installer: create headscale user resource
diff --git a/charts/headscale-user/.helmignore b/charts/headscale-user/.helmignore
new file mode 100644
index 0000000..0e8a0eb
--- /dev/null
+++ b/charts/headscale-user/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/headscale-user/Chart.yaml b/charts/headscale-user/Chart.yaml
new file mode 100644
index 0000000..2b8cdf9
--- /dev/null
+++ b/charts/headscale-user/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: headscale-user
+description: A Helm chart to create headscale users
+type: application
+version: 0.0.1
+appVersion: "0.0.1"
diff --git a/charts/headscale-user/templates/headscale-user.yaml b/charts/headscale-user/templates/headscale-user.yaml
new file mode 100644
index 0000000..8fc998f
--- /dev/null
+++ b/charts/headscale-user/templates/headscale-user.yaml
@@ -0,0 +1,11 @@
+apiVersion: headscale.dodo.cloud/v1
+kind: HeadscaleUser
+metadata:
+ name: {{ .Values.username }}
+ namespace: {{ .Release.Namespace }}
+spec:
+ headscaleAddress: {{ .Values.headscaleApiAddress }}
+ name: {{ .Values.username }}
+ preAuthKey:
+ enabled: {{ .Values.preAuthKey.enabled }}
+ secretName: {{ .Values.preAuthKey.secretName }}
diff --git a/charts/headscale-user/values.yaml b/charts/headscale-user/values.yaml
new file mode 100644
index 0000000..c91e8d8
--- /dev/null
+++ b/charts/headscale-user/values.yaml
@@ -0,0 +1,6 @@
+username: foo
+headscaleApiAddress: headscale-api.example.com
+preAuthKey:
+ enabled: false
+ secretName: foo-secret
+
diff --git a/core/headscale/main.go b/core/headscale/main.go
index b9dbc22..1ca4f6b 100644
--- a/core/headscale/main.go
+++ b/core/headscale/main.go
@@ -20,19 +20,16 @@
// TODO(gio): ingress-private user name must be configurable
const defaultACLs = `
{
- "hosts": {
- "private-network": "10.1.0.0/24",
- },
"autoApprovers": {
"routes": {
- "private-network": ["private-network-proxy@{{ .Domain }}"],
+ "10.1.0.0/24": ["private-network-proxy@{{ .Domain }}"],
},
},
"acls": [
{ // Everyone can access ingress-private service
"action": "accept",
"src": ["*"],
- "dst": ["private-network:*"],
+ "dst": ["10.1.0.0/24:*"],
},
],
}
diff --git a/core/installer/app.go b/core/installer/app.go
index 3210667..4935169 100644
--- a/core/installer/app.go
+++ b/core/installer/app.go
@@ -102,6 +102,7 @@
CreateCertificateIssuerPrivate(valuesTmpls, tmpls),
CreateAppCoreAuth(valuesTmpls, tmpls),
CreateAppHeadscale(valuesTmpls, tmpls),
+ CreateAppHeadscaleUser(valuesTmpls, tmpls),
CreateAppTailscaleProxy(valuesTmpls, tmpls),
CreateMetallbIPAddressPool(valuesTmpls, tmpls),
CreateEnvManager(valuesTmpls, tmpls),
@@ -383,6 +384,22 @@
}
}
+func CreateAppHeadscaleUser(fs embed.FS, tmpls *template.Template) App {
+ schema, err := fs.ReadFile("values-tmpl/headscale-user.jsonschema")
+ if err != nil {
+ panic(err)
+ }
+ return App{
+ "headscale-user",
+ []string{"app-headscale"},
+ []*template.Template{
+ tmpls.Lookup("headscale-user.yaml"),
+ },
+ string(schema),
+ tmpls.Lookup("headscale-user.md"),
+ }
+}
+
func CreateAppTailscaleProxy(fs embed.FS, tmpls *template.Template) App {
schema, err := fs.ReadFile("values-tmpl/tailscale-proxy.jsonschema")
if err != nil {
diff --git a/core/installer/values-tmpl/headscale-user.jsonschema b/core/installer/values-tmpl/headscale-user.jsonschema
new file mode 100644
index 0000000..e4884a6
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-user.jsonschema
@@ -0,0 +1,14 @@
+{
+ "type": "object",
+ "properties": {
+ "Username": { "type": "string" },
+ "PreAuthKey": {
+ "type": "object",
+ "properties": {
+ "Enabled": { "type": "boolean" }
+ },
+ "additionalProperties": false
+ }
+ },
+ "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/headscale-user.md b/core/installer/values-tmpl/headscale-user.md
new file mode 100644
index 0000000..7246082
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-user.md
@@ -0,0 +1 @@
+Creates Headscale user resource
diff --git a/core/installer/values-tmpl/headscale-user.yaml b/core/installer/values-tmpl/headscale-user.yaml
new file mode 100644
index 0000000..0eca8d0
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-user.yaml
@@ -0,0 +1,20 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: user-{{ .Values.Username }}
+ namespace: {{ .Release.Namespace }}
+spec:
+ chart:
+ spec:
+ chart: charts/headscale-user
+ sourceRef:
+ kind: GitRepository
+ name: pcloud
+ namespace: {{ .Global.Id }}
+ interval: 1m0s
+ values:
+ username: {{ .Values.Username }}
+ headscaleApiAddress: http://headscale-api.{{ .Global.Id }}-app-headscale.svc.cluster.local
+ preAuthKey:
+ enabled: {{ .Values.PreAuthKey.Enabled }}
+ secretName: {{ .Values.Username }}-headscale-preauthkey
diff --git a/core/installer/values-tmpl/tailscale-proxy.yaml b/core/installer/values-tmpl/tailscale-proxy.yaml
index 1774f1e..904f850 100644
--- a/core/installer/values-tmpl/tailscale-proxy.yaml
+++ b/core/installer/values-tmpl/tailscale-proxy.yaml
@@ -16,7 +16,7 @@
namespace: {{ .Global.Id }}
interval: 1m0s
values:
- hostname: {{ .Global.Id }}-{{ .Values.HostnameSuffix }}
+ hostname: {{ .Values.Hostname}}
apiServer: http://headscale-api.{{ .Global.Id }}-app-headscale.svc.cluster.local
loginServer: https://headscale.{{ .Global.Domain }} # TODO(gio): take headscale subdomain from configuration
ipSubnet: {{ .Values.IPSubnet }}
diff --git a/core/installer/welcome/create-admin-account.html b/core/installer/welcome/create-admin-account.html
index 5f6efd2..2b22074 100644
--- a/core/installer/welcome/create-admin-account.html
+++ b/core/installer/welcome/create-admin-account.html
@@ -36,7 +36,7 @@
aria-label="Secret Token"
required
/>
- <button type="submit" class="contrast">Create Account</button>
+ <button type="submit">Create Account</button>
</form>
</main>
</body>
diff --git a/core/installer/welcome/env.go b/core/installer/welcome/env.go
index 4e74181..3d3e332 100644
--- a/core/installer/welcome/env.go
+++ b/core/installer/welcome/env.go
@@ -556,9 +556,9 @@
return err
}
if err := appManager.Install(*app, nsGen, emptySuffixGen, map[string]any{
- "Username": "private-network-proxy",
- "IPSubnet": "10.1.0.0/24",
- "HostnameSuffix": "private-network-proxy",
+ "Hostname": "private-network-proxy",
+ "Username": "private-network-proxy",
+ "IPSubnet": "10.1.0.0/24",
}); err != nil {
return err
}
diff --git a/core/installer/welcome/welcome.go b/core/installer/welcome/welcome.go
index 2517a6f..e13ec3a 100644
--- a/core/installer/welcome/welcome.go
+++ b/core/installer/welcome/welcome.go
@@ -93,7 +93,11 @@
}
func (s *Server) createAdminAccount(w http.ResponseWriter, r *http.Request) {
- var req createAccountReq
+ req, err := extractReq(r)
+ if err != nil {
+ http.Error(w, err.Error(), http.StatusInternalServerError)
+ return
+ }
// TODO(giolekva): accounts-ui create user req
{
config, err := s.repo.ReadConfig()
@@ -127,19 +131,20 @@
}
}
{
- app, err := appsRepo.Find("tailscale-proxy")
+ app, err := appsRepo.Find("headscale-user")
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
if err := appManager.Install(*app, nsGen, suffixGen, map[string]any{
"Username": req.Username,
- "IPSubnet": "10.1.0.0/24", // TODO(giolekva): this should be taken from the config generated during new env creation
+ "PreAuthKey": map[string]any{
+ "Enabled": false,
+ },
}); err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
- // TODO(giolekva): headscale accept routes
}
}
if _, err := w.Write([]byte("OK")); err != nil {