684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
30dd718d68
add oidc.enabled flag for helm and config generation
...
allows defining oidc config without enabling it
2026-02-24 10:43:28 +02:00
403f9c9b0b
feat: add lazy retrying oidc connector
2026-01-16 00:33:10 -05:00
199ef46ee1
fix: correctly passthrough and handle a new OIDC redirect_uri system
2025-12-04 10:34:48 -05:00
e09c5760af
chore: random quick fixes
2025-12-04 04:11:52 -05:00
ba61656fb0
feat: cleanup oidc logic and surface errors better
2025-12-04 00:44:31 -05:00
86184e3420
feat: overhaul config loading
2025-12-01 02:46:22 -05:00
d3d7c7cc0e
feat: better error handling for oidc api key
...
This also ships with a better error page
2025-11-28 17:54:52 -05:00
444b2325fb
feat: fix acl api logic to work correctly
2025-11-04 23:51:36 -05:00
a68aedc297
feat: create type-safe API object for Headscale
2025-11-04 22:40:57 -05:00
b1c93512df
feat: support custom cookie options
2025-11-02 14:04:38 -05:00
ce4be73faf
feat: add a warning banner on the login page for misconfigured cookies
2025-11-02 13:54:45 -05:00
f66f778398
chore: add sig handlers for the server
2025-10-19 15:29:40 -04:00
eb4669498a
feat: overhaul oidc work
2025-08-28 22:55:26 -04:00
a9d5e10be9
fix: redirect admin to admin/ (regression)
2025-08-26 15:18:48 -04:00
d2c4f5eb2b
feat: completely overhaul the auth model
...
* Cookies are now encrypted JWTs (GHSA-wrqq-v7qw-r5w7)
* Authentication is stored in the SQLite database (auto-migrated)
* Session logic is much cleaner
2025-08-19 17:52:16 -04:00
8cb91cd45b
feat: overhaul hp_agent lifecycle handling
...
* Added backoff and liveness probes for better management
* Switched IPC to a simple text based system
* Lookups don't directly touch the agent now
* Use the database as a source of truth
2025-08-19 00:10:06 -04:00
a4a037ed68
feat: update to rolldown-vite and typescript-go
2025-08-18 16:42:29 -04:00
73f0a0d273
fix: use distroless and fix build
2025-06-20 11:32:27 -04:00
b18147fa82
feat: cleanup removal of old ssh plexer and logic
...
we also have added the necessary logic to auto prune ephemeral nodes because
headscale doesn't seem to automatically remove them. this change made use of a database
which is now stored in the persistent headplane directory.
2025-06-20 00:14:00 -04:00
55eacb59e9
feat: expand frame type to support stdout/stderr chan
2025-06-16 11:44:59 -04:00
7dfcbef774
feat: initial webssh tooling
2025-06-16 11:44:59 -04:00
021ecabd3c
feat: add support for extra_records_path in hs config
2025-05-25 11:02:19 -04:00
c5e6a6c407
feat: switch away from websocket to stdout messaging for agent
2025-05-25 11:02:19 -04:00
1fb084451d
fix: fix integrations not loading
2025-04-03 12:57:06 -04:00
bf02015dc7
feat: begin working on user auth
2025-03-29 14:12:15 -04:00
b8d22beb17
feat: bundle node_modules into the server
2025-03-24 16:15:38 -04:00
5918d0e501
fix: allow hostname passthrough for hono node
2025-03-24 16:15:38 -04:00
03acebb23e
fix: env variables did not resolve in prod
2025-03-24 16:15:38 -04:00
73ea35980d
feat: switch agent fetching to the server side
...
this brings the benefit of fitting in the revalidator lifecycle we have
created via the useLiveData hook.
2025-03-24 16:15:38 -04:00
9a1051b9af
feat: reimplement websocket to use hono
2025-03-24 16:15:38 -04:00
34cfee7cff
feat: reach an initial working stage
2025-03-24 16:15:38 -04:00
cbbd64e91a
feat: initial server side systems
2025-03-24 16:15:38 -04:00
Aarnav Tale