MyFavMirrors/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2025-03-26 07:21:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

feat: add verify client config for embedded DERP

Browse Source
This commit is contained in:
seiuneko 2024-11-27 16:11:15 +08:00
parent af4508b9dc
commit 55980d6427
No known key found for this signature in database
GPG Key ID: A5A75952899A0179
3 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
config-example.yaml
View File

@ -87,6 +87,12 @@ derp:
region_code: "headscale" region_code: "headscale"
region_name: "Headscale Embedded DERP" region_name: "Headscale Embedded DERP"
# If non-empty, an admission controller URL for permitting client connections
verify_client_url: "http://127.0.0.1:8080/verify"
# Whether derp fail open if verify_client_url is unreachable
verify_client_url_fail_open: false
# Listens over UDP at the configured address for STUN connections - to help with NAT traversal. # Listens over UDP at the configured address for STUN connections - to help with NAT traversal.
# When the embedded DERP server is enabled stun_listen_addr MUST be defined. # When the embedded DERP server is enabled stun_listen_addr MUST be defined.
# #

4
hscontrol/derp/server/derp_server.go
View File

@ -44,6 +44,10 @@ func NewDERPServer(
) (*DERPServer, error) { ) (*DERPServer, error) {
log.Trace().Caller().Msg("Creating new embedded DERP server") log.Trace().Caller().Msg("Creating new embedded DERP server")
server := derp.NewServer(derpKey, util.TSLogfWrapper()) // nolint // zerolinter complains server := derp.NewServer(derpKey, util.TSLogfWrapper()) // nolint // zerolinter complains
if cfg.ServerVerifyClientURL != "" {
server.SetVerifyClientURL(cfg.ServerVerifyClientURL)
server.SetVerifyClientURLFailOpen(cfg.ServerVerifyFailOpen)
}
return &DERPServer{ return &DERPServer{
serverURL: serverURL, serverURL: serverURL,

6
hscontrol/types/config.go
View File

@ -185,6 +185,8 @@ type DERPConfig struct {
ServerRegionCode string ServerRegionCode string
ServerRegionName string ServerRegionName string
ServerPrivateKeyPath string ServerPrivateKeyPath string
ServerVerifyClientURL string
ServerVerifyFailOpen bool
STUNAddr string STUNAddr string
URLs []url.URL URLs []url.URL
Paths []string Paths []string
@ -431,6 +433,8 @@ func derpConfig() DERPConfig {
serverRegionID := viper.GetInt("derp.server.region_id") serverRegionID := viper.GetInt("derp.server.region_id")
serverRegionCode := viper.GetString("derp.server.region_code") serverRegionCode := viper.GetString("derp.server.region_code")
serverRegionName := viper.GetString("derp.server.region_name") serverRegionName := viper.GetString("derp.server.region_name")
serverVerifyClientURL := viper.GetString("derp.server.verify_client_url")
serverVerifyFailOpen := viper.GetBool("derp.server.verify_client_url_fail_open")
stunAddr := viper.GetString("derp.server.stun_listen_addr") stunAddr := viper.GetString("derp.server.stun_listen_addr")
privateKeyPath := util.AbsolutePathFromConfigPath( privateKeyPath := util.AbsolutePathFromConfigPath(
viper.GetString("derp.server.private_key_path"), viper.GetString("derp.server.private_key_path"),
@ -475,6 +479,8 @@ func derpConfig() DERPConfig {
ServerRegionID: serverRegionID, ServerRegionID: serverRegionID,
ServerRegionCode: serverRegionCode, ServerRegionCode: serverRegionCode,
ServerRegionName: serverRegionName, ServerRegionName: serverRegionName,
ServerVerifyClientURL: serverVerifyClientURL,
ServerVerifyFailOpen: serverVerifyFailOpen,
ServerPrivateKeyPath: privateKeyPath, ServerPrivateKeyPath: privateKeyPath,
STUNAddr: stunAddr, STUNAddr: stunAddr,
URLs: urls, URLs: urls,