bool("pre-approved", false, "Make the preauthkey with node pre-approval")
 	createPreAuthKeyCmd.Flags().
 		StringP("expiration", "e", DefaultPreAuthKeyExpiry, "Human-readable expiration of the key (e.g. 30m, 24h)")
 	createPreAuthKeyCmd.Flags().
@@ -91,6 +93,7 @@ var listPreAuthKeys = &cobra.Command{
 				"Key",
 				"Reusable",
 				"Ephemeral",
+				"Pre-Approved",
 				"Used",
 				"Expiration",
 				"Created",
@@ -116,6 +119,7 @@ var listPreAuthKeys = &cobra.Command{
 				key.GetKey(),
 				strconv.FormatBool(key.GetReusable()),
 				strconv.FormatBool(key.GetEphemeral()),
+				strconv.FormatBool(key.GetPreApproved()),
 				strconv.FormatBool(key.GetUsed()),
 				expiration,
 				key.GetCreatedAt().AsTime().Format("2006-01-02 15:04:05"),
@@ -148,13 +152,15 @@ var createPreAuthKeyCmd = &cobra.Command{
 
 		reusable, _ := cmd.Flags().GetBool("reusable")
 		ephemeral, _ := cmd.Flags().GetBool("ephemeral")
+		preApproved, _ := cmd.Flags().GetBool("pre-approved")
 		tags, _ := cmd.Flags().GetStringSlice("tags")
 
 		request := &v1.CreatePreAuthKeyRequest{
-			User:      user,
-			Reusable:  reusable,
-			Ephemeral: ephemeral,
-			AclTags:   tags,
+			User:        user,
+			Reusable:    reusable,
+			Ephemeral:   ephemeral,
+			PreApproved: preApproved,
+			AclTags:     tags,
 		}
 
 		durationStr, _ := cmd.Flags().GetString("expiration")

cmd/headscale/headscale_test.go

@@ -111,4 +111,5 @@ func (*Suite) TestConfigLoading(c *check.C) {
 	)
 	c.Assert(viper.GetBool("logtail.enabled"), check.Equals, false)
 	c.Assert(viper.GetBool("randomize_client_port"), check.Equals, false)
+	c.Assert(viper.GetBool("node_management.manual_approve_new_node"), check.Equals, false)
 }

config-example.yaml

@@ -384,3 +384,9 @@ logtail:
 # default static port 41641. This option is intended as a workaround for some buggy
 # firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.
 randomize_client_port: false
+
+# Node management
+# See https://tailscale.com/kb/1099/device-approval for more information.
+node_management:
+  # Require new nodes to be approved by admins before they can access the network.
+  manual_approve_new_node: false

docs/node-management.md

@@ -0,0 +1,38 @@
+# Node management
+
+See https://tailscale.com/kb/1099/device-approval for more information.
+
+## Setup
+
+### 1. Change the configuration
+
+1. Change the `config.yaml` to contain the desired records like so:
+
+   ```yaml
+   node_management:
+     manual_approve_new_node: true
+   ```
+
+2. Restart your headscale instance.
+
+## Usage
+
+### Pre-approve a node using preauthkeys
+
+1. Create preauthkey with a pre-approve option
+
+```bash
+headscale preauthkeys create --user=<USER_NAME> --pre-approved
+```
+
+2. Register a node on the headscale using preauthkey (with the pre-approval option enabled)
+
+```bash
+headscale nodes register --user=<USER_NAME> --mkey=mkey:<MACHINE_KEY> --auth-key=<PREAUTHKEY_PRE_APPROVED>
+```
+
+### Approve a node after registration without the pre-authkey pre-approval option
+
+```bash
+headscale nodes approve --identifier=<NODE_ID>
+```