Headscale: Added an option to set an Access-Control-Allow-Origin resp… #1

Jisse-Meruma · 2024-12-12T15:50:15Z

[ x ] read the CONTRIBUTING guidelines
raised a GitHub issue or discussed it on the projects chat beforehand
added unit tests
added integration tests
[ x ] updated documentation if needed
updated CHANGELOG.md

* consolidate scheduled tasks into one goroutine Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename Tailcfg dns struct Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add dns.extra_records_path option Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * prettier lint Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * go-fmt Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

yuri91

squash the commits together. other than that it looks clean to me.
Make the PR to upstream first thing on Monday (so you don't get potentially pinged on the weekend).

Fixes juanfont#2259 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

Fixes juanfont#2291 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

Jumpcloud send invalid json, so we need to handle it. Fixes juanfont#2293 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* Fix excess error message during writes Fixes juanfont#2290 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * retry filewatcher on removed files This should handled if files are deleted and added again, and for rename scenarios. Fixes juanfont#2289 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * test more write and remove in filewatcher Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

…uanfont#2306) * Correct macOS GUI connect guide because there's no ALT key on a mac * also correct macOS GUI connect in hscontrol text

…odesInUser (juanfont#2038) * Add -race flag to Makefile and integration tests; fix data race in CreateTailscaleNodesInUser * Fix data race in ExecuteCommand by using local buffers and mutex Signed-off-by: Dongjun Na <kmu5544616@gmail.com> * lint Signed-off-by: Dongjun Na <kmu5544616@gmail.com> --------- Signed-off-by: Dongjun Na <kmu5544616@gmail.com>

The referenced version is outdated (0.23.0-beta1) and seems unmaintained.

and fix some links Ref: juanfont#2304

* Describe both ways to add extra DNS records * Use "extra" instead of "custom" to align with the configuration file * Include dns.extra_records_path in the configuration file

Fixes: juanfont#2284

* Bump go crypto Closes juanfont#2281 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * upgrade tailscale Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * upgrade rest Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * nix: flake update --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* ensure valid tags is populated on user gets too Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * ensure forced tags are added Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove unused envvar in test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * debug log auth/unauth tags in policy man Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * defer shutdown in tags test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add tag test with groups Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add email, display name, picture to create user Updates juanfont#2166 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add ability to set display and email to cli Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add email to test users in integration Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix issue where tags were only assigned to email, not username Fixes juanfont#2300 Fixes juanfont#2307 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * expand principles to correct login name and if fix an issue where nodeip principles might not expand to all relevant IPs instead of taking the first in a prefix. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix ssh unit test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update cli and oauth tests for users with email Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * index by test email Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix last test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* feat: add PKCE verifier for OIDC * Update CHANGELOG.md

* set state and nounce in oidc to prevent csrf Fixes juanfont#2276 * try to fix new postgres issue Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

The official iOS app now has a simpler login process for custom instances, directly within the app.

)

* correct changelog date Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update docs version and copyright Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix deprecated goreleaser key and DRY Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

…oviders (juanfont#2364) * relax user validation to allow emails, add tests from various oidc providers Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* make it harder to insert invalid routes Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * dont panic if node is not available for route Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* fix postgres migration issue with 0.24 Fixes juanfont#2351 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add postgres migration test for 2351 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* fix panic if derp update is 0 Fixes juanfont#2362 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* update users doc on unique constraints Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * simplify finduser func Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add initial tests for findUserFromToken Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

The routes table has a NOT NULL constraint on node_id. Fixes: juanfont#2376

* clean up handler methods, common logging Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * streamline http.Error calls Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* initial capver packet tracking version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * Log the minimum version as client version, not only capver Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove old versions Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use capver for integration tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * patch through m and n key Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

…onse header to enable Cross-Origin Resource Sharing (CORS)

… enable cors for specific endpoints (#2)

Jisse-Meruma requested a review from yuri91 December 12, 2024 15:50

kradalby added 2 commits December 13, 2024 07:52

update oidc part of changelog for 0.24.0 (juanfont#2285)

76d26a7

yuri91 requested changes Dec 13, 2024

View reviewed changes

Jisse-Meruma force-pushed the enable-cors-with-config branch from 2c2085a to 39bd024 Compare December 13, 2024 14:22

Jisse-Meruma added bug Something isn't working and removed bug Something isn't working labels Dec 13, 2024

kradalby and others added 3 commits December 13, 2024 20:15

fix deletion of exit routes without nodes (juanfont#2286)

58d089c

Fixes juanfont#2259 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

flake.lock: Update (juanfont#2294)

e00b9d9

fix sighup issue with empty acl (juanfont#2296)

ec8729b

Fixes juanfont#2291 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

Jisse-Meruma requested a review from yuri91 December 16, 2024 09:24

yuri91 approved these changes Dec 16, 2024

View reviewed changes

kradalby added 2 commits December 16, 2024 11:26

fix issue where some oidc claim bools are sent as string (juanfont#2297)

5345f19

Jumpcloud send invalid json, so we need to handle it. Fixes juanfont#2293 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

Jisse-Meruma force-pushed the enable-cors-with-config branch from 39bd024 to 4183039 Compare December 16, 2024 11:02

showier-drastic and others added 9 commits December 17, 2024 12:11

Correct macOS GUI connect guide because there's no ALT key on a mac (j…

7d937c6

…uanfont#2306) * Correct macOS GUI connect guide because there's no ALT key on a mac * also correct macOS GUI connect in hscontrol text

Remove sealos documentation

65304a0

The referenced version is outdated (0.23.0-beta1) and seems unmaintained.

Changelog: support client verify for DERP

47b405d

and fix some links Ref: juanfont#2304

Update DNS documentation for dns.extra_records_path

319ce67

* Describe both ways to add extra DNS records * Use "extra" instead of "custom" to align with the configuration file * Include dns.extra_records_path in the configuration file

Mention reload and SIGHUP when editing the ACL policy file

3269cfd

Fixes: juanfont#2284

Misc doc updates

0acb2b5

Set title for code listings

bbc93a9

Jisse-Meruma force-pushed the enable-cors-with-config branch 2 times, most recently from e07c42b to dfad6a1 Compare December 18, 2024 16:27

kradalby and others added 4 commits December 19, 2024 13:10

flake.lock: Update (juanfont#2313)

9313e5b

feat: Add PKCE Verifier for OIDC (juanfont#2314)

b81420b

* feat: add PKCE verifier for OIDC * Update CHANGELOG.md

flake.lock: Update (juanfont#2320)

f9bbfa5

github-actions bot and others added 24 commits January 5, 2025 07:35

flake.lock: Update (juanfont#2324)

41bad2b

Set CSRF cookies for OIDC (juanfont#2328)

fa641e3

* set state and nounce in oidc to prevent csrf Fixes juanfont#2276 * try to fix new postgres issue Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

Fix typos

ede4f97

flake.lock: Update (juanfont#2342)

610597b

Update apple.md for latest version of iOS (juanfont#2321)

1ab7b31

The official iOS app now has a simpler login process for custom instances, directly within the app.

allow @ and Log if OIDC username is not consider valid (juanfont#2340)

38aef77

fix nil pointer deref (juanfont#2339)

caad5c6

use headscale server url as domain instead of base_domain (juanfont#2338

e4a3dcc

)

set changelog date (juanfont#2347)

e88406e

set oidc.map_legacy_users false (juanfont#2350)

5b986ed

flake.lock: Update (juanfont#2353)

aa76980

flake.lock: Update (juanfont#2378)

97e5d95

use dedicated registration ID for auth flow (juanfont#2337)

4c8e847

create and rename usernames validated by new func (juanfont#2381)

2c279e0

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

Remove routes without a node_id (juanfont#2386)

f44b1d3

The routes table has a NOT NULL constraint on node_id. Fixes: juanfont#2376

Headscale: Added an option to set an Access-Control-Allow-Origin resp…

68ce697

…onse header to enable Cross-Origin Resource Sharing (CORS)

Jisse-Meruma force-pushed the enable-cors-with-config branch from dfad6a1 to 68ce697 Compare February 5, 2025 11:08

Block ability to use '*'. replace origins string to a list to config.…

cbf6a43

… enable cors for specific endpoints (#2)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Headscale: Added an option to set an Access-Control-Allow-Origin resp… #1

Headscale: Added an option to set an Access-Control-Allow-Origin resp… #1

Jisse-Meruma commented Dec 12, 2024

yuri91 left a comment

Headscale: Added an option to set an Access-Control-Allow-Origin resp… #1

Are you sure you want to change the base?

Headscale: Added an option to set an Access-Control-Allow-Origin resp… #1

Conversation

Jisse-Meruma commented Dec 12, 2024

yuri91 left a comment

Choose a reason for hiding this comment