You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Go to file

Xe Iaso 4f1d6c53cb cmd/nginx-auth: create new Tailscale NGINX auth service (#4400 ) This conforms to the NGINX subrequest result authentication protocol[1] using the NGINX module `ngx_http_auth_request_module`. This is based on the example that @peterkeen provided on Twitter[2], but with several changes to make things more tightly locked down: * This listens over a UNIX socket instead of a TCP socket to prevent leakage to the network * This uses systemd socket activation so that systemd owns the socket and can then lock down the service to the bare minimum required to do its job without having to worry about dropping permissions * This provides additional information in HTTP response headers that can be useful for integrating with various services * This has a script to automagically create debian and redhat packages for easier distribution This will be written about on the Tailscale blog. There is more information in README.md. [1]: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/ [2]: https://github.com/peterkeen/tailscale/blob/main/cmd/nginx-auth-proxy/nginx-auth-proxy.go Signed-off-by: Xe Iaso <xe@tailscale.com>		2 years ago
.bencher	bencher: add config to suppress failures on benchmark regressions.	3 years ago
.github	Revert ".github/workflows: work around golang/go#51629"	2 years ago
atomicfile	atomicfile: don't Chmod on windows	4 years ago
chirp	all: use any instead of interface{}	2 years ago
client/tailscale	cmd/tailscale: add id-token subcommand	2 years ago
cmd	cmd/nginx-auth: create new Tailscale NGINX auth service (#4400 )	2 years ago
control	control/controlbase: don't enforce a max protocol version at handshake time.	2 years ago
derp	derp: add (*Server).IsClientConnectedForTest func. (#4331 )	2 years ago
disco	types/key: export constants for key size, not a method.	3 years ago
docs	fix minor typo	3 years ago
envknob	envknob: use the correct key when logging (#4319 )	2 years ago
health	net/dns: add health check for particular broken-ish Linux DNS config	2 years ago
hostinfo	tsnet: set Hostinfo.Package to "tsnet" on use	2 years ago
internal/tooldeps	util/deephash: move internal/deephash to util/deephash	3 years ago
ipn	ipn/ipnlocal: make peerIPs return a sorted slice	2 years ago
kube	all: use any instead of interface{}	2 years ago
log	all: use any instead of interface{}	2 years ago
logpolicy	all: use any instead of interface{}	2 years ago
logtail	all: use any instead of interface{}	2 years ago
metrics	all: use testingutil.MinAllocsPerRun	3 years ago
net	Revert ".github/workflows: work around golang/go#51629"	2 years ago
packages/deb	all: use any instead of interface{}	2 years ago
paths	cmd/tailscaled: default to userspace-networking mode on gokrazy, set paths	2 years ago
portlist	envknob: add new package for all the strconv.ParseBool(os.Getenv(..))	2 years ago
prober	prober: used keyed initializer for LimitedReader.	2 years ago
safesocket	safesocket: add ConnectionStrategy, provide control over fallbacks	2 years ago
scripts	scripts: install gnupg only when apt-key is needed	2 years ago
smallzstd	smallzstd: new package that constructs zstd small encoders/decoders.	4 years ago
ssh/tailssh	go.mod, ssh/tailssh, tempfork/gliderlabs: bump x/crypto/ssh fork for NoClientAuthCallback	2 years ago
syncs	syncs: use TryLock and TryRLock instead of unsafe	2 years ago
tailcfg	ipn/localapi: add endpoint to request id token	2 years ago
tempfork	go.mod, ssh/tailssh, tempfork/gliderlabs: bump x/crypto/ssh fork for NoClientAuthCallback	2 years ago
tool	tool/go: add wrapper to download and use go.toolchain.rev go version.	2 years ago
tsconst	net/interfaces/windows: update Tailscale interface detection logic to	3 years ago
tsnet	tsnet: set Hostinfo.Package to "tsnet" on use	2 years ago
tstest	tstest/integration/vms: smoke test derphttp through mitm proxies	2 years ago
tstime	tstime/mono: fix Before function comment	2 years ago
tsweb	tsweb: add PrometheusVar, for vars that want to output varz themselves.	2 years ago
types	tailcfg: add omitempty to all fields of Hostinfo (#4360 )	2 years ago
util	util/groupmember: remove redundant code (#4298 )	2 years ago
version	version: use Go 1.18's git stamping as default implementation	2 years ago
wf	all: use any instead of interface{}	2 years ago
wgengine	net/tsaddr, wgengine/netstack: add IPv6 range that forwards to site-relative IPv4	2 years ago
words	words: more hamsters, less hampsters (#3938 )	2 years ago
.gitattributes	.: add .gitattributes entry to use Go hunk-header driver	2 years ago
.gitignore	Makefile: update make spk target to use the new go spk builder	2 years ago
AUTHORS	Move Linux client & common packages into a public repo.	4 years ago
CODE_OF_CONDUCT.md	Add a code of conduct.	4 years ago
Dockerfile	Dockerfile: require Go 1.18	2 years ago
Dockerfile.base	Dockerfile.base: update to alpine:3.15	2 years ago
LICENSE	LICENSE: Reformat for Github	3 years ago
Makefile	Makefile: add tidy target	2 years ago
PATENTS	Move Linux client & common packages into a public repo.	4 years ago
README.md	README.md: update current Go release	2 years ago
SECURITY.md	Add a SECURITY.md for vulnerability reports.	4 years ago
VERSION.txt	VERSION.txt: This is 1.23.	2 years ago
api.md	api: update acl/validate data format (#4366 )	2 years ago
build_dist.sh	tool/go: add wrapper to download and use go.toolchain.rev go version.	2 years ago
build_docker.sh	tool/go: add wrapper to download and use go.toolchain.rev go version.	2 years ago
go.mod	cmd/nginx-auth: create new Tailscale NGINX auth service (#4400 )	2 years ago
go.sum	cmd/nginx-auth: create new Tailscale NGINX auth service (#4400 )	2 years ago
go.toolchain.branch	go.toolchain.branch: upgrade to Go 1.18	2 years ago
go.toolchain.rev	go.toolchain.rev: pick up httptest race fix	2 years ago
pull-toolchain.sh	go.toolchain.rev: add update script	2 years ago
shell.nix	shell.nix: use tailscale-go for compilation	2 years ago
staticcheck.conf	staticcheck.conf: remove unnecessary warning	3 years ago
version-embed.go	go.toolchain.rev: add Go toolchain rev, tool to print it out	2 years ago

README.md

Tailscale

https://tailscale.com

Private WireGuard® networks made easy

Overview

This repository contains all the open source Tailscale client code and the tailscaled daemon and tailscale CLI tool. The tailscaled daemon runs on Linux, Windows and macOS, and to varying degrees on FreeBSD, OpenBSD, and Darwin. (The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code.)

The Android app is at https://github.com/tailscale/tailscale-android

The Synology package is at https://github.com/tailscale/tailscale-synology

Using

We serve packages for a variety of distros at https://pkgs.tailscale.com .

Other clients

The macOS, iOS, and Windows clients use the code in this repository but additionally include small GUI wrappers that are not open source.

Building

go install tailscale.com/cmd/tailscale{,d}

If you're packaging Tailscale for distribution, use build_dist.sh instead, to burn commit IDs and version info into the binaries:

./build_dist.sh tailscale.com/cmd/tailscale
./build_dist.sh tailscale.com/cmd/tailscaled

If your distro has conventions that preclude the use of build_dist.sh, please do the equivalent of what it does in your distro's way, so that bug reports contain useful version information.

We only guarantee to support the latest Go release and any Go beta or release candidate builds (currently Go 1.18) in module mode. It might work in earlier Go versions or in GOPATH mode, but we're making no effort to keep those working.

Bugs

Please file any issues about this code or the hosted service on the issue tracker.

Contributing

PRs welcome! But please file bugs. Commit messages should reference bugs.

We require Developer Certificate of Origin Signed-off-by lines in commits.

About Us

Tailscale is primarily developed by the people at https://github.com/orgs/tailscale/people. For other contributors, see:

Legal

WireGuard is a registered trademark of Jason A. Donenfeld.