mark some changes as more important

Signed-off-by: Kristoffer Dalby <kradalby@kradalby.no>
Add notes about current ssh status
2025-08-15 20:07:48 +00:00 · 2022-11-26 12:01:12 +01:00 · 2022-11-26 11:53:31 +01:00 · 2022-11-26 11:53:31 +01:00 · 2022-11-26 11:53:31 +01:00 · 2022-11-26 11:53:31 +01:00
1 changed files with 12 additions and 9 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,9 +7,20 @@
 - Log level option `log_level` was moved to a distinct `log` config section and renamed to `level` [#768](https://github.com/juanfont/headscale/pull/768)
 - Removed Alpine Linux container image [#962](https://github.com/juanfont/headscale/pull/962)

-### Changes
+### Important Changes

 - Added support for Tailscale TS2021 protocol [#738](https://github.com/juanfont/headscale/pull/738)
+- Add experimental support for [SSH ACL](https://tailscale.com/kb/1018/acls/#tailscale-ssh) (see docs for limitations) [#847](https://github.com/juanfont/headscale/pull/847)
+  - Please note that this support should be considered _partially_ implemented
+  - SSH ACLs status:
+    - Support `accept` and `check` (SSH can be enabled and used for connecting and authentication)
+    - Rejecting connections **are not supported**, meaning that if you enable SSH, then assume that _all_ `ssh` connections **will be allowed**.
+    - If you decied to try this feature, please carefully managed permissions by blocking port `22` with regular ACLs or do _not_ set `--ssh` on your clients.
+    - We are currently improving our testing of the SSH ACLs, help us get an overview by testing and giving feedback.
+  - This feature should be considered dangerous and it is disabled by default. Enable by setting `HEADSCALE_EXPERIMENTAL_FEATURE_SSH=1`.
+
+### Changes
+
 - Add ability to specify config location via env var `HEADSCALE_CONFIG` [#674](https://github.com/juanfont/headscale/issues/674)
 - Target Go 1.19 for Headscale [#778](https://github.com/juanfont/headscale/pull/778)
 - Target Tailscale v1.30.0 to build Headscale [#780](https://github.com/juanfont/headscale/pull/780)
@@ -29,14 +40,6 @@
 - Fix OIDC registration issues [#960](https://github.com/juanfont/headscale/pull/960) and [#971](https://github.com/juanfont/headscale/pull/971)
 - Add support for specifying NextDNS DNS-over-HTTPS resolver [#940](https://github.com/juanfont/headscale/pull/940)
 - Make more sslmode available for postgresql connection [#927](https://github.com/juanfont/headscale/pull/927)
- Add experimental support for [SSH ACL](https://tailscale.com/kb/1018/acls/#tailscale-ssh) (see docs for limitations) [#847](https://github.com/juanfont/headscale/pull/847)
-  - Please note that this support should be considered _partially_ implemented
-  - SSH ACLs status:
-    - Support `accept` and `check` (SSH can be enabled and used for connecting and authentication)
-    - Rejecting connections **are not supported**, meaning that if you enable SSH, then assume that _all_ `ssh` connections **will be allowed**.
-    - If you decied to try this feature, please carefully managed permissions by blocking port `22` with regular ACLs or do _not_ set `--ssh` on your clients.
-    - We are currently improving our testing of the SSH ACLs, help us get an overview by testing and giving feedback.
-  - This feature should be considered dangerous and it is disabled by default. Enable by setting `HEADSCALE_EXPERIMENTAL_FEATURE_SSH=1`.

 ## 0.16.4 (2022-08-21)
Author	SHA1	Message	Date
Kristoffer Dalby	eb072a1a74	mark some changes as more important Signed-off-by: Kristoffer Dalby <kradalby@kradalby.no>	2022-11-26 12:01:12 +01:00
Kristoffer Dalby	36b8862e7c	Add notes about current ssh status Signed-off-by: Kristoffer Dalby <kradalby@kradalby.no>	2022-11-26 11:53:31 +01:00
Even Holthe	d4e3bf184b	Add experimental flag to unit test	2022-11-26 11:53:31 +01:00
Even Holthe	c28ca27133	Add SSH ACL to changelog	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	c02e105065	Mark the flag properly experimental Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	22da5bfc1d	Enable SSH for tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	c6d31747f7	Add feature flag for SSH, and warning Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	91ed6e2197	Allow WithEnv to be passed multiple times Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	d71aef3b98	Mark all tests with Parallel Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	8a79c2e7ed	Do not retry on permission denied in ssh Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	f34e7c341b	Strip newline from hostname Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	e28d308796	Add negative tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Even Holthe	f610be632e	SSH: add test between namespaces	2022-11-26 11:53:31 +01:00
Even Holthe	fd6d25b5c1	SSH: Lint and typos	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	3695284286	Make simple initial test case This commit makes the initial SSH test a bit simpler: - Use the same pattern/functions for all clients as other tests - Only test within _one_ namespace/user to confirm the base case - Use retry function, same as taildrop, there is some funky going on there... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	cfaa36e51a	Add method to expose container id Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Kristoffer Dalby	d207c30949	Ensure we have ssh in container Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-26 11:53:31 +01:00
Even Holthe	519f22f9bf	SSH integration test setup	2022-11-26 11:53:31 +01:00
Even Holthe	52a323b90d	Add SSH capability advertisement Advertises the SSH capability, and parses the SSH ACLs to pass to the tailscale client. Doesn’t support ‘autogroup’ ACL functionality. Co-authored-by: Daniel Brooks <db48x@headline.com>	2022-11-26 11:53:31 +01:00