ee59a2d06d
feat: switch agent to a periodic dump rather than long running process
2026-03-27 13:32:59 -04:00
2c57187628
feat: switch to a generalized api key config
2026-03-27 13:32:59 -04:00
5f81822366
feat: correct package.json dependencies and remove libsql
2026-03-17 13:31:35 -04:00
b1361e9062
feat: upgrade to node 24 and drizzle
2026-03-17 13:22:48 -04:00
8f6fe05c83
fix: actually fix type errors
2026-03-16 23:41:09 -04:00
25dc09e025
perf: switch to SSE dispatched changes
...
Previously we would use naive revalidators which would invalidate EVERY
SINGLE action loader every 3 seconds, resulting in several fetches. It
would also bubble fetches across the layout actions into the individual
pages.
This new approach selectively has live stores of resources which then
poll for changes on the server side and then dispatches updates to the
client via a new /events/live SSE endpoint.
2026-03-16 23:32:06 -04:00
0741567754
fix: validate required Docker API version
2026-03-15 02:08:07 +01:00
a26faab139
feat: add ownership transfer support
2026-03-14 15:17:45 -04:00
e255407115
feat: redo user page to match account linking
2026-03-14 14:56:04 -04:00
38cf93e5ae
feat: replace onboarding for explicit user linking
2026-03-14 13:23:22 -04:00
6470f5a821
feat: refactor several components and clean up ui
2026-03-09 22:09:58 -04:00
434f886034
feat: admin UI for Headscale user linking + skip onboarding
...
- Add 'Link Headscale user' option in user menu (admin-only, OIDC users)
- Dialog shows only unclaimed Headscale users
- New link_user action in user-actions with claim validation
- Onboarding now allows skipping the link step with clear messaging
- Users who skip are told they can ask an admin to link later
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:57 -04:00
684a95b5e8
fix: harden user linking and session pruning
...
Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims
Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:55 -04:00
45984ec639
chore: remove deprecated oidc.user_storage_file option
...
The flat-file user store has been deprecated for several versions.
All user data now lives in the SQL database. Removes the config field,
nix option, docs, and migration logic.
Co-authored-by: Amp <amp@ampcode.com >
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9
2026-03-08 17:34:49 -04:00
0f8e192b5c
feat: initial auth rework
2026-03-07 17:10:34 -05:00
cb97b73abd
Merge pull request #477 from drifterza/fix/issue-427-hostinfo-update-frequency
2026-03-07 14:51:15 -05:00
1462016a39
Add self-service pre-auth keys for auditor role
...
Closes #453
2026-02-27 12:21:16 +02:00
be79413178
fix: refresh agent HostInfo periodically using cache_ttl ( #427 )
...
Previously REFRESH was only sent once at startup, causing version info
to stay stale. Now the agent refreshes peer data at the cache_ttl
interval (default 3 minutes).
2026-02-27 11:26:06 +02:00
3c5a653942
Merge pull request #469 from drifterza/feature/oidc-pending-approval
2026-02-26 18:03:26 -05:00
624b9ab479
list all preauth keys without user filter
...
headscale 0.28 added GET /v1/preauthkey without a user param
which returns all keys including tag-only ones. this change
adds getAllPreAuthKeys() and uses it when available, falling
back to per-user fetching on older versions.
the UI now handles keys where user is null, showing them as
Tag Only in the filter dropdown.
closes #432
Amp-Thread-ID: https://ampcode.com/threads/T-019c9861-2d45-73ef-ab94-5fce62f63670
Co-authored-by: Amp <amp@ampcode.com >
2026-02-26 00:40:31 -05:00
dde72ae4ed
Merge pull request #465 from drifterza/feature/preauth-key-tags
2026-02-26 00:04:02 -05:00
2e6b387d67
fix role assignment for users without headplane db record
2026-02-24 17:37:09 +02:00
30dd718d68
add oidc.enabled flag for helm and config generation
...
allows defining oidc config without enabling it
2026-02-24 10:43:28 +02:00
c96249f41e
add tag-only preauth keys for headscale 0.28
...
allows creating keys with acl tags but no user
2026-02-24 10:25:51 +02:00
0080cddb55
chore: fix some test issues
2026-02-08 11:11:44 -05:00
fad0c99fc9
feat: official 0.28 support possibly
2026-02-06 00:11:26 -05:00
696e08dbcc
feat: normalize node tags before leaving the api
2026-01-24 20:30:57 -05:00
403f9c9b0b
feat: add lazy retrying oidc connector
2026-01-16 00:33:10 -05:00
2618cdd9f6
fix: strengthen the proc scanner for headscale
2026-01-16 00:20:26 -05:00
62325f7c86
chore: fallback to client_secret_post for OIDC
2026-01-15 21:54:55 -05:00
0fb02d0d8b
feat: implement better token auth endpoint method heuristic for oidc
2026-01-13 22:17:17 -05:00
7b4966be02
feat: track headscale acl response changes
2025-12-13 16:34:23 -05:00
3d71049afe
fix: accept the full discovered oidc configuration
2025-12-12 21:26:35 +01:00
295dd43059
feat: add info route
2025-12-06 15:02:18 -05:00
3a3e5ca65e
feat: pkce
2025-12-04 11:37:22 -05:00
199ef46ee1
fix: correctly passthrough and handle a new OIDC redirect_uri system
2025-12-04 10:34:48 -05:00
e09c5760af
chore: random quick fixes
2025-12-04 04:11:52 -05:00
a824ea3dcf
chore: spammy log cleanup
2025-12-04 03:37:48 -05:00
ba61656fb0
feat: cleanup oidc logic and surface errors better
2025-12-04 00:44:31 -05:00
86184e3420
feat: overhaul config loading
2025-12-01 02:46:22 -05:00
d3d7c7cc0e
feat: better error handling for oidc api key
...
This also ships with a better error page
2025-11-28 17:54:52 -05:00
5ea96db816
fix(docker): bump docker api version to v1.44
2025-11-21 19:02:16 -03:00
08a251cc8c
feat: add e2e integration tests and canonical versioning
2025-11-16 18:31:09 -05:00
444b2325fb
feat: fix acl api logic to work correctly
2025-11-04 23:51:36 -05:00
c84e9ca4a8
feat: update more primitives to use the new api
2025-11-04 23:06:56 -05:00
d68737e410
feat: switch machine apis to new runtime api client
2025-11-04 22:44:58 -05:00
a68aedc297
feat: create type-safe API object for Headscale
2025-11-04 22:40:57 -05:00
b1c93512df
feat: support custom cookie options
2025-11-02 14:04:38 -05:00
ce4be73faf
feat: add a warning banner on the login page for misconfigured cookies
2025-11-02 13:54:45 -05:00
28ad1d439f
Merge branch 'main' into next
2025-10-30 23:52:35 -04:00
Aarnav Tale