Support for SSH check mode in ACLs

[almereyda]

Why

Tailscale upstream supports SSH check mode.

We would like to use it with Headscale, too.

Description

When defining an Tailscale SSH ACL policy with the action set to check, an additional authentication against the OIDC endpoint is required, which grants access within an optional checkPeriod, defaulting to 12 hours and allowing to be set to always.

References

• Configure Tailscale SSH with check · Tailscale SSH · Tailscale Docs

This is related to, but not identical to:

• 1303, where a user tried to use check mode

• 1623, where upstream reports about the availability of a web check mode in the Tailscale client, currently restricted to the upstream control plane.

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity.

[almereyda]

No stale activity.

[dparv]

+1