redo dns_config

this commit changes and streamlines the dns_config into a new key, dns. It removes a combination of outdates and incompatible configuration options that made it easy to confuse what headscale could and could not do, or what to expect from ones configuration. Signed-off-by: Kristoffer Dalby <[email protected]>
kradalby · Aug 19, 2024 · 3a098e5 · 3a098e5
1 parent 022fb24
commit 3a098e5
Show file tree

Hide file tree

Showing 25 changed files with 1,023 additions and 440 deletions.
diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
@@ -37,6 +37,8 @@ jobs:
  - TestNodeRenameCommand
  - TestNodeMoveCommand
  - TestPolicyCommand
+ - TestResolveMagicDNS
+ - TestValidateResolvConf
  - TestDERPServerScenario
  - TestPingAllByIP
  - TestPingAllByIPPublicDERP
@@ -45,7 +47,6 @@ jobs:
  - TestEphemeral2006DeletedTooQuickly
  - TestPingAllByHostname
  - TestTaildrop
- - TestResolveMagicDNS
  - TestExpireNode
  - TestNodeOnlineStatus
  - TestPingAllByIPManyUpDown

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -29,7 +29,7 @@ after improving the test harness as part of adopting [#1460](https://github.com/
  - Adds additional configuration for PostgreSQL for setting max open, idle connection and idle connection lifetime.
 - API: Machine is now Node [#1553](https://github.com/juanfont/headscale/pull/1553)
 - Remove support for older Tailscale clients [#1611](https://github.com/juanfont/headscale/pull/1611)
- - The latest supported client is 1.38
+ - The latest supported client is 1.42
 - Headscale checks that _at least_ one DERP is defined at start [#1564](https://github.com/juanfont/headscale/pull/1564)
  - If no DERP is configured, the server will fail to start, this can be because it cannot load the DERPMap from file or url.
 - Embedded DERP server requires a private key [#1611](https://github.com/juanfont/headscale/pull/1611)
@@ -43,9 +43,12 @@ after improving the test harness as part of adopting [#1460](https://github.com/
 - MagicDNS domains no longer contain usernames []()
  - This is in preperation to fix Headscales implementation of tags which currently does not correctly remove the link between a tagged device and a user. As tagged devices will not have a user, this will require a change to the DNS generation, removing the username, see [#1369](https://github.com/juanfont/headscale/issues/1369) for more information.
  - `use_username_in_magic_dns` can be used to turn this behaviour on again, but note that this option _will be removed_ when tags are fixed.
- - This option brings Headscales behaviour in line with Tailscale.
+ - dns.base_domain can no longer be the same as (or part of) server_url.
+ - This option brings Headscales behaviour in line with Tailscale.
 - YAML files are no longer supported for headscale policy. [#1792](https://github.com/juanfont/headscale/pull/1792)
  - HuJSON is now the only supported format for policy.
+- DNS configuration has been restructured [#2034](https://github.com/juanfont/headscale/pull/2034)
+ - Please review the new [config-example.yaml](./config-example.yaml) for the new structure.
 
 ### Changes
 

diff --git a/cmd/headscale/headscale_test.go b/cmd/headscale/headscale_test.go
@@ -63,7 +63,6 @@ func (*Suite) TestConfigFileLoading(c *check.C) {
  c.Assert(viper.GetString("tls_letsencrypt_hostname"), check.Equals, "")
  c.Assert(viper.GetString("tls_letsencrypt_listen"), check.Equals, ":http")
  c.Assert(viper.GetString("tls_letsencrypt_challenge_type"), check.Equals, "HTTP-01")
- c.Assert(viper.GetStringSlice("dns_config.nameservers")[0], check.Equals, "1.1.1.1")
  c.Assert(
  util.GetFileMode("unix_socket_permission"),
  check.Equals,
@@ -106,7 +105,6 @@ func (*Suite) TestConfigLoading(c *check.C) {
  c.Assert(viper.GetString("tls_letsencrypt_hostname"), check.Equals, "")
  c.Assert(viper.GetString("tls_letsencrypt_listen"), check.Equals, ":http")
  c.Assert(viper.GetString("tls_letsencrypt_challenge_type"), check.Equals, "HTTP-01")
- c.Assert(viper.GetStringSlice("dns_config.nameservers")[0], check.Equals, "1.1.1.1")
  c.Assert(
  util.GetFileMode("unix_socket_permission"),
  check.Equals,
@@ -116,39 +114,6 @@ func (*Suite) TestConfigLoading(c *check.C) {
  c.Assert(viper.GetBool("randomize_client_port"), check.Equals, false)
 }
 
-func (*Suite) TestDNSConfigLoading(c *check.C) {
- tmpDir, err := os.MkdirTemp("", "headscale")
- if err != nil {
- c.Fatal(err)
- }
- defer os.RemoveAll(tmpDir)
-
- path, err := os.Getwd()
- if err != nil {
- c.Fatal(err)
- }
-
- // Symlink the example config file
- err = os.Symlink(
- filepath.Clean(path+"/../../config-example.yaml"),
- filepath.Join(tmpDir, "config.yaml"),
- )
- if err != nil {
- c.Fatal(err)
- }
-
- // Load example config, it should load without validation errors
- err = types.LoadConfig(tmpDir, false)
- c.Assert(err, check.IsNil)
-
- dnsConfig, baseDomain := types.GetDNSConfig()
-
- c.Assert(dnsConfig.Nameservers[0].String(), check.Equals, "1.1.1.1")
- c.Assert(dnsConfig.Resolvers[0].Addr, check.Equals, "1.1.1.1")
- c.Assert(dnsConfig.Proxied, check.Equals, true)
- c.Assert(baseDomain, check.Equals, "example.com")
-}
-
 func writeConfig(c *check.C, tmpDir string, configYaml []byte) {
  // Populate a custom config file
  configFile := filepath.Join(tmpDir, "config.yaml")

diff --git a/config-example.yaml b/config-example.yaml
@@ -224,54 +224,67 @@ policy:
 # - https://tailscale.com/kb/1081/magicdns/
 # - https://tailscale.com/blog/2021-09-private-dns-with-magicdns/
 #
-dns_config:
- # Whether to prefer using Headscale provided DNS or use local.
- override_local_dns: true
+# Please not that for the DNS configuration to have any effect,
+# clients must have the `--accept-ds=true` option enabled. This is the
+# default for the Tailscale client. This option is enabled by default
+# in the Tailscale client.
+#
+# Setting _any_ of the configuration and `--accept-dns=true` on the
+# clients will integrate with the DNS manager on the client or
+# overwrite /etc/resolv.conf.
+# https://tailscale.com/kb/1235/resolv-conf
+#
+# If you want stop Headscale from managing the DNS configuration
+# all the fields under `dns` should be set to empty values.
+dns:
+ # Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).
+ # Only works if there is at least a nameserver defined.
+ magic_dns: true
+
+ # Defines the base domain to create the hostnames for MagicDNS.
+ # This domain _must_ be different from the server_url domain.
+ # `base_domain` must be a FQDN, without the trailing dot.
+ # The FQDN of the hosts will be
+ # `hostname.base_domain` (e.g., _myhost.example.com_).
+ base_domain: example.com
 
  # List of DNS servers to expose to clients.
  nameservers:
- - 1.1.1.1
-
- # NextDNS (see https://tailscale.com/kb/1218/nextdns/).
- # "abc123" is example NextDNS ID, replace with yours.
- #
- # With metadata sharing:
- # nameservers:
- # - https://dns.nextdns.io/abc123
- #
- # Without metadata sharing:
- # nameservers:
- # - 2a07:a8c0::ab:c123
- # - 2a07:a8c1::ab:c123
-
- # Split DNS (see https://tailscale.com/kb/1054/dns/),
- # list of search domains and the DNS to query for each one.
- #
- # restricted_nameservers:
- # foo.bar.com:
- # - 1.1.1.1
- # darp.headscale.net:
- # - 1.1.1.1
- # - 8.8.8.8
-
- # Search domains to inject.
- domains: []
+ global:
+ - 1.1.1.1
+ - 1.0.0.1
+ - 2606:4700:4700::1111
+ - 2606:4700:4700::1001
+
+ # NextDNS (see https://tailscale.com/kb/1218/nextdns/).
+ # "abc123" is example NextDNS ID, replace with yours.
+ # - https://dns.nextdns.io/abc123
+
+ # Split DNS (see https://tailscale.com/kb/1054/dns/),
+ # a map of domains and which DNS server to use for each.
+ split:
+ {}
+ # foo.bar.com:
+ # - 1.1.1.1
+ # darp.headscale.net:
+ # - 1.1.1.1
+ # - 8.8.8.8
+
+ # Set custom DNS search domains. With MagicDNS enabled,
+ # your tailnet base_domain is always the first search domain.
+ search_domains: []
 
  # Extra DNS records
  # so far only A-records are supported (on the tailscale side)
  # See https://github.com/juanfont/headscale/blob/main/docs/dns-records.md#Limitations
- # extra_records:
+ extra_records: []
  # - name: "grafana.myvpn.example.com"
  # type: "A"
  # value: "100.64.0.3"
  #
  # # you can also put it in one line
  # - { name: "prometheus.myvpn.example.com", type: "A", value: "100.64.0.3" }
 
- # Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).
- # Only works if there is at least a nameserver defined.
- magic_dns: true
-
  # DEPRECATED
  # Use the username as part of the DNS name for nodes, with this option enabled:
  # node1.username.example.com
@@ -281,12 +294,6 @@ dns_config:
  # while in upstream Tailscale, the username is not included.
  use_username_in_magic_dns: false
 
- # Defines the base domain to create the hostnames for MagicDNS.
- # `base_domain` must be a FQDNs, without the trailing dot.
- # The FQDN of the hosts will be
- # `hostname.user.base_domain` (e.g., _myhost.myuser.example.com_).
- base_domain: example.com
-
 # Unix socket used for the CLI to connect without authentication
 # Note: for production you will want to set this to something like:
 unix_socket: /var/run/headscale/headscale.sock

diff --git a/flake.nix b/flake.nix
@@ -31,7 +31,7 @@
 
  # When updating go.mod or go.sum, a new sha will need to be calculated,
  # update this if you have a mismatch after doing a change to thos files.
- vendorHash = "sha256-EorT2AVwA3usly/LcNor6r5UIhLCdj3L4O4ilgTIC2o=";
+ vendorHash = "sha256-08N9ZdUM3Lw0ad89Vpy01e/qJQoMRPj8n4Jd7Aecgjw=";
 
  subPackages = ["cmd/headscale"];
 

diff --git a/go.mod b/go.mod
@@ -31,15 +31,15 @@ require (
  github.com/samber/lo v1.39.0
  github.com/sasha-s/go-deadlock v0.3.1
  github.com/spf13/cobra v1.8.0
- github.com/spf13/viper v1.18.2
+ github.com/spf13/viper v1.20.0-alpha.6
  github.com/stretchr/testify v1.9.0
  github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a
  github.com/tailscale/tailsql v0.0.0-20240418235827-820559f382c1
  github.com/tcnksm/go-latest v0.0.0-20170313132115-e3007ae9052e
  go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
- golang.org/x/crypto v0.23.0
- golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
- golang.org/x/net v0.25.0
+ golang.org/x/crypto v0.25.0
+ golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
+ golang.org/x/net v0.27.0
  golang.org/x/oauth2 v0.20.0
  golang.org/x/sync v0.7.0
  google.golang.org/genproto/googleapis/api v0.0.0-20240515191416-fc5f0ca64291
@@ -101,6 +101,7 @@ require (
  github.com/go-jose/go-jose/v4 v4.0.1 // indirect
  github.com/go-json-experiment/json v0.0.0-20231102232822-2e55bd4e08b0 // indirect
  github.com/go-ole/go-ole v1.3.0 // indirect
+ github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
  github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 // indirect
  github.com/gogo/protobuf v1.3.2 // indirect
  github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
@@ -117,7 +118,6 @@ require (
  github.com/gorilla/csrf v1.7.2 // indirect
  github.com/gorilla/securecookie v1.1.2 // indirect
  github.com/hashicorp/go-version v1.6.0 // indirect
- github.com/hashicorp/hcl v1.0.0 // indirect
  github.com/hdevalence/ed25519consensus v0.2.0 // indirect
  github.com/illarion/gonotify v1.0.1 // indirect
  github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -137,7 +137,6 @@ require (
  github.com/kr/text v0.2.0 // indirect
  github.com/lib/pq v1.10.7 // indirect
  github.com/lithammer/fuzzysearch v1.1.8 // indirect
- github.com/magiconair/properties v1.8.7 // indirect
  github.com/mattn/go-colorable v0.1.13 // indirect
  github.com/mattn/go-isatty v0.0.20 // indirect
  github.com/mattn/go-runewidth v0.0.15 // indirect
@@ -166,8 +165,7 @@ require (
  github.com/rivo/uniseg v0.4.7 // indirect
  github.com/rogpeppe/go-internal v1.12.0 // indirect
  github.com/safchain/ethtool v0.3.0 // indirect
- github.com/sagikazarmark/locafero v0.4.0 // indirect
- github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+ github.com/sagikazarmark/locafero v0.6.0 // indirect
  github.com/sirupsen/logrus v1.9.3 // indirect
  github.com/sourcegraph/conc v0.3.0 // indirect
  github.com/spf13/afero v1.11.0 // indirect
@@ -195,16 +193,15 @@ require (
  github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
  go.uber.org/multierr v1.11.0 // indirect
  go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
- golang.org/x/mod v0.17.0 // indirect
- golang.org/x/sys v0.20.0 // indirect
- golang.org/x/term v0.20.0 // indirect
- golang.org/x/text v0.15.0 // indirect
+ golang.org/x/mod v0.19.0 // indirect
+ golang.org/x/sys v0.22.0 // indirect
+ golang.org/x/term v0.22.0 // indirect
+ golang.org/x/text v0.16.0 // indirect
  golang.org/x/time v0.5.0 // indirect
- golang.org/x/tools v0.21.0 // indirect
+ golang.org/x/tools v0.23.0 // indirect
  golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
  golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
  google.golang.org/genproto/googleapis/rpc v0.0.0-20240515191416-fc5f0ca64291 // indirect
- gopkg.in/ini.v1 v1.67.0 // indirect
  gopkg.in/yaml.v2 v2.4.0 // indirect
  gvisor.dev/gvisor v0.0.0-20240306221502-ee1e1f6070e3 // indirect
  modernc.org/libc v1.50.6 // indirect