mirror of
https://github.com/tale/headplane.git
synced 2026-08-21 02:06:37 +00:00
feat: use strictly typed configs and context
This commit is contained in:
Aarnav Tale
@@ -1,353 +0,0 @@
|
||||
import { type Document, parse, parseDocument } from 'yaml'
|
||||
import { type FSWatcher, watch } from 'node:fs'
|
||||
import { access, constants, readFile, writeFile } from 'node:fs/promises'
|
||||
import { resolve } from 'node:path'
|
||||
|
||||
type Duration = `${string}s` | `${string}h` | `${string}m` | `${string}d` | `${string}y`
|
||||
|
||||
interface Config {
|
||||
server_url: string
|
||||
listen_addr: string
|
||||
metrics_listen_addr: string
|
||||
grpc_listen_addr: string
|
||||
grpc_allow_insecure: boolean
|
||||
|
||||
private_key_path: string
|
||||
noise: {
|
||||
private_key_path: string
|
||||
}
|
||||
|
||||
prefixes: {
|
||||
v4: string
|
||||
v6: string
|
||||
}
|
||||
|
||||
derp: {
|
||||
server: {
|
||||
enabled: boolean
|
||||
region_id: number
|
||||
region_code: string
|
||||
region_name: string
|
||||
stun_listen_addr: string
|
||||
}
|
||||
|
||||
urls: string[]
|
||||
paths: string[]
|
||||
auto_update_enabled: boolean
|
||||
update_frequency: Duration
|
||||
}
|
||||
|
||||
disable_check_updates: boolean
|
||||
epheremal_node_inactivity_timeout: Duration
|
||||
node_update_check_interval: Duration
|
||||
|
||||
// Database is probably dangerous
|
||||
database: {
|
||||
type: 'sqlite3' | 'sqlite' | 'postgres'
|
||||
sqlite?: {
|
||||
path: string
|
||||
}
|
||||
|
||||
postgres?: {
|
||||
host: string
|
||||
port: number
|
||||
name: string
|
||||
user: string
|
||||
pass: string
|
||||
max_open_conns: number
|
||||
max_idle_conns: number
|
||||
conn_max_idle_time_secs: number
|
||||
ssl: boolean
|
||||
}
|
||||
}
|
||||
|
||||
acme_url: string
|
||||
acme_email: string
|
||||
tls_letsencrypt_hostname: string
|
||||
tls_letsencrypt_cache_dir: string
|
||||
tls_letsencrypt_challenge_type: string
|
||||
tls_letsencrypt_listen: string
|
||||
tls_cert_path: string
|
||||
tls_key_path: string
|
||||
|
||||
log: {
|
||||
format: 'text' | 'json'
|
||||
level: string
|
||||
}
|
||||
|
||||
acl_policy_path: string
|
||||
dns_config: {
|
||||
override_local_dns: boolean
|
||||
nameservers: string[]
|
||||
restricted_nameservers: Record<string, string[]> // Split DNS
|
||||
domains: string[]
|
||||
extra_records: {
|
||||
name: string
|
||||
type: 'A'
|
||||
value: string
|
||||
}[]
|
||||
|
||||
magic_dns: boolean
|
||||
base_domain: string
|
||||
}
|
||||
|
||||
unix_socket: string
|
||||
unix_socket_permission: string
|
||||
|
||||
oidc: {
|
||||
only_start_if_oidc_is_available: boolean
|
||||
issuer: string
|
||||
client_id: string
|
||||
client_secret: string
|
||||
expiry: Duration
|
||||
use_expiry_from_token: boolean
|
||||
scope: string[]
|
||||
extra_params: Record<string, string>
|
||||
|
||||
allowed_domains: string[]
|
||||
allowed_groups: string[]
|
||||
allowed_users: string[]
|
||||
|
||||
strip_email_domain: boolean
|
||||
}
|
||||
|
||||
logtail: {
|
||||
enabled: boolean
|
||||
}
|
||||
|
||||
randomize_client_port: boolean
|
||||
}
|
||||
|
||||
let config: Document
|
||||
|
||||
export async function getConfig(force = false) {
|
||||
if (!config || force) {
|
||||
const path = resolve(process.env.CONFIG_FILE ?? '/etc/headscale/config.yaml')
|
||||
const data = await readFile(path, 'utf8')
|
||||
config = parseDocument(data)
|
||||
}
|
||||
|
||||
return config.toJSON() as Config
|
||||
}
|
||||
|
||||
export async function getAcl() {
|
||||
let path = process.env.ACL_FILE
|
||||
if (!path) {
|
||||
try {
|
||||
const config = await getConfig()
|
||||
path = config.acl_policy_path
|
||||
} catch {}
|
||||
}
|
||||
|
||||
if (!path) {
|
||||
return { data: '', type: 'json' }
|
||||
}
|
||||
|
||||
const data = await readFile(path, 'utf8')
|
||||
|
||||
// Naive check for YAML over JSON
|
||||
// This is because JSON.parse doesn't support comments
|
||||
try {
|
||||
parse(data)
|
||||
return { data, type: 'yaml' }
|
||||
} catch {
|
||||
return { data, type: 'json' }
|
||||
}
|
||||
}
|
||||
|
||||
// This is so obscenely dangerous, please have a check around it
|
||||
export async function patchConfig(partial: Record<string, unknown>) {
|
||||
for (const [key, value] of Object.entries(partial)) {
|
||||
config.setIn(key.split('.'), value)
|
||||
}
|
||||
|
||||
const path = resolve(process.env.CONFIG_FILE ?? '/etc/headscale/config.yaml')
|
||||
await writeFile(path, config.toString(), 'utf8')
|
||||
}
|
||||
|
||||
export async function patchAcl(data: string) {
|
||||
let path = process.env.ACL_FILE
|
||||
if (!path) {
|
||||
try {
|
||||
const config = await getConfig()
|
||||
path = config.acl_policy_path
|
||||
} catch {}
|
||||
}
|
||||
|
||||
if (!path) {
|
||||
throw new Error('No ACL file defined')
|
||||
}
|
||||
|
||||
await writeFile(path, data, 'utf8')
|
||||
}
|
||||
|
||||
let watcher: FSWatcher
|
||||
|
||||
export function registerConfigWatcher() {
|
||||
if (watcher) {
|
||||
return
|
||||
}
|
||||
|
||||
const path = resolve(process.env.CONFIG_FILE ?? '/etc/headscale/config.yaml')
|
||||
watcher = watch(path, async () => {
|
||||
console.log('Config file changed, reloading')
|
||||
await getConfig(true)
|
||||
})
|
||||
}
|
||||
|
||||
export interface Context {
|
||||
hasDockerSock: boolean
|
||||
hasConfig: boolean
|
||||
hasConfigWrite: boolean
|
||||
hasAcl: boolean
|
||||
hasAclWrite: boolean
|
||||
headscaleUrl: string
|
||||
oidcConfig?: {
|
||||
issuer: string
|
||||
client: string
|
||||
secret: string
|
||||
}
|
||||
}
|
||||
|
||||
export let context: Context
|
||||
|
||||
export async function getContext() {
|
||||
if (!context) {
|
||||
context = {
|
||||
hasDockerSock: await checkSock(),
|
||||
hasConfig: await hasConfig(),
|
||||
hasConfigWrite: await hasConfigW(),
|
||||
hasAcl: await hasAcl(),
|
||||
hasAclWrite: await hasAclW(),
|
||||
headscaleUrl: await getHeadscaleUrl(),
|
||||
oidcConfig: await getOidcConfig(),
|
||||
}
|
||||
}
|
||||
|
||||
return context
|
||||
}
|
||||
|
||||
async function getOidcConfig() {
|
||||
// Check for the OIDC environment variables first
|
||||
let issuer = process.env.OIDC_ISSUER
|
||||
let client = process.env.OIDC_CLIENT_ID
|
||||
let secret = process.env.OIDC_CLIENT_SECRET
|
||||
const rootKey = process.env.API_KEY
|
||||
|
||||
if (!issuer || !client || !secret) {
|
||||
const config = await getConfig()
|
||||
issuer = config.oidc.issuer
|
||||
client = config.oidc.client_id
|
||||
secret = config.oidc.client_secret
|
||||
}
|
||||
|
||||
// If atleast one is defined but not all 3, throw an error
|
||||
if ((issuer || client || secret) && !(issuer && client && secret)) {
|
||||
throw new Error('OIDC configuration is incomplete')
|
||||
}
|
||||
|
||||
if (!issuer || !client || !secret) {
|
||||
return
|
||||
}
|
||||
|
||||
if (!rootKey) {
|
||||
throw new Error('Cannot use OIDC without the root API_KEY variable set')
|
||||
}
|
||||
|
||||
return { issuer, client, secret }
|
||||
}
|
||||
|
||||
async function getHeadscaleUrl() {
|
||||
if (process.env.HEADSCALE_URL) {
|
||||
return process.env.HEADSCALE_URL
|
||||
}
|
||||
|
||||
try {
|
||||
const config = await getConfig()
|
||||
if (config.server_url) {
|
||||
return config.server_url
|
||||
}
|
||||
} catch {}
|
||||
|
||||
return ''
|
||||
}
|
||||
|
||||
async function checkSock() {
|
||||
try {
|
||||
await access('/var/run/docker.sock', constants.R_OK)
|
||||
return true
|
||||
} catch {}
|
||||
|
||||
if (!process.env.HEADSCALE_CONTAINER) {
|
||||
return false
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
async function hasConfig() {
|
||||
try {
|
||||
await getConfig()
|
||||
return true
|
||||
} catch {}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
async function hasConfigW() {
|
||||
const path = resolve(process.env.CONFIG_FILE ?? '/etc/headscale/config.yaml')
|
||||
try {
|
||||
await access(path, constants.W_OK)
|
||||
return true
|
||||
} catch {}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
async function hasAcl() {
|
||||
let path = process.env.ACL_FILE
|
||||
if (!path) {
|
||||
try {
|
||||
const config = await getConfig()
|
||||
path = config.acl_policy_path
|
||||
} catch {}
|
||||
}
|
||||
|
||||
if (!path) {
|
||||
return false
|
||||
}
|
||||
|
||||
try {
|
||||
path = resolve(path)
|
||||
await access(path, constants.R_OK)
|
||||
return true
|
||||
} catch (error) {
|
||||
console.log('Cannot acquire read access to ACL file', error)
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
async function hasAclW() {
|
||||
let path = process.env.ACL_FILE
|
||||
if (!path) {
|
||||
try {
|
||||
const config = await getConfig()
|
||||
path = config.acl_policy_path
|
||||
} catch {}
|
||||
}
|
||||
|
||||
if (!path) {
|
||||
return false
|
||||
}
|
||||
|
||||
try {
|
||||
path = resolve(path)
|
||||
await access(path, constants.W_OK)
|
||||
return true
|
||||
} catch (error) {
|
||||
console.log('Cannot acquire read access to ACL file', error)
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
@@ -0,0 +1,240 @@
|
||||
// Handle the configuration loading for headplane.
|
||||
// Functionally only used for all sorts of sanity checks across headplane.
|
||||
//
|
||||
// Around the codebase, this is referred to as the context
|
||||
|
||||
import { access, constants, readFile, writeFile } from 'node:fs/promises'
|
||||
import { resolve } from 'node:path'
|
||||
|
||||
import { parse } from 'yaml'
|
||||
|
||||
import { HeadscaleConfig, loadConfig } from './headscale'
|
||||
|
||||
export interface HeadplaneContext {
|
||||
headscaleUrl: string
|
||||
cookieSecret: string
|
||||
|
||||
config: {
|
||||
read: boolean
|
||||
write: boolean
|
||||
}
|
||||
|
||||
acl: {
|
||||
read: boolean
|
||||
write: boolean
|
||||
}
|
||||
|
||||
docker?: {
|
||||
sock: string
|
||||
container: string
|
||||
}
|
||||
|
||||
oidc?: {
|
||||
issuer: string
|
||||
client: string
|
||||
secret: string
|
||||
rootKey: string
|
||||
disableKeyLogin: boolean
|
||||
}
|
||||
}
|
||||
|
||||
let context: HeadplaneContext | undefined
|
||||
|
||||
export async function loadContext(): Promise<HeadplaneContext> {
|
||||
if (context) {
|
||||
return context
|
||||
}
|
||||
|
||||
let config: HeadscaleConfig | undefined
|
||||
try {
|
||||
config = await loadConfig()
|
||||
} catch {}
|
||||
|
||||
const path = resolve(process.env.CONFIG_FILE ?? '/etc/headscale/config.yaml')
|
||||
|
||||
let headscaleUrl = process.env.HEADSCALE_URL
|
||||
if (!headscaleUrl && !config) {
|
||||
throw new Error('HEADSCALE_URL not set')
|
||||
}
|
||||
|
||||
if (config) {
|
||||
headscaleUrl = headscaleUrl ?? config.server_url
|
||||
}
|
||||
|
||||
if (!headscaleUrl) {
|
||||
throw new Error('Missing server_url in headscale config')
|
||||
}
|
||||
|
||||
const cookieSecret = process.env.COOKIE_SECRET
|
||||
if (!cookieSecret) {
|
||||
throw new Error('COOKIE_SECRET not set')
|
||||
}
|
||||
|
||||
context = {
|
||||
headscaleUrl,
|
||||
cookieSecret,
|
||||
config: await checkConfig(path, config),
|
||||
acl: await checkAcl(config),
|
||||
docker: await checkDocker(),
|
||||
oidc: await checkOidc(config),
|
||||
}
|
||||
|
||||
console.log('Context loaded:', context)
|
||||
return context
|
||||
}
|
||||
|
||||
export async function loadAcl() {
|
||||
let path = process.env.ACL_FILE
|
||||
if (!path) {
|
||||
try {
|
||||
const config = await loadConfig()
|
||||
path = config.acl_policy_path
|
||||
} catch {}
|
||||
}
|
||||
|
||||
if (!path) {
|
||||
return { data: '', type: 'json' }
|
||||
}
|
||||
|
||||
const data = await readFile(path, 'utf8')
|
||||
|
||||
// Naive check for YAML over JSON
|
||||
// This is because JSON.parse doesn't support comments
|
||||
try {
|
||||
parse(data)
|
||||
return { data, type: 'yaml' }
|
||||
} catch {
|
||||
return { data, type: 'json' }
|
||||
}
|
||||
}
|
||||
|
||||
export async function patchAcl(data: string) {
|
||||
let path = process.env.ACL_FILE
|
||||
if (!path) {
|
||||
try {
|
||||
const config = await loadConfig()
|
||||
path = config.acl_policy_path
|
||||
} catch {}
|
||||
}
|
||||
|
||||
if (!path) {
|
||||
throw new Error('No ACL file defined')
|
||||
}
|
||||
|
||||
await writeFile(path, data, 'utf8')
|
||||
}
|
||||
|
||||
async function checkConfig(path: string, config?: HeadscaleConfig) {
|
||||
let write = false
|
||||
try {
|
||||
await access(path, constants.W_OK)
|
||||
write = true
|
||||
} catch {}
|
||||
|
||||
return {
|
||||
read: config ? true : false,
|
||||
write,
|
||||
}
|
||||
}
|
||||
|
||||
async function checkAcl(config?: HeadscaleConfig) {
|
||||
let path = process.env.ACL_FILE
|
||||
if (!path && config) {
|
||||
path = config.acl_policy_path
|
||||
}
|
||||
|
||||
let read = false
|
||||
let write = false
|
||||
if (path) {
|
||||
try {
|
||||
await access(path, constants.R_OK)
|
||||
read = true
|
||||
} catch {}
|
||||
|
||||
try {
|
||||
await access(path, constants.W_OK)
|
||||
write = true
|
||||
} catch {}
|
||||
}
|
||||
|
||||
return {
|
||||
read,
|
||||
write,
|
||||
}
|
||||
}
|
||||
|
||||
async function checkDocker() {
|
||||
const path = process.env.DOCKER_SOCK ?? '/var/run/docker.sock'
|
||||
try {
|
||||
await access(path, constants.R_OK)
|
||||
} catch {
|
||||
return
|
||||
}
|
||||
|
||||
if (!process.env.HEADSCALE_CONTAINER) {
|
||||
return
|
||||
}
|
||||
|
||||
return {
|
||||
sock: path,
|
||||
container: process.env.HEADSCALE_CONTAINER,
|
||||
}
|
||||
}
|
||||
|
||||
async function checkOidc(config?: HeadscaleConfig) {
|
||||
const disableKeyLogin = process.env.DISABLE_API_KEY_LOGIN === 'true'
|
||||
const rootKey = process.env.ROOT_API_KEY ?? process.env.API_KEY
|
||||
if (!rootKey) {
|
||||
throw new Error('ROOT_API_KEY or API_KEY not set')
|
||||
}
|
||||
|
||||
let issuer = process.env.OIDC_ISSUER
|
||||
let client = process.env.OIDC_CLIENT_ID
|
||||
let secret = process.env.OIDC_CLIENT_SECRET
|
||||
|
||||
if (
|
||||
(issuer ?? client ?? secret)
|
||||
&& !(issuer && client && secret)
|
||||
&& !config
|
||||
) {
|
||||
throw new Error('OIDC environment variables are incomplete')
|
||||
}
|
||||
|
||||
if ((!issuer || !client || !secret) && config) {
|
||||
issuer = config.oidc?.issuer
|
||||
client = config.oidc?.client_id
|
||||
secret = config.oidc?.client_secret
|
||||
|
||||
if (!secret && config.oidc?.client_secret_path) {
|
||||
try {
|
||||
const data = await readFile(
|
||||
config.oidc.client_secret_path,
|
||||
'utf8',
|
||||
)
|
||||
|
||||
if (data && data.length > 0) {
|
||||
secret = data.trim()
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
}
|
||||
|
||||
if (
|
||||
(issuer ?? client ?? secret)
|
||||
&& !(issuer && client && secret)
|
||||
) {
|
||||
throw new Error('OIDC configuration is incomplete')
|
||||
}
|
||||
|
||||
if (!issuer || !client || !secret) {
|
||||
return
|
||||
}
|
||||
|
||||
return {
|
||||
issuer,
|
||||
client,
|
||||
secret,
|
||||
rootKey,
|
||||
disableKeyLogin,
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,187 @@
|
||||
// Handle the configuration loading for headscale.
|
||||
// Functionally only used for reading and writing the configuration file.
|
||||
// Availability checks and other configuration checks are done in the headplane
|
||||
// configuration file that's adjacent to this one.
|
||||
//
|
||||
// Around the codebase, this is referred to as the config
|
||||
// Refer to this file on juanfont/headscale for the default values:
|
||||
// https://github.com/juanfont/headscale/blob/main/hscontrol/types/config.go
|
||||
import { readFile, writeFile } from 'node:fs/promises'
|
||||
import { resolve } from 'node:path'
|
||||
|
||||
import { type Document, parseDocument } from 'yaml'
|
||||
import { z } from 'zod'
|
||||
|
||||
const HeadscaleConfig = z.object({
|
||||
tls_letsencrypt_cache_dir: z.string().default('/var/www/cache'),
|
||||
tls_letsencrypt_challenge_type: z.enum(['HTTP-01', 'TLS-ALPN-01']).default('HTTP-01'),
|
||||
|
||||
tls_letsencrypt_hostname: z.string().optional(),
|
||||
tls_letsencrypt_listen: z.string().optional(),
|
||||
|
||||
tls_cert_path: z.string().optional(),
|
||||
tls_key_path: z.string().optional(),
|
||||
|
||||
server_url: z.string().regex(/^https?:\/\//),
|
||||
listen_addr: z.string(),
|
||||
metrics_listen_addr: z.string().optional(),
|
||||
grpc_listen_addr: z.string().default(':50443'),
|
||||
grpc_allow_insecure: z.boolean().default(false),
|
||||
|
||||
disable_check_updates: z.boolean().default(false),
|
||||
ephemeral_node_inactivity_timeout: z.string().default('120s'),
|
||||
randomize_client_port: z.boolean().default(false),
|
||||
acl_policy_path: z.string().optional(),
|
||||
|
||||
acme_email: z.string().optional(),
|
||||
acme_url: z.string().optional(),
|
||||
|
||||
unix_socket: z.string().default('/var/run/headscale/headscale.sock'),
|
||||
unix_socket_permission: z.string().default('0o770'),
|
||||
|
||||
tuning: z.object({
|
||||
batch_change_delay: z.string().default('800ms'),
|
||||
node_mapsession_buffered_chan_size: z.number().default(30),
|
||||
}).optional(),
|
||||
|
||||
noise: z.object({
|
||||
private_key_path: z.string(),
|
||||
}),
|
||||
|
||||
log: z.object({
|
||||
level: z.string().default('info'),
|
||||
format: z.enum(['text', 'json']).default('text'),
|
||||
}).default({ level: 'info', format: 'text' }),
|
||||
|
||||
logtail: z.object({
|
||||
enabled: z.boolean().default(false),
|
||||
}).default({ enabled: false }),
|
||||
|
||||
cli: z.object({
|
||||
address: z.string().optional(),
|
||||
api_key: z.string().optional(),
|
||||
timeout: z.string().default('10s'),
|
||||
insecure: z.boolean().default(false),
|
||||
}).optional(),
|
||||
|
||||
prefixes: z.object({
|
||||
allocation: z.enum(['sequential', 'random']).default('sequential'),
|
||||
v4: z.string(),
|
||||
v6: z.string(),
|
||||
}),
|
||||
|
||||
dns_config: z.object({
|
||||
override_local_dns: z.boolean().default(true),
|
||||
nameservers: z.array(z.string()).default([]),
|
||||
restricted_nameservers: z.record(z.array(z.string())).default({}),
|
||||
domains: z.array(z.string()).default([]),
|
||||
extra_records: z.array(z.object({
|
||||
name: z.string(),
|
||||
type: z.literal('A'),
|
||||
value: z.string(),
|
||||
})).default([]),
|
||||
magic_dns: z.boolean().default(false),
|
||||
base_domain: z.string().default('headscale.net'),
|
||||
}),
|
||||
|
||||
oidc: z.object({
|
||||
only_start_if_oidc_is_available: z.boolean().default(true),
|
||||
issuer: z.string().optional(),
|
||||
client_id: z.string().optional(),
|
||||
client_secret: z.string().optional(),
|
||||
client_secret_path: z.string().optional(),
|
||||
scope: z.array(z.string()).default(['openid', 'profile', 'email']),
|
||||
extra_params: z.record(z.string()).default({}),
|
||||
allowed_domains: z.array(z.string()).optional(),
|
||||
allowed_users: z.array(z.string()).optional(),
|
||||
allowed_groups: z.array(z.string()).optional(),
|
||||
strip_email_domain: z.boolean().default(true),
|
||||
expiry: z.string().default('180d'),
|
||||
use_expiry_from_token: z.boolean().default(false),
|
||||
}).optional(),
|
||||
|
||||
database: z.union([
|
||||
z.object({
|
||||
type: z.literal('sqlite'),
|
||||
debug: z.boolean().default(false),
|
||||
sqlite: z.object({
|
||||
path: z.string(),
|
||||
}),
|
||||
}),
|
||||
z.object({
|
||||
type: z.literal('sqlite3'),
|
||||
debug: z.boolean().default(false),
|
||||
sqlite: z.object({
|
||||
path: z.string(),
|
||||
}),
|
||||
}),
|
||||
z.object({
|
||||
type: z.literal('postgres'),
|
||||
debug: z.boolean().default(false),
|
||||
postgres: z.object({
|
||||
host: z.string(),
|
||||
port: z.number(),
|
||||
name: z.string(),
|
||||
user: z.string(),
|
||||
pass: z.string(),
|
||||
ssl: z.boolean().default(false),
|
||||
max_open_conns: z.number().default(10),
|
||||
max_idle_conns: z.number().default(10),
|
||||
conn_max_idle_time_secs: z.number().default(3600),
|
||||
}),
|
||||
}),
|
||||
]),
|
||||
|
||||
derp: z.object({
|
||||
server: z.object({
|
||||
enabled: z.boolean().default(false),
|
||||
region_id: z.number().optional(),
|
||||
region_code: z.string().optional(),
|
||||
region_name: z.string().optional(),
|
||||
stun_listen_addr: z.string().optional(),
|
||||
private_key_path: z.string().optional(),
|
||||
|
||||
ipv4: z.string().optional(),
|
||||
ipv6: z.string().optional(),
|
||||
automatically_add_embedded_derp_region: z.boolean().default(true),
|
||||
}),
|
||||
|
||||
urls: z.array(z.string()).optional(),
|
||||
paths: z.array(z.string()).optional(),
|
||||
auto_update_enabled: z.boolean().default(true),
|
||||
update_frequency: z.string().default('24h'),
|
||||
}),
|
||||
})
|
||||
|
||||
export type HeadscaleConfig = z.infer<typeof HeadscaleConfig>
|
||||
|
||||
export let configYaml: Document | undefined
|
||||
export let config: HeadscaleConfig | undefined
|
||||
|
||||
export async function loadConfig() {
|
||||
if (config) {
|
||||
return config
|
||||
}
|
||||
|
||||
const path = resolve(process.env.CONFIG_FILE ?? '/etc/headscale/config.yaml')
|
||||
const data = await readFile(path, 'utf8')
|
||||
|
||||
configYaml = parseDocument(data)
|
||||
config = await HeadscaleConfig.parseAsync(configYaml.toJSON())
|
||||
return config
|
||||
}
|
||||
|
||||
// This is so obscenely dangerous, please have a check around it
|
||||
export async function patchConfig(partial: Record<string, unknown>) {
|
||||
if (!configYaml || !config) {
|
||||
throw new Error('Config not loaded')
|
||||
}
|
||||
|
||||
for (const [key, value] of Object.entries(partial)) {
|
||||
configYaml.setIn(key.split('.'), value)
|
||||
}
|
||||
|
||||
config = await HeadscaleConfig.parseAsync(configYaml.toJSON())
|
||||
const path = resolve(process.env.CONFIG_FILE ?? '/etc/headscale/config.yaml')
|
||||
await writeFile(path, configYaml.toString(), 'utf8')
|
||||
}
|
||||
+9
-20
@@ -1,31 +1,25 @@
|
||||
|
||||
/* eslint-disable no-await-in-loop */
|
||||
/* eslint-disable no-constant-condition */
|
||||
import { setTimeout } from 'node:timers/promises'
|
||||
|
||||
import { Client } from 'undici'
|
||||
|
||||
import { getContext } from './config'
|
||||
import { loadContext } from './config/headplane'
|
||||
import { HeadscaleError, pull } from './headscale'
|
||||
|
||||
export async function sighupHeadscale() {
|
||||
const context = await getContext()
|
||||
if (!context.hasDockerSock) {
|
||||
const context = await loadContext()
|
||||
if (!context.docker) {
|
||||
return
|
||||
}
|
||||
|
||||
if (!process.env.HEADSCALE_CONTAINER) {
|
||||
throw new Error('HEADSCALE_CONTAINER is not set')
|
||||
}
|
||||
|
||||
const client = new Client('http://localhost', {
|
||||
socketPath: '/var/run/docker.sock'
|
||||
socketPath: context.docker.sock,
|
||||
})
|
||||
|
||||
const container = process.env.HEADSCALE_CONTAINER
|
||||
const response = await client.request({
|
||||
method: 'POST',
|
||||
path: `/v1.30/containers/${container}/kill?signal=SIGHUP`
|
||||
path: `/v1.30/containers/${context.docker.container}/kill?signal=SIGHUP`,
|
||||
})
|
||||
|
||||
if (!response.statusCode || response.statusCode !== 204) {
|
||||
@@ -34,23 +28,18 @@ export async function sighupHeadscale() {
|
||||
}
|
||||
|
||||
export async function restartHeadscale() {
|
||||
const context = await getContext()
|
||||
if (!context.hasDockerSock) {
|
||||
const context = await loadContext()
|
||||
if (!context.docker) {
|
||||
return
|
||||
}
|
||||
|
||||
if (!process.env.HEADSCALE_CONTAINER) {
|
||||
throw new Error('HEADSCALE_CONTAINER is not set')
|
||||
}
|
||||
|
||||
const client = new Client('http://localhost', {
|
||||
socketPath: '/var/run/docker.sock'
|
||||
socketPath: context.docker.sock,
|
||||
})
|
||||
|
||||
const container = process.env.HEADSCALE_CONTAINER
|
||||
const response = await client.request({
|
||||
method: 'POST',
|
||||
path: `/v1.30/containers/${container}/restart`
|
||||
path: `/v1.30/containers/${context.docker.container}/restart`,
|
||||
})
|
||||
|
||||
if (!response.statusCode || response.statusCode !== 204) {
|
||||
|
||||
+10
-10
@@ -1,4 +1,4 @@
|
||||
import { getContext } from './config'
|
||||
import { loadContext } from './config/headplane'
|
||||
|
||||
export class HeadscaleError extends Error {
|
||||
status: number
|
||||
@@ -18,12 +18,12 @@ export class FatalError extends Error {
|
||||
}
|
||||
|
||||
export async function pull<T>(url: string, key: string) {
|
||||
const context = await getContext()
|
||||
const context = await loadContext()
|
||||
const prefix = context.headscaleUrl
|
||||
const response = await fetch(`${prefix}/api/${url}`, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${key}`
|
||||
}
|
||||
Authorization: `Bearer ${key}`,
|
||||
},
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
@@ -34,14 +34,14 @@ export async function pull<T>(url: string, key: string) {
|
||||
}
|
||||
|
||||
export async function post<T>(url: string, key: string, body?: unknown) {
|
||||
const context = await getContext()
|
||||
const context = await loadContext()
|
||||
const prefix = context.headscaleUrl
|
||||
const response = await fetch(`${prefix}/api/${url}`, {
|
||||
method: 'POST',
|
||||
body: body ? JSON.stringify(body) : undefined,
|
||||
headers: {
|
||||
Authorization: `Bearer ${key}`
|
||||
}
|
||||
Authorization: `Bearer ${key}`,
|
||||
},
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
@@ -52,13 +52,13 @@ export async function post<T>(url: string, key: string, body?: unknown) {
|
||||
}
|
||||
|
||||
export async function del<T>(url: string, key: string) {
|
||||
const context = await getContext()
|
||||
const context = await loadContext()
|
||||
const prefix = context.headscaleUrl
|
||||
const response = await fetch(`${prefix}/api/${url}`, {
|
||||
method: 'DELETE',
|
||||
headers: {
|
||||
Authorization: `Bearer ${key}`
|
||||
}
|
||||
Authorization: `Bearer ${key}`,
|
||||
},
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
|
||||
Reference in New Issue
Block a user