mirror of
https://github.com/juanfont/headscale.git
synced 2025-11-27 20:48:53 -05:00
Deployed 8becb7e5 to development with MkDocs 1.6.1 and mike 2.1.3
This commit is contained in:
github-actions
@@ -127,7 +127,7 @@
|
||||
</span><span id=__span-2-123><a id=__codelineno-2-123 name=__codelineno-2-123 href=#__codelineno-2-123></a><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-2-124><a id=__codelineno-2-124 name=__codelineno-2-124 href=#__codelineno-2-124></a><span class=w> </span><span class=p>]</span>
|
||||
</span><span id=__span-2-125><a id=__codelineno-2-125 name=__codelineno-2-125 href=#__codelineno-2-125></a><span class=p>}</span>
|
||||
</span></code></pre></div> <h2 id=autogroups>Autogroups<a class=headerlink href=#autogroups title="Permanent link">¶</a></h2> <p>Headscale supports several autogroups that automatically include users, destinations, or devices with specific properties. Autogroups provide a convenient way to write ACL rules without manually listing individual users or devices.</p> <h3 id=autogroupinternet><code>autogroup:internet</code><a class=headerlink href=#autogroupinternet title="Permanent link">¶</a></h3> <p>Allows access to the internet through <a href=../routes/#exit-node>exit nodes</a>. Can only be used in ACL destinations. </p> <div class="language-json highlight"><pre><span></span><code><span id=__span-3-1><a id=__codelineno-3-1 name=__codelineno-3-1 href=#__codelineno-3-1></a><span class=p>{</span>
|
||||
</span></code></pre></div> <h2 id=autogroups>Autogroups<a class=headerlink href=#autogroups title="Permanent link">¶</a></h2> <p>Headscale supports several autogroups that automatically include users, destinations, or devices with specific properties. Autogroups provide a convenient way to write ACL rules without manually listing individual users or devices.</p> <h3 id=autogroupinternet><code>autogroup:internet</code><a class=headerlink href=#autogroupinternet title="Permanent link">¶</a></h3> <p>Allows access to the internet through <a href=../routes/#exit-node>exit nodes</a>. Can only be used in ACL destinations.</p> <div class="language-json highlight"><pre><span></span><code><span id=__span-3-1><a id=__codelineno-3-1 name=__codelineno-3-1 href=#__codelineno-3-1></a><span class=p>{</span>
|
||||
</span><span id=__span-3-2><a id=__codelineno-3-2 name=__codelineno-3-2 href=#__codelineno-3-2></a><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span>
|
||||
</span><span id=__span-3-3><a id=__codelineno-3-3 name=__codelineno-3-3 href=#__codelineno-3-3></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"group:users"</span><span class=p>],</span>
|
||||
</span><span id=__span-3-4><a id=__codelineno-3-4 name=__codelineno-3-4 href=#__codelineno-3-4></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:internet:*"</span><span class=p>]</span>
|
||||
@@ -147,14 +147,15 @@
|
||||
</span><span id=__span-6-3><a id=__codelineno-6-3 name=__codelineno-6-3 href=#__codelineno-6-3></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:member"</span><span class=p>],</span>
|
||||
</span><span id=__span-6-4><a id=__codelineno-6-4 name=__codelineno-6-4 href=#__codelineno-6-4></a><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:self:*"</span><span class=p>]</span>
|
||||
</span><span id=__span-6-5><a id=__codelineno-6-5 name=__codelineno-6-5 href=#__codelineno-6-5></a><span class=p>}</span>
|
||||
</span></code></pre></div> <em>Using <code>autogroup:self</code> may cause performance degradation on the Headscale coordinator server in large deployments, as filter rules must be compiled per-node rather than globally and the current implementation is not very efficient.</em></p> <p>If you experience performance issues, consider using more specific ACL rules or limiting the use of <code>autogroup:self</code>.<br> <div class="language-json highlight"><pre><span></span><code><span id=__span-7-1><a id=__codelineno-7-1 name=__codelineno-7-1 href=#__codelineno-7-1></a><span class=p>{</span>
|
||||
</span><span id=__span-7-2><a id=__codelineno-7-2 name=__codelineno-7-2 href=#__codelineno-7-2></a><span class=c1>// To allow internal users communications to their own nodes we can do following rules to allow access in case autogroup:self is causing performance issues.</span>
|
||||
</span><span id=__span-7-3><a id=__codelineno-7-3 name=__codelineno-7-3 href=#__codelineno-7-3></a><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"boss@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"boss@:"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-4><a id=__codelineno-7-4 name=__codelineno-7-4 href=#__codelineno-7-4></a><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev1@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev1@:*"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-5><a id=__codelineno-7-5 name=__codelineno-7-5 href=#__codelineno-7-5></a><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev2@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev2@:"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-6><a id=__codelineno-7-6 name=__codelineno-7-6 href=#__codelineno-7-6></a><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"admin1@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"admin1@:"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-7><a id=__codelineno-7-7 name=__codelineno-7-7 href=#__codelineno-7-7></a><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"intern1@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"intern1@:"</span><span class=p>]</span><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-7-8><a id=__codelineno-7-8 name=__codelineno-7-8 href=#__codelineno-7-8></a><span class=p>}</span>
|
||||
</span></code></pre></div> <em>Using <code>autogroup:self</code> may cause performance degradation on the Headscale coordinator server in large deployments, as filter rules must be compiled per-node rather than globally and the current implementation is not very efficient.</em></p> <p>If you experience performance issues, consider using more specific ACL rules or limiting the use of <code>autogroup:self</code>. <div class="language-json highlight"><pre><span></span><code><span id=__span-7-1><a id=__codelineno-7-1 name=__codelineno-7-1 href=#__codelineno-7-1></a><span class=p>{</span>
|
||||
</span><span id=__span-7-2><a id=__codelineno-7-2 name=__codelineno-7-2 href=#__codelineno-7-2></a><span class=w> </span><span class=c1>// The following rules allow internal users to communicate with their</span>
|
||||
</span><span id=__span-7-3><a id=__codelineno-7-3 name=__codelineno-7-3 href=#__codelineno-7-3></a><span class=w> </span><span class=c1>// own nodes in case autogroup:self is causing performance issues.</span>
|
||||
</span><span id=__span-7-4><a id=__codelineno-7-4 name=__codelineno-7-4 href=#__codelineno-7-4></a><span class=w> </span><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"boss@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"boss@:*"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-5><a id=__codelineno-7-5 name=__codelineno-7-5 href=#__codelineno-7-5></a><span class=w> </span><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev1@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev1@:*"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-6><a id=__codelineno-7-6 name=__codelineno-7-6 href=#__codelineno-7-6></a><span class=w> </span><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev2@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"dev2@:*"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-7><a id=__codelineno-7-7 name=__codelineno-7-7 href=#__codelineno-7-7></a><span class=w> </span><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"admin1@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"admin1@:*"</span><span class=p>]</span><span class=w> </span><span class=p>},</span>
|
||||
</span><span id=__span-7-8><a id=__codelineno-7-8 name=__codelineno-7-8 href=#__codelineno-7-8></a><span class=w> </span><span class=p>{</span><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"intern1@"</span><span class=p>],</span><span class=w> </span><span class=nt>"dst"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"intern1@:*"</span><span class=p>]</span><span class=w> </span><span class=p>}</span>
|
||||
</span><span id=__span-7-9><a id=__codelineno-7-9 name=__codelineno-7-9 href=#__codelineno-7-9></a><span class=p>}</span>
|
||||
</span></code></pre></div></p> <h3 id=autogroupnonroot><code>autogroup:nonroot</code><a class=headerlink href=#autogroupnonroot title="Permanent link">¶</a></h3> <p>Used in Tailscale SSH rules to allow access to any user except root. Can only be used in the <code>users</code> field of SSH rules.</p> <div class="language-json highlight"><pre><span></span><code><span id=__span-8-1><a id=__codelineno-8-1 name=__codelineno-8-1 href=#__codelineno-8-1></a><span class=p>{</span>
|
||||
</span><span id=__span-8-2><a id=__codelineno-8-2 name=__codelineno-8-2 href=#__codelineno-8-2></a><span class=w> </span><span class=nt>"action"</span><span class=p>:</span><span class=w> </span><span class=s2>"accept"</span><span class=p>,</span>
|
||||
</span><span id=__span-8-3><a id=__codelineno-8-3 name=__codelineno-8-3 href=#__codelineno-8-3></a><span class=w> </span><span class=nt>"src"</span><span class=p>:</span><span class=w> </span><span class=p>[</span><span class=s2>"autogroup:member"</span><span class=p>],</span>
|
||||
|
||||
Reference in New Issue
Block a user