fix: require auth for agent ws

agent/config/config.go

@@ -12,6 +12,7 @@ type Config struct {
 	TSControlURL string
 	TSAuthKey    string
 	HPControlURL string
+	HPAuthKey    string
 }
 
 const (
@@ -20,6 +21,7 @@ const (
 	TSControlURLEnv = "HP_AGENT_TS_SERVER"
 	TSAuthKeyEnv    = "HP_AGENT_TS_AUTHKEY"
 	HPControlURLEnv = "HP_AGENT_HP_SERVER"
+	HPAuthKeyEnv	= "HP_AGENT_HP_AUTHKEY"
 )
 
 // Load reads the agent configuration from environment variables.
@@ -30,6 +32,7 @@ func Load() (*Config, error) {
 		TSControlURL: os.Getenv(TSControlURLEnv),
 		TSAuthKey:    os.Getenv(TSAuthKeyEnv),
 		HPControlURL: os.Getenv(HPControlURLEnv),
+		HPAuthKey:    os.Getenv(HPAuthKeyEnv),
 	}
 
 	if os.Getenv(DebugEnv) == "true" {

agent/config/preflight.go

@@ -24,6 +24,10 @@ func validateRequired(config *Config) error {
 		return fmt.Errorf("%s is required", TSAuthKeyEnv)
 	}
 
+	if config.HPAuthKey == "" {
+		return fmt.Errorf("%s is required", HPAuthKeyEnv)
+	}
+
 	return nil
 }
 
@@ -34,6 +38,7 @@ func validateTSReady(config *Config) error {
 		testURL = testURL[:len(testURL)-1]
 	}
 
+	// TODO: Consequences of switching to /health (headscale only)
 	testURL = fmt.Sprintf("%s/key?v=109", testURL)
 	resp, err := http.Get(testURL)
 	if err != nil {