add --verify-clients environment variable to docker version

juanfont / headscale

An open source, self-hosted implementation of the Tailscale control server

BSD 3-Clause "New" or "Revised" License

23.49k stars 1.29k forks source link

add --verify-clients environment variable to docker version #740

Open vampywiz17 opened 2 years ago

vampywiz17 commented 2 years ago

Feature request

PLease add option to set private option to embedded DERP server in docker container.

kradalby commented 2 years ago

Hi, can you please try to reword and explain this feature request?

Edit: I think I understand, We would be very happy to take a PR for this, but we do not officially support the docker setup, so it will not be prioritised for now.

christian-heusel commented 2 years ago

.... but we do not officially support the docker setup, so it will not be prioritised for now.

@kradalby this is a general feature request, not specific for docker 😊 See https://tailscale.com/kb/1118/custom-derp-servers/#optional-restricting-client-access-to-your-derp-node for reference

joejose97 commented 1 year ago

@juanfont

The tailscale derp server gets the valid client list by sending a GET request to http://local-tailscaled.sock/localapi/v0/status I'm thinking of emulating what the tailscale client does by creating a http listener on the said socket.

If this is acceptable, I'll open a PR with the same.

icb- commented 1 year ago

Emulating the tailscale control socket API doesn't sound very straightforward, and would come with some downsides (like not being able to easily run tailscale on the headscale system).

It may be better to see about factoring out how the DERP server validates node keys (https://github.com/tailscale/tailscale/blob/main/derp/derp_server.go#L1126-L1142) and make it possible to pull those from headscale rather than the tailscale client socket.

Maybe passing a Verifier function, rather than setting a boolean for whether to verify?

I don't know if that sort of change could be made in a way that would be accepted upstream, or if it would mean maintaining a fork of the derp server.

mritd commented 1 year ago

@icb- After reading the derper code, it is feasible to simulate the API; I have created a branch and tested it; derper successfully completed the verification of the Client.

1、Derper's verification of its client is mainly completed through the node public key in the status struct.
2、Node public key is obtained from local socket api status request
3、We only need to simulate a local status api and return the public keys of all nodes.
4、After setting up client authentication, derper will automatically connect to this API to obtain the public keys of all nodes.