Skip to content

Commit 00cf167

Browse files
offbyoneoffbyone
committed
feat: add support for registering as a tailscale service host
Optionally register as a tailcale service host, instead of as an HTTP tsnet host. Notes: - uses x-forwarded-for for the remote IP, since we don't have the peer IP from the request (there's an internal proxy in place) Fixes: #214 Signed-off-by: Chris Rose <offline@offby1.net>
1 parent aa7bf1a commit 00cf167

4 files changed

Lines changed: 255 additions & 102 deletions

File tree

‎README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,50 @@ As long as this is on a persistent volume, the auth key only needs to be provide
5757
[tag]: https://tailscale.com/kb/1068/acl-tags/
5858
[os.UserConfigDir]: https://pkg.go.dev/os#UserConfigDir
5959

60+
## Registering as a Tailscale Service
61+
62+
By default, golink registers as a regular tailnet node. However, you can register it as a [Tailscale Service],
63+
which provides more stable identity and is especially useful for ephemeral infrastructure (like fly.io)
64+
where storage may be lost.
65+
66+
To register as a service:
67+
68+
```bash
69+
TS_AUTHKEY="tskey-auth-<key>" go run ./cmd/golink -sqlitedb golink.db --register-as-service=svc:golink
70+
```
71+
72+
Or using the environment variable:
73+
74+
```bash
75+
TS_SERVICE_NAME="svc:golink" TS_AUTHKEY="tskey-auth-<key>" go run ./cmd/golink -sqlitedb golink.db
76+
```
77+
78+
**Requirements:**
79+
- The node must be tagged (e.g., `tag:golink`)
80+
- Your ACL policy must define the service and include auto-approvers
81+
- Services only support HTTPS on port 443
82+
83+
**Admin Capabilities in Service Mode:**
84+
85+
Admin capability grants work in service mode by looking up the user's capabilities via the Tailscale daemon status API. This means admin permissions are properly enforced based on your ACL policy, just like in regular mode.
86+
87+
Example ACL configuration:
88+
89+
```json
90+
{
91+
"tagOwners": {
92+
"tag:golink": ["autogroup:admin"]
93+
},
94+
"autoApprovers": {
95+
"services": {
96+
"svc:golink": ["tag:golink"]
97+
}
98+
}
99+
}
100+
```
101+
102+
[Tailscale Service]: https://tailscale.com/kb/1534/services/
103+
60104
## Docker Compose
61105

62106
To run golink via Docker Compose:

‎go.mod‎

Lines changed: 25 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,56 @@
11
module github.com/tailscale/golink
22

3-
go 1.25.1
3+
go 1.25.5
44

55
require (
66
github.com/google/go-cmp v0.7.0
77
github.com/prometheus/client_golang v1.23.2
8-
golang.org/x/net v0.47.0
8+
golang.org/x/net v0.48.0
99
modernc.org/sqlite v1.39.1
10-
tailscale.com v1.88.4
10+
tailscale.com v1.94.2
1111
)
1212

1313
require (
1414
filippo.io/edwards25519 v1.1.0 // indirect
1515
github.com/akutz/memconn v0.1.0 // indirect
1616
github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa // indirect
17-
github.com/aws/aws-sdk-go-v2 v1.36.0 // indirect
17+
github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
1818
github.com/aws/aws-sdk-go-v2/config v1.29.5 // indirect
1919
github.com/aws/aws-sdk-go-v2/credentials v1.17.58 // indirect
2020
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.27 // indirect
21-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.31 // indirect
22-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.31 // indirect
21+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
22+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
2323
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 // indirect
24-
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2 // indirect
25-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.12 // indirect
26-
github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7 // indirect
24+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
25+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
2726
github.com/aws/aws-sdk-go-v2/service/sso v1.24.14 // indirect
2827
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.13 // indirect
29-
github.com/aws/aws-sdk-go-v2/service/sts v1.33.13 // indirect
30-
github.com/aws/smithy-go v1.22.2 // indirect
28+
github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
29+
github.com/aws/smithy-go v1.24.0 // indirect
3130
github.com/beorn7/perks v1.0.1 // indirect
3231
github.com/cespare/xxhash/v2 v2.3.0 // indirect
3332
github.com/coder/websocket v1.8.12 // indirect
34-
github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 // indirect
33+
github.com/creachadair/msync v0.7.1 // indirect
3534
github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa // indirect
36-
github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e // indirect
3735
github.com/dustin/go-humanize v1.0.1 // indirect
38-
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
36+
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
3937
github.com/gaissmai/bart v0.18.0 // indirect
4038
github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced // indirect
41-
github.com/go-ole/go-ole v1.3.0 // indirect
4239
github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 // indirect
43-
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
44-
github.com/google/btree v1.1.2 // indirect
45-
github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806 // indirect
40+
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
41+
github.com/google/btree v1.1.3 // indirect
4642
github.com/google/uuid v1.6.0 // indirect
4743
github.com/hdevalence/ed25519consensus v0.2.0 // indirect
48-
github.com/illarion/gonotify/v3 v3.0.2 // indirect
49-
github.com/jmespath/go-jmespath v0.4.0 // indirect
44+
github.com/huin/goupnp v1.3.0 // indirect
5045
github.com/jsimonetti/rtnetlink v1.4.0 // indirect
51-
github.com/klauspost/compress v1.18.0 // indirect
46+
github.com/klauspost/compress v1.18.2 // indirect
5247
github.com/mattn/go-isatty v0.0.20 // indirect
53-
github.com/mdlayher/genetlink v1.3.2 // indirect
5448
github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
55-
github.com/mdlayher/sdnotify v1.0.0 // indirect
5649
github.com/mdlayher/socket v0.5.0 // indirect
57-
github.com/miekg/dns v1.1.58 // indirect
5850
github.com/mitchellh/go-ps v1.0.0 // indirect
5951
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
6052
github.com/ncruces/go-strftime v0.1.9 // indirect
53+
github.com/pires/go-proxyproto v0.8.1 // indirect
6154
github.com/prometheus-community/pro-bing v0.4.0 // indirect
6255
github.com/prometheus/client_model v0.6.2 // indirect
6356
github.com/prometheus/common v0.66.1 // indirect
@@ -66,29 +59,25 @@ require (
6659
github.com/safchain/ethtool v0.3.0 // indirect
6760
github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e // indirect
6861
github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
69-
github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 // indirect
7062
github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a // indirect
71-
github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7 // indirect
7263
github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc // indirect
7364
github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976 // indirect
7465
github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da // indirect
75-
github.com/vishvananda/netns v0.0.5 // indirect
7666
github.com/x448/float16 v0.8.4 // indirect
7767
go.yaml.in/yaml/v2 v2.4.2 // indirect
7868
go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
7969
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
80-
golang.org/x/crypto v0.45.0 // indirect
70+
golang.org/x/crypto v0.46.0 // indirect
8171
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
82-
golang.org/x/mod v0.29.0 // indirect
83-
golang.org/x/sync v0.18.0 // indirect
84-
golang.org/x/sys v0.38.0 // indirect
85-
golang.org/x/term v0.37.0 // indirect
86-
golang.org/x/text v0.31.0 // indirect
87-
golang.org/x/time v0.11.0 // indirect
88-
golang.org/x/tools v0.38.0 // indirect
72+
golang.org/x/oauth2 v0.32.0 // indirect
73+
golang.org/x/sync v0.19.0 // indirect
74+
golang.org/x/sys v0.40.0 // indirect
75+
golang.org/x/term v0.38.0 // indirect
76+
golang.org/x/text v0.32.0 // indirect
77+
golang.org/x/time v0.12.0 // indirect
8978
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
9079
golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
91-
google.golang.org/protobuf v1.36.8 // indirect
80+
google.golang.org/protobuf v1.36.11 // indirect
9281
gvisor.dev/gvisor v0.0.0-20250205023644-9414b50a5633 // indirect
9382
modernc.org/libc v1.66.10 // indirect
9483
modernc.org/mathutil v1.7.1 // indirect

0 commit comments

Comments
 (0)