Merge pull request #193 from juanfont/fix-again-contributors

Another fix for the contributors section in README
Contributors again fixed
2025-08-19 05:57:26 +00:00 · 2021-10-21 23:55:41 +02:00 · 2021-10-21 23:54:20 +02:00 · 2021-10-21 23:32:43 +02:00 · 2021-10-21 23:21:38 +02:00 · 2021-10-21 22:53:30 +02:00
36 changed files with 1584 additions and 660 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,4 +33,4 @@ jobs:
      - uses: actions/upload-artifact@v2
        with:
          name: headscale-linux
-          path: headscale
+          path: headscale
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -0,0 +1,24 @@
+name: Contributors
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  add-contributors:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: BobAnkh/add-contributors@master
+        with:
+          CONTRIBUTOR: "## Contributors"
+          COLUMN_PER_ROW: "6"
+          ACCESS_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          IMG_WIDTH: "100"
+          FONT_SIZE: "14"
+          PATH: "/README.md"
+          COMMIT_MESSAGE: "docs(README): update contributors"
+          AVATAR_SHAPE: "round"
+          BRANCH: "update-contributors"
+          PULL_REQUEST: "main"
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,25 +4,27 @@ name: release
 on:
  push:
    tags:
-      - "*"  # triggers only if push new tag version
+      - "*" # triggers only if push new tag version
  workflow_dispatch:

 jobs:
  goreleaser:
-    runs-on: ubuntu-18.04  # due to CGO we need to user an older version
+    runs-on: ubuntu-18.04 # due to CGO we need to user an older version
    steps:
-      -
-        name: Checkout
+      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
-      -
-        name: Set up Go
+      - name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.16
-      -
-        name: Run GoReleaser
+
+      - name: Install dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y gcc-aarch64-linux-gnu
+      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        with:
          distribution: goreleaser
@@ -34,13 +36,11 @@ jobs:
  docker-release:
    runs-on: ubuntu-latest
    steps:
-      -
-        name: Checkout
+      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
-      -
-        name: Docker meta
+      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v3
        with:
@@ -53,21 +53,18 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
-      -
-        name: Login to DockerHub
+      - name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Login to GHCR
+      - name: Login to GHCR
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Build and push
+      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@v2
        with:
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -6,7 +6,7 @@ before:
 builds:
  - id: darwin-amd64
    main: ./cmd/headscale/headscale.go
-    mod_timestamp: '{{ .CommitTimestamp }}'
+    mod_timestamp: "{{ .CommitTimestamp }}"
    goos:
      - darwin
    goarch:
@@ -20,9 +20,10 @@ builds:
      - -mod=readonly
    ldflags:
      - -s -w -X github.com/juanfont/headscale/cmd/headscale/cli.Version=v{{.Version}}
+
  - id: linux-armhf
    main: ./cmd/headscale/headscale.go
-    mod_timestamp: '{{ .CommitTimestamp }}'
+    mod_timestamp: "{{ .CommitTimestamp }}"
    goos:
      - linux
    goarch:
@@ -41,7 +42,6 @@ builds:
    ldflags:
      - -s -w -X github.com/juanfont/headscale/cmd/headscale/cli.Version=v{{.Version}}

-
  - id: linux-amd64
    env:
      - CGO_ENABLED=1
@@ -49,11 +49,21 @@ builds:
      - linux
    goarch:
      - amd64
-    goarm:
-      - 6
-      - 7
    main: ./cmd/headscale/headscale.go
-    mod_timestamp: '{{ .CommitTimestamp }}'
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    ldflags:
+      - -s -w -X github.com/juanfont/headscale/cmd/headscale/cli.Version=v{{.Version}}
+
+  - id: linux-arm64
+    goos:
+      - linux
+    goarch:
+      - arm64
+    env:
+      - CGO_ENABLED=1
+      - CC=aarch64-linux-gnu-gcc
+    main: ./cmd/headscale/headscale.go
+    mod_timestamp: "{{ .CommitTimestamp }}"
    ldflags:
      - -s -w -X github.com/juanfont/headscale/cmd/headscale/cli.Version=v{{.Version}}

@@ -63,16 +73,17 @@ archives:
      - darwin-amd64
      - linux-armhf
      - linux-amd64
+      - linux-arm64
    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
    format: binary

 checksum:
-  name_template: 'checksums.txt'
+  name_template: "checksums.txt"
 snapshot:
  name_template: "{{ .Tag }}-next"
 changelog:
  sort: asc
  filters:
    exclude:
-      - '^docs:'
-      - '^test:'
+      - "^docs:"
+      - "^test:"
--- a/README.md
+++ b/README.md
@@ -1,9 +1,11 @@
-# Headscale
+# headscale

-[![Join the chat at https://gitter.im/headscale-dev/community](https://badges.gitter.im/headscale-dev/community.svg)](https://gitter.im/headscale-dev/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) ![ci](https://github.com/juanfont/headscale/actions/workflows/test.yml/badge.svg)
+![ci](https://github.com/juanfont/headscale/actions/workflows/test.yml/badge.svg)

 An open source, self-hosted implementation of the Tailscale coordination server.

+Join our [Discord](https://discord.gg/XcQxk2VHjx) server for a chat.
+
 ## Overview

 Tailscale is [a modern VPN](https://tailscale.com/) built on top of [Wireguard](https://www.wireguard.com/). It [works like an overlay network](https://tailscale.com/blog/how-tailscale-works/) between the computers of your networks - using all kinds of [NAT traversal sorcery](https://tailscale.com/blog/how-nat-traversal-works/).
@@ -12,14 +14,14 @@ Everything in Tailscale is Open Source, except the GUI clients for proprietary O

 The control server works as an exchange point of Wireguard public keys for the nodes in the Tailscale network. It also assigns the IP addresses of the clients, creates the boundaries between each user, enables sharing machines between users, and exposes the advertised routes of your nodes.

-Headscale implements this coordination server.
+headscale implements this coordination server.

 ## Status

 - [x] Base functionality (nodes can communicate with each other)
 - [x] Node registration through the web flow
 - [x] Network changes are relayed to the nodes
- [x] Namespace support (~equivalent to multi-user in Tailscale.com)
+- [x] Namespaces support (~tailnets in Tailscale.com naming)
 - [x] Routing (advertise & accept, including exit nodes)
 - [x] Node registration via pre-auth keys (including reusable keys, and ephemeral node support)
 - [x] JSON-formatted output
@@ -27,245 +29,36 @@ Headscale implements this coordination server.
 - [x] Taildrop (File Sharing)
 - [x] Support for alternative IP ranges in the tailnets (default Tailscale's 100.64.0.0/10)
 - [x] DNS (passing DNS servers to nodes)
- [x] Share nodes between ~~users~~ namespaces
- [ ] MagicDNS / Smart DNS
+- [x] Share nodes between namespaces
+- [x] MagicDNS (see `docs/`)

 ## Client OS support

-| OS | Supports headscale |
-| --- | --- |
-| Linux | Yes |
-| OpenBSD | Yes |
-| macOS | Yes (see `/apple` on your headscale for more information) |
-| Windows | Yes |
+| OS      | Supports headscale                                                                                                |
+| ------- | ----------------------------------------------------------------------------------------------------------------- |
+| Linux   | Yes                                                                                                               |
+| OpenBSD | Yes                                                                                                               |
+| macOS   | Yes (see `/apple` on your headscale for more information)                                                         |
+| Windows | Yes                                                                                                               |
 | Android | [You need to compile the client yourself](https://github.com/juanfont/headscale/issues/58#issuecomment-885255270) |
-| iOS | Not yet |
+| iOS     | Not yet                                                                                                           |

 ## Roadmap 🤷

 Suggestions/PRs welcomed!

-## Running it

-1. Download the Headscale binary https://github.com/juanfont/headscale/releases, and place it somewhere in your PATH or use the docker container
+## Running headscale

-   ```shell
-   docker pull headscale/headscale:x.x.x
-   ```
+Please have a look at the documentation under [`docs/`](docs/).

-   <!--
-    or
-    ```shell
-    docker pull ghrc.io/juanfont/headscale:x.x.x
-    ``` -->
-
-2. (Optional, you can also use SQLite) Get yourself a PostgreSQL DB running
-
-   ```shell
-   docker run --name headscale -e POSTGRES_DB=headscale -e \
-     POSTGRES_USER=foo -e POSTGRES_PASSWORD=bar -p 5432:5432 -d postgres
-   ```
-
-3. Set some stuff up (headscale Wireguard keys & the config.json file)
-
-   ```shell
-   wg genkey > private.key
-   wg pubkey < private.key > public.key  # not needed
-
-   # Postgres
-   cp config.json.postgres.example config.json
-   # or
-   # SQLite
-   cp config.json.sqlite.example config.json
-   ```
-
-4. Create a namespace (a namespace is a 'tailnet', a group of Tailscale nodes that can talk to each other)
-
-   ```shell
-   headscale namespaces create myfirstnamespace
-   ```
-
-   or docker:
-
-   the db.sqlite mount is only needed if you use sqlite
-
-   ```shell
-   touch db.sqlite
-   docker run -v $(pwd)/private.key:/private.key -v $(pwd)/config.json:/config.json -v $(pwd)/derp.yaml:/derp.yaml -v $(pwd)/db.sqlite:/db.sqlite -p 127.0.0.1:8080:8080 headscale/headscale:x.x.x headscale namespaces create myfirstnamespace
-   ```
-
-   or if your server is already running in docker:
-
-   ```shell
-   docker exec <container_name> headscale create myfirstnamespace
-   ```
-
-5. Run the server
-
-   ```shell
-   headscale serve
-   ```
-
-   or docker:
-
-   the db.sqlite mount is only needed if you use sqlite
-
-   ```shell
-   docker run -v $(pwd)/private.key:/private.key -v $(pwd)/config.json:/config.json -v $(pwd)/derp.yaml:/derp.yaml -v $(pwd)/db.sqlite:/db.sqlite -p 127.0.0.1:8080:8080 headscale/headscale:x.x.x headscale serve
-   ```
-
-6. If you used tailscale.com before in your nodes, make sure you clear the tailscald data folder
-
-   ```shell
-   systemctl stop tailscaled
-   rm -fr /var/lib/tailscale
-   systemctl start tailscaled
-   ```
-
-7. Add your first machine
-
-   ```shell
-   tailscale up --login-server YOUR_HEADSCALE_URL
-   ```
-
-8. Navigate to the URL you will get with `tailscale up`, where you'll find your machine key.
-
-9. In the server, register your machine to a namespace with the CLI
-   ```shell
-   headscale -n myfirstnamespace nodes register YOURMACHINEKEY
-   ```
-   or docker:
-   ```shell
-   docker run -v $(pwd)/private.key:/private.key -v $(pwd)/config.json:/config.json -v $(pwd)/derp.yaml:/derp.yaml headscale/headscale:x.x.x headscale -n myfirstnamespace nodes register YOURMACHINEKEY
-   ```
-   or if your server is already running in docker:
-   ```shell
-   docker exec <container_name> headscale -n myfirstnamespace nodes register YOURMACHINEKEY
-   ```
-
-Alternatively, you can use Auth Keys to register your machines:
-
-1. Create an authkey
-
-   ```shell
-   headscale -n myfirstnamespace preauthkeys create --reusable --expiration 24h
-   ```
-
-   or docker:
-
-   ```shell
-   docker run -v $(pwd)/private.key:/private.key -v $(pwd)/config.json:/config.json -v$(pwd)/derp.yaml:/derp.yaml -v $(pwd)/db.sqlite:/db.sqlite headscale/headscale:x.x.x headscale -n myfirstnamespace preauthkeys create --reusable --expiration 24h
-   ```
-
-   or if your server is already running in docker:
-
-   ```shell
-   docker exec <container_name> headscale -n myfirstnamespace preauthkeys create --reusable --expiration 24h
-   ```
-
-2. Use the authkey from your machine to register it
-   ```shell
-   tailscale up --login-server YOUR_HEADSCALE_URL --authkey YOURAUTHKEY
-   ```
-
-If you create an authkey with the `--ephemeral` flag, that key will create ephemeral nodes. This implies that `--reusable` is true.
-
-Please bear in mind that all the commands from headscale support adding `-o json` or `-o json-line` to get a nicely JSON-formatted output.
-
-## Configuration reference
-
-Headscale's configuration file is named `config.json` or `config.yaml`. Headscale will look for it in `/etc/headscale`, `~/.headscale` and finally the directory from where the Headscale binary is executed.
-
-```
-    "server_url": "http://192.168.1.12:8080",
-    "listen_addr": "0.0.0.0:8080",
-    "ip_prefix": "100.64.0.0/10"
-```
-
-`server_url` is the external URL via which Headscale is reachable. `listen_addr` is the IP address and port the Headscale program should listen on. `ip_prefix` is the IP prefix (range) in which IP addresses for nodes will be allocated (default 100.64.0.0/10, e.g., 192.168.4.0/24, 10.0.0.0/8)
-
-```
-    "log_level": "debug"
-```
-
-`log_level` can be used to set the Log level for Headscale, it defaults to `debug`, and the available levels are: `trace`, `debug`, `info`, `warn` and `error`.
-
-```
-    "private_key_path": "private.key",
-```
-
-`private_key_path` is the path to the Wireguard private key. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from.
-
-```
-    "derp_map_path": "derp.yaml",
-```
-
-`derp_map_path` is the path to the [DERP](https://pkg.go.dev/tailscale.com/derp) map file. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from.
-
-```
-    "ephemeral_node_inactivity_timeout": "30m",
-```
-
-`ephemeral_node_inactivity_timeout` is the timeout after which inactive ephemeral node records will be deleted from the database. The default is 30 minutes. This value must be higher than 65 seconds (the keepalive timeout for the HTTP long poll is 60 seconds, plus a few seconds to avoid race conditions).
-
-```
-    "db_host": "localhost",
-    "db_port": 5432,
-    "db_name": "headscale",
-    "db_user": "foo",
-    "db_pass": "bar",
-```
-
-The fields starting with `db_` are used for the PostgreSQL connection information.
-
-### Running the service via TLS (optional)
-
-```
-    "tls_cert_path": ""
-    "tls_key_path": ""
-```
-
-Headscale can be configured to expose its web service via TLS. To configure the certificate and key file manually, set the `tls_cert_path` and `tls_cert_path` configuration parameters. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from.
-
-```
-    "tls_letsencrypt_hostname": "",
-    "tls_letsencrypt_listen": ":http",
-    "tls_letsencrypt_cache_dir": ".cache",
-    "tls_letsencrypt_challenge_type": "HTTP-01",
-```
-
-To get a certificate automatically via [Let's Encrypt](https://letsencrypt.org/), set `tls_letsencrypt_hostname` to the desired certificate hostname. This name must resolve to the IP address(es) Headscale is reachable on (i.e., it must correspond to the `server_url` configuration parameter). The certificate and Let's Encrypt account credentials will be stored in the directory configured in `tls_letsencrypt_cache_dir`. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from. The certificate will automatically be renewed as needed.
-
-#### Challenge type HTTP-01
-
-The default challenge type `HTTP-01` requires that Headscale is reachable on port 80 for the Let's Encrypt automated validation, in addition to whatever port is configured in `listen_addr`. By default, Headscale listens on port 80 on all local IPs for Let's Encrypt automated validation.
-
-If you need to change the ip and/or port used by Headscale for the Let's Encrypt validation process, set `tls_letsencrypt_listen` to the appropriate value. This can be handy if you are running Headscale as a non-root user (or can't run `setcap`). Keep in mind, however, that Let's Encrypt will _only_ connect to port 80 for the validation callback, so if you change `tls_letsencrypt_listen` you will also need to configure something else (e.g. a firewall rule) to forward the traffic from port 80 to the ip:port combination specified in `tls_letsencrypt_listen`.
-
-#### Challenge type TLS-ALPN-01
-
-Alternatively, `tls_letsencrypt_challenge_type` can be set to `TLS-ALPN-01`. In this configuration, Headscale listens on the ip:port combination defined in `listen_addr`. Let's Encrypt will _only_ connect to port 443 for the validation callback, so if `listen_addr` is not set to port 443, something else (e.g. a firewall rule) will be required to forward the traffic from port 443 to the ip:port combination specified in `listen_addr`.
-
-### Policy ACLs
-
-Headscale implements the same policy ACLs as Tailscale.com, adapted to the self-hosted environment.
-
-For instance, instead of referring to users when defining groups you must
-use namespaces (which are the equivalent to user/logins in Tailscale.com).
-
-Please check https://tailscale.com/kb/1018/acls/, and `./tests/acls/` in this repo for working examples.
-
-### Apple devices
-
-An endpoint with information on how to connect your Apple devices (currently macOS only) is available at `/apple` on your running instance.

 ## Disclaimer

 1. We have nothing to do with Tailscale, or Tailscale Inc.
 2. The purpose of writing this was to learn how Tailscale works.

-## More on Tailscale

- https://tailscale.com/blog/how-tailscale-works/
- https://tailscale.com/blog/tailscale-key-management/
- https://tailscale.com/blog/an-unlikely-database-migration/
+## Contributors
+
+
--- a/api.go
+++ b/api.go
@@ -225,7 +225,7 @@ func (h *Headscale) getMapResponse(mKey wgkey.Key, req tailcfg.MapRequest, m *Ma
 		Str("func", "getMapResponse").
 		Str("machine", req.Hostinfo.Hostname).
 		Msg("Creating Map response")
-	node, err := m.toNode(true)
+	node, err := m.toNode(h.cfg.BaseDomain, h.cfg.DNSConfig, true)
 	if err != nil {
 		log.Error().
 			Str("func", "getMapResponse").
@@ -243,13 +243,9 @@ func (h *Headscale) getMapResponse(mKey wgkey.Key, req tailcfg.MapRequest, m *Ma
 		return nil, err
 	}

-	profile := tailcfg.UserProfile{
-		ID:          tailcfg.UserID(m.NamespaceID),
-		LoginName:   m.Namespace.Name,
-		DisplayName: m.Namespace.Name,
-	}
+	profiles := getMapResponseUserProfiles(*m, peers)

-	nodePeers, err := peers.toNodes(true)
+	nodePeers, err := peers.toNodes(h.cfg.BaseDomain, h.cfg.DNSConfig, true)
 	if err != nil {
 		log.Error().
 			Str("func", "getMapResponse").
@@ -258,22 +254,26 @@ func (h *Headscale) getMapResponse(mKey wgkey.Key, req tailcfg.MapRequest, m *Ma
 		return nil, err
 	}

+	dnsConfig, err := getMapResponseDNSConfig(h.cfg.DNSConfig, h.cfg.BaseDomain, *m, peers)
+	if err != nil {
+		log.Error().
+			Str("func", "getMapResponse").
+			Err(err).
+			Msg("Failed generate the DNSConfig")
+		return nil, err
+	}
+
 	resp := tailcfg.MapResponse{
-		KeepAlive: false,
-		Node:      node,
-		Peers:     nodePeers,
-		// TODO(kradalby): As per tailscale docs, if DNSConfig is nil,
-		// it means its not updated, maybe we can have some logic
-		// to check and only pass updates when its updates.
-		// This is probably more relevant if we try to implement
-		// "MagicDNS"
-		DNSConfig:    h.cfg.DNSConfig,
-		SearchPaths:  []string{},
-		Domain:       "headscale.net",
+		KeepAlive:    false,
+		Node:         node,
+		Peers:        nodePeers,
+		DNSConfig:    dnsConfig,
+		Domain:       h.cfg.BaseDomain,
 		PacketFilter: *h.aclRules,
 		DERPMap:      h.cfg.DerpMap,
-		UserProfiles: []tailcfg.UserProfile{profile},
+		UserProfiles: profiles,
 	}
+
 	log.Trace().
 		Str("func", "getMapResponse").
 		Str("machine", req.Hostinfo.Hostname).
@@ -337,6 +337,11 @@ func (h *Headscale) handleAuthKey(c *gin.Context, db *gorm.DB, idKey wgkey.Key,
 	resp := tailcfg.RegisterResponse{}
 	pak, err := h.checkKeyValidity(req.Auth.AuthKey)
 	if err != nil {
+		log.Error().
+			Str("func", "handleAuthKey").
+			Str("machine", m.Name).
+			Err(err).
+			Msg("Failed authentication via AuthKey")
 		resp.MachineAuthorized = false
 		respBody, err := encode(resp, &idKey, h.privateKey)
 		if err != nil {
@@ -385,6 +390,9 @@ func (h *Headscale) handleAuthKey(c *gin.Context, db *gorm.DB, idKey wgkey.Key,
 	m.RegisterMethod = "authKey"
 	db.Save(&m)

+	pak.Used = true
+	db.Save(&pak)
+
 	resp.MachineAuthorized = true
 	resp.User = *pak.Namespace.toUser()
 	respBody, err := encode(resp, &idKey, h.privateKey)
--- a/app.go
+++ b/app.go
@@ -13,12 +13,13 @@ import (
 	"github.com/rs/zerolog/log"

 	"github.com/gin-gonic/gin"
-	"github.com/zsais/go-gin-prometheus"
+	ginprometheus "github.com/zsais/go-gin-prometheus"
 	"golang.org/x/crypto/acme"
 	"golang.org/x/crypto/acme/autocert"
 	"gorm.io/gorm"
 	"inet.af/netaddr"
 	"tailscale.com/tailcfg"
+	"tailscale.com/types/dnstype"
 	"tailscale.com/types/wgkey"
 )

@@ -30,6 +31,7 @@ type Config struct {
 	DerpMap                        *tailcfg.DERPMap
 	EphemeralNodeInactivityTimeout time.Duration
 	IPPrefix                       netaddr.IPPrefix
+	BaseDomain                     string

 	DBtype string
 	DBpath string
@@ -106,6 +108,20 @@ func NewHeadscale(cfg Config) (*Headscale, error) {
 		return nil, err
 	}

+	if h.cfg.DNSConfig != nil && h.cfg.DNSConfig.Proxied { // if MagicDNS
+		magicDNSDomains, err := generateMagicDNSRootDomains(h.cfg.IPPrefix, h.cfg.BaseDomain)
+		if err != nil {
+			return nil, err
+		}
+		// we might have routes already from Split DNS
+		if h.cfg.DNSConfig.Routes == nil { 
+			h.cfg.DNSConfig.Routes = make(map[string][]dnstype.Resolver)
+		}
+		for _, d := range magicDNSDomains {
+			h.cfg.DNSConfig.Routes[d.WithoutTrailingDot()] = nil
+		}
+	}
+
 	return &h, nil
 }

--- a/cmd/headscale/cli/namespaces.go
+++ b/cmd/headscale/cli/namespaces.go
@@ -15,6 +15,7 @@ func init() {
 	namespaceCmd.AddCommand(createNamespaceCmd)
 	namespaceCmd.AddCommand(listNamespacesCmd)
 	namespaceCmd.AddCommand(destroyNamespaceCmd)
+	namespaceCmd.AddCommand(renameNamespaceCmd)
 }

 var namespaceCmd = &cobra.Command{
@@ -107,3 +108,31 @@ var listNamespacesCmd = &cobra.Command{
 		}
 	},
 }
+
+var renameNamespaceCmd = &cobra.Command{
+	Use:   "rename OLD_NAME NEW_NAME",
+	Short: "Renames a namespace",
+	Args: func(cmd *cobra.Command, args []string) error {
+		if len(args) < 2 {
+			return fmt.Errorf("Missing parameters")
+		}
+		return nil
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		o, _ := cmd.Flags().GetString("output")
+		h, err := getHeadscaleApp()
+		if err != nil {
+			log.Fatalf("Error initializing: %s", err)
+		}
+		err = h.RenameNamespace(args[0], args[1])
+		if strings.HasPrefix(o, "json") {
+			JsonOutput(map[string]string{"Result": "Namespace renamed"}, err, o)
+			return
+		}
+		if err != nil {
+			fmt.Printf("Error renaming namespace: %s\n", err)
+			return
+		}
+		fmt.Printf("Namespace renamed\n")
+	},
+}
--- a/cmd/headscale/cli/nodes.go
+++ b/cmd/headscale/cli/nodes.go
@@ -26,6 +26,7 @@ func init() {
 	nodeCmd.AddCommand(registerNodeCmd)
 	nodeCmd.AddCommand(deleteNodeCmd)
 	nodeCmd.AddCommand(shareMachineCmd)
+	nodeCmd.AddCommand(unshareMachineCmd)
 }

 var nodeCmd = &cobra.Command{
@@ -129,6 +130,7 @@ var deleteNodeCmd = &cobra.Command{
 		return nil
 	},
 	Run: func(cmd *cobra.Command, args []string) {
+		output, _ := cmd.Flags().GetString("output")
 		h, err := getHeadscaleApp()
 		if err != nil {
 			log.Fatalf("Error initializing: %s", err)
@@ -143,21 +145,32 @@ var deleteNodeCmd = &cobra.Command{
 		}

 		confirm := false
-		prompt := &survey.Confirm{
-			Message: fmt.Sprintf("Do you want to remove the node %s?", m.Name),
-		}
-		err = survey.AskOne(prompt, &confirm)
-		if err != nil {
-			return
+		force, _ := cmd.Flags().GetBool("force")
+		if !force {
+			prompt := &survey.Confirm{
+				Message: fmt.Sprintf("Do you want to remove the node %s?", m.Name),
+			}
+			err = survey.AskOne(prompt, &confirm)
+			if err != nil {
+				return
+			}
 		}

-		if confirm {
+		if confirm || force {
 			err = h.DeleteMachine(m)
+			if strings.HasPrefix(output, "json") {
+				JsonOutput(map[string]string{"Result": "Node deleted"}, err, output)
+				return
+			}
 			if err != nil {
 				log.Fatalf("Error deleting node: %s", err)
 			}
 			fmt.Printf("Node deleted\n")
 		} else {
+			if strings.HasPrefix(output, "json") {
+				JsonOutput(map[string]string{"Result": "Node not deleted"}, err, output)
+				return
+			}
 			fmt.Printf("Node not deleted\n")
 		}
 	},
@@ -217,6 +230,55 @@ var shareMachineCmd = &cobra.Command{
 	},
 }

+var unshareMachineCmd = &cobra.Command{
+	Use:   "unshare ID",
+	Short: "Unshares a node from the specified namespace",
+	Args: func(cmd *cobra.Command, args []string) error {
+		if len(args) < 1 {
+			return fmt.Errorf("missing parameters")
+		}
+		return nil
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		namespace, err := cmd.Flags().GetString("namespace")
+		if err != nil {
+			log.Fatalf("Error getting namespace: %s", err)
+		}
+		output, _ := cmd.Flags().GetString("output")
+
+		h, err := getHeadscaleApp()
+		if err != nil {
+			log.Fatalf("Error initializing: %s", err)
+		}
+
+		n, err := h.GetNamespace(namespace)
+		if err != nil {
+			log.Fatalf("Error fetching namespace: %s", err)
+		}
+
+		id, err := strconv.Atoi(args[0])
+		if err != nil {
+			log.Fatalf("Error converting ID to integer: %s", err)
+		}
+		machine, err := h.GetMachineByID(uint64(id))
+		if err != nil {
+			log.Fatalf("Error getting node: %s", err)
+		}
+
+		err = h.RemoveSharedMachineFromNamespace(machine, n)
+		if strings.HasPrefix(output, "json") {
+			JsonOutput(map[string]string{"Result": "Node unshared"}, err, output)
+			return
+		}
+		if err != nil {
+			fmt.Printf("Error unsharing node: %s\n", err)
+			return
+		}
+
+		fmt.Println("Node unshared!")
+	},
+}
+
 func nodesToPtables(currentNamespace headscale.Namespace, machines []headscale.Machine) (pterm.TableData, error) {
 	d := pterm.TableData{{"ID", "Name", "NodeKey", "Namespace", "IP address", "Ephemeral", "Last seen", "Online"}}

--- a/cmd/headscale/cli/preauthkeys.go
+++ b/cmd/headscale/cli/preauthkeys.go
@@ -57,7 +57,7 @@ var listPreAuthKeys = &cobra.Command{
 			return
 		}

-		d := pterm.TableData{{"ID", "Key", "Reusable", "Ephemeral", "Expiration", "Created"}}
+		d := pterm.TableData{{"ID", "Key", "Reusable", "Ephemeral", "Used", "Expiration", "Created"}}
 		for _, k := range *keys {
 			expiration := "-"
 			if k.Expiration != nil {
@@ -76,6 +76,7 @@ var listPreAuthKeys = &cobra.Command{
 				k.Key,
 				reusable,
 				strconv.FormatBool(k.Ephemeral),
+				fmt.Sprintf("%v", k.Used),
 				expiration,
 				k.CreatedAt.Format("2006-01-02 15:04:05"),
 			})
@@ -130,7 +131,7 @@ var createPreAuthKeyCmd = &cobra.Command{
 }

 var expirePreAuthKeyCmd = &cobra.Command{
-	Use:   "expire",
+	Use:   "expire KEY",
 	Short: "Expire a preauthkey",
 	Args: func(cmd *cobra.Command, args []string) error {
 		if len(args) < 1 {
@@ -152,6 +153,10 @@ var expirePreAuthKeyCmd = &cobra.Command{

 		k, err := h.GetPreAuthKey(n, args[0])
 		if err != nil {
+			if strings.HasPrefix(o, "json") {
+				JsonOutput(k, err, o)
+				return
+			}
 			log.Fatalf("Error getting the key: %s", err)
 		}

--- a/cmd/headscale/cli/root.go
+++ b/cmd/headscale/cli/root.go
@@ -9,6 +9,7 @@ import (

 func init() {
 	rootCmd.PersistentFlags().StringP("output", "o", "", "Output format. Empty for human-readable, 'json' or 'json-line'")
+	rootCmd.PersistentFlags().Bool("force", false, "Disable prompts and forces the execution")
 }

 var rootCmd = &cobra.Command{
--- a/cmd/headscale/cli/utils.go
+++ b/cmd/headscale/cli/utils.go
@@ -76,7 +76,7 @@ func LoadConfig(path string) error {

 }

-func GetDNSConfig() *tailcfg.DNSConfig {
+func GetDNSConfig() (*tailcfg.DNSConfig, string) {
 	if viper.IsSet("dns_config") {
 		dnsConfig := &tailcfg.DNSConfig{}

@@ -104,14 +104,58 @@ func GetDNSConfig() *tailcfg.DNSConfig {
 			dnsConfig.Nameservers = nameservers
 			dnsConfig.Resolvers = resolvers
 		}
+
+		if viper.IsSet("dns_config.restricted_nameservers") {
+			if len(dnsConfig.Nameservers) > 0 {
+				dnsConfig.Routes = make(map[string][]dnstype.Resolver)
+				restrictedDNS := viper.GetStringMapStringSlice("dns_config.restricted_nameservers")
+				for domain, restrictedNameservers := range restrictedDNS {
+					restrictedResolvers := make([]dnstype.Resolver, len(restrictedNameservers))
+					for index, nameserverStr := range restrictedNameservers {
+						nameserver, err := netaddr.ParseIP(nameserverStr)
+						if err != nil {
+							log.Error().
+								Str("func", "getDNSConfig").
+								Err(err).
+								Msgf("Could not parse restricted nameserver IP: %s", nameserverStr)
+						}
+						restrictedResolvers[index] = dnstype.Resolver{
+							Addr: nameserver.String(),
+						}
+					}
+					dnsConfig.Routes[domain] = restrictedResolvers
+				}
+			} else {
+				log.Warn().
+					Msg("Warning: dns_config.restricted_nameservers is set, but no nameservers are configured. Ignoring restricted_nameservers.")
+			}
+		}
+
 		if viper.IsSet("dns_config.domains") {
 			dnsConfig.Domains = viper.GetStringSlice("dns_config.domains")
 		}

-		return dnsConfig
+		if viper.IsSet("dns_config.magic_dns") {
+			magicDNS := viper.GetBool("dns_config.magic_dns")
+			if len(dnsConfig.Nameservers) > 0 {
+				dnsConfig.Proxied = magicDNS
+			} else if magicDNS {
+				log.Warn().
+					Msg("Warning: dns_config.magic_dns is set, but no nameservers are configured. Ignoring magic_dns.")
+			}
+		}
+
+		var baseDomain string
+		if viper.IsSet("dns_config.base_domain") {
+			baseDomain = viper.GetString("dns_config.base_domain")
+		} else {
+			baseDomain = "headscale.net" // does not really matter when MagicDNS is not enabled
+		}
+
+		return dnsConfig, baseDomain
 	}

-	return nil
+	return nil, ""
 }

 func absPath(path string) string {
@@ -144,12 +188,15 @@ func getHeadscaleApp() (*headscale.Headscale, error) {
 		return nil, err
 	}

+	dnsConfig, baseDomain := GetDNSConfig()
+
 	cfg := headscale.Config{
 		ServerURL:      viper.GetString("server_url"),
 		Addr:           viper.GetString("listen_addr"),
 		PrivateKeyPath: absPath(viper.GetString("private_key_path")),
 		DerpMap:        derpMap,
 		IPPrefix:       netaddr.MustParseIPPrefix(viper.GetString("ip_prefix")),
+		BaseDomain:     baseDomain,

 		EphemeralNodeInactivityTimeout: viper.GetDuration("ephemeral_node_inactivity_timeout"),

@@ -169,10 +216,10 @@ func getHeadscaleApp() (*headscale.Headscale, error) {
 		TLSCertPath: absPath(viper.GetString("tls_cert_path")),
 		TLSKeyPath:  absPath(viper.GetString("tls_key_path")),

+		DNSConfig: dnsConfig,
+
 		ACMEEmail: viper.GetString("acme_email"),
 		ACMEURL:   viper.GetString("acme_url"),
-
-		DNSConfig: GetDNSConfig(),
 	}

 	h, err := headscale.NewHeadscale(cfg)
@@ -242,3 +289,12 @@ func JsonOutput(result interface{}, errResult error, outputFormat string) {
 	}
 	fmt.Println(string(j))
 }
+
+func HasJsonOutputFlag() bool {
+	for _, arg := range os.Args {
+		if arg == "json" || arg == "json-line" {
+			return true
+		}
+	}
+	return false
+}
--- a/cmd/headscale/headscale.go
+++ b/cmd/headscale/headscale.go
@@ -62,7 +62,8 @@ func main() {
 		zerolog.SetGlobalLevel(zerolog.DebugLevel)
 	}

-	if !viper.GetBool("disable_check_updates") {
+	jsonOutput := cli.HasJsonOutputFlag()
+	if !viper.GetBool("disable_check_updates") && !jsonOutput {
 		if (runtime.GOOS == "linux" || runtime.GOOS == "darwin") && cli.Version != "dev" {
 			githubTag := &latest.GithubTag{
 				Owner:      "juanfont",
--- a/cmd/headscale/headscale_test.go
+++ b/cmd/headscale/headscale_test.go
@@ -41,7 +41,7 @@ func (*Suite) TestPostgresConfigLoading(c *check.C) {
 	}

 	// Symlink the example config file
-	err = os.Symlink(filepath.Clean(path+"/../../config.json.postgres.example"), filepath.Join(tmpDir, "config.json"))
+	err = os.Symlink(filepath.Clean(path+"/../../config.yaml.postgres.example"), filepath.Join(tmpDir, "config.yaml"))
 	if err != nil {
 		c.Fatal(err)
 	}
@@ -74,7 +74,7 @@ func (*Suite) TestSqliteConfigLoading(c *check.C) {
 	}

 	// Symlink the example config file
-	err = os.Symlink(filepath.Clean(path+"/../../config.json.sqlite.example"), filepath.Join(tmpDir, "config.json"))
+	err = os.Symlink(filepath.Clean(path+"/../../config.yaml.sqlite.example"), filepath.Join(tmpDir, "config.yaml"))
 	if err != nil {
 		c.Fatal(err)
 	}
@@ -108,7 +108,7 @@ func (*Suite) TestDNSConfigLoading(c *check.C) {
 	}

 	// Symlink the example config file
-	err = os.Symlink(filepath.Clean(path+"/../../config.json.sqlite.example"), filepath.Join(tmpDir, "config.json"))
+	err = os.Symlink(filepath.Clean(path+"/../../config.yaml.sqlite.example"), filepath.Join(tmpDir, "config.yaml"))
 	if err != nil {
 		c.Fatal(err)
 	}
@@ -117,12 +117,12 @@ func (*Suite) TestDNSConfigLoading(c *check.C) {
 	err = cli.LoadConfig(tmpDir)
 	c.Assert(err, check.IsNil)

-	dnsConfig := cli.GetDNSConfig()
-	fmt.Println(dnsConfig)
+	dnsConfig, baseDomain := cli.GetDNSConfig()

 	c.Assert(dnsConfig.Nameservers[0].String(), check.Equals, "1.1.1.1")
-
 	c.Assert(dnsConfig.Resolvers[0].Addr, check.Equals, "1.1.1.1")
+	c.Assert(dnsConfig.Proxied, check.Equals, true)
+	c.Assert(baseDomain, check.Equals, "example.com")
 }

 func writeConfig(c *check.C, tmpDir string, configYaml []byte) {
--- a/config.json.postgres.example
+++ b/config.json.postgres.example
@@ -1,27 +0,0 @@
-{
-    "server_url": "http://127.0.0.1:8080",
-    "listen_addr": "0.0.0.0:8080",
-    "private_key_path": "private.key",
-    "derp_map_path": "derp.yaml",
-    "ephemeral_node_inactivity_timeout": "30m",
-    "db_type": "postgres",
-    "db_host": "localhost",
-    "db_port": 5432,
-    "db_name": "headscale",
-    "db_user": "foo",
-    "db_pass": "bar",
-    "acme_url": "https://acme-v02.api.letsencrypt.org/directory",
-    "acme_email": "",
-    "tls_letsencrypt_hostname": "",
-    "tls_letsencrypt_listen": ":http",
-    "tls_letsencrypt_cache_dir": ".cache",
-    "tls_letsencrypt_challenge_type": "HTTP-01",
-    "tls_cert_path": "",
-    "tls_key_path": "",
-    "acl_policy_path": "",
-    "dns_config": {
-        "nameservers": [
-            "1.1.1.1"
-        ]
-    }
-}
--- a/config.json.sqlite.example
+++ b/config.json.sqlite.example
@@ -1,23 +0,0 @@
-{
-    "server_url": "http://127.0.0.1:8080",
-    "listen_addr": "0.0.0.0:8080",
-    "private_key_path": "private.key",
-    "derp_map_path": "derp.yaml",
-    "ephemeral_node_inactivity_timeout": "30m",
-    "db_type": "sqlite3",
-    "db_path": "db.sqlite",
-    "acme_url": "https://acme-v02.api.letsencrypt.org/directory",
-    "acme_email": "",
-    "tls_letsencrypt_hostname": "",
-    "tls_letsencrypt_listen": ":http",
-    "tls_letsencrypt_cache_dir": ".cache",
-    "tls_letsencrypt_challenge_type": "HTTP-01",
-    "tls_cert_path": "",
-    "tls_key_path": "",
-    "acl_policy_path": "",
-    "dns_config": {
-        "nameservers": [
-            "1.1.1.1"
-        ]
-    }
-}
--- a/config.yaml.postgres.example
+++ b/config.yaml.postgres.example
@@ -0,0 +1,30 @@
+---
+server_url: http://127.0.0.1:8080
+listen_addr: 0.0.0.0:8080
+private_key_path: private.key
+derp_map_path: derp.yaml
+ephemeral_node_inactivity_timeout: 30m
+
+# Postgres config
+db_type: postgres
+db_host: localhost
+db_port: 5432
+db_name: headscale
+db_user: foo
+db_pass: bar
+
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ''
+tls_letsencrypt_hostname: ''
+tls_letsencrypt_listen: ":http"
+tls_letsencrypt_cache_dir: ".cache"
+tls_letsencrypt_challenge_type: HTTP-01
+tls_cert_path: ''
+tls_key_path: ''
+acl_policy_path: ''
+dns_config:
+  nameservers:
+  - 1.1.1.1
+  domains: []
+  magic_dns: true
+  base_domain: example.com
--- a/config.yaml.sqlite.example
+++ b/config.yaml.sqlite.example
@@ -0,0 +1,26 @@
+---
+server_url: http://127.0.0.1:8080
+listen_addr: 0.0.0.0:8080
+private_key_path: private.key
+derp_map_path: derp.yaml
+ephemeral_node_inactivity_timeout: 30m
+
+# SQLite config (uncomment it if you want to use SQLite)
+db_type: sqlite3
+db_path: db.sqlite
+
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ''
+tls_letsencrypt_hostname: ''
+tls_letsencrypt_listen: ":http"
+tls_letsencrypt_cache_dir: ".cache"
+tls_letsencrypt_challenge_type: HTTP-01
+tls_cert_path: ''
+tls_key_path: ''
+acl_policy_path: ''
+dns_config:
+  nameservers:
+  - 1.1.1.1
+  domains: []
+  magic_dns: true
+  base_domain: example.com
--- a/dns.go
+++ b/dns.go
@@ -0,0 +1,92 @@
+package headscale
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/fatih/set"
+	"inet.af/netaddr"
+	"tailscale.com/tailcfg"
+	"tailscale.com/util/dnsname"
+)
+
+// generateMagicDNSRootDomains generates a list of DNS entries to be included in `Routes` in `MapResponse`.
+// This list of reverse DNS entries instructs the OS on what subnets and domains the Tailscale embedded DNS
+// server (listening in 100.100.100.100 udp/53) should be used for.
+//
+// Tailscale.com includes in the list:
+// - the `BaseDomain` of the user
+// - the reverse DNS entry for IPv6 (0.e.1.a.c.5.1.1.a.7.d.f.ip6.arpa., see below more on IPv6)
+// - the reverse DNS entries for the IPv4 subnets covered by the user's `IPPrefix`.
+//   In the public SaaS this is [64-127].100.in-addr.arpa.
+//
+// The main purpose of this function is then generating the list of IPv4 entries. For the 100.64.0.0/10, this
+// is clear, and could be hardcoded. But we are allowing any range as `IPPrefix`, so we need to find out the
+// subnets when we have 172.16.0.0/16 (i.e., [0-255].16.172.in-addr.arpa.), or any other subnet.
+//
+// How IN-ADDR.ARPA domains work is defined in RFC1035 (section 3.5). Tailscale.com seems to adhere to this,
+// and do not make use of RFC2317 ("Classless IN-ADDR.ARPA delegation") - hence generating the entries for the next
+// class block only.
+
+// From the netmask we can find out the wildcard bits (the bits that are not set in the netmask).
+// This allows us to then calculate the subnets included in the subsequent class block and generate the entries.
+func generateMagicDNSRootDomains(ipPrefix netaddr.IPPrefix, baseDomain string) ([]dnsname.FQDN, error) {
+	// TODO(juanfont): we are not handing out IPv6 addresses yet
+	// and in fact this is Tailscale.com's range (note the fd7a:115c:a1e0: range in the fc00::/7 network)
+	ipv6base := dnsname.FQDN("0.e.1.a.c.5.1.1.a.7.d.f.ip6.arpa.")
+	fqdns := []dnsname.FQDN{ipv6base}
+
+	// Conversion to the std lib net.IPnet, a bit easier to operate
+	netRange := ipPrefix.IPNet()
+	maskBits, _ := netRange.Mask.Size()
+
+	// lastOctet is the last IP byte covered by the mask
+	lastOctet := maskBits / 8
+
+	// wildcardBits is the number of bits not under the mask in the lastOctet
+	wildcardBits := 8 - maskBits%8
+
+	// min is the value in the lastOctet byte of the IP
+	// max is basically 2^wildcardBits - i.e., the value when all the wildcardBits are set to 1
+	min := uint(netRange.IP[lastOctet])
+	max := uint((min + 1<<uint(wildcardBits)) - 1)
+
+	// here we generate the base domain (e.g., 100.in-addr.arpa., 16.172.in-addr.arpa., etc.)
+	rdnsSlice := []string{}
+	for i := lastOctet - 1; i >= 0; i-- {
+		rdnsSlice = append(rdnsSlice, fmt.Sprintf("%d", netRange.IP[i]))
+	}
+	rdnsSlice = append(rdnsSlice, "in-addr.arpa.")
+	rdnsBase := strings.Join(rdnsSlice, ".")
+
+	for i := min; i <= max; i++ {
+		fqdn, err := dnsname.ToFQDN(fmt.Sprintf("%d.%s", i, rdnsBase))
+		if err != nil {
+			continue
+		}
+		fqdns = append(fqdns, fqdn)
+	}
+	return fqdns, nil
+}
+
+func getMapResponseDNSConfig(dnsConfigOrig *tailcfg.DNSConfig, baseDomain string, m Machine, peers Machines) (*tailcfg.DNSConfig, error) {
+	var dnsConfig *tailcfg.DNSConfig
+	if dnsConfigOrig != nil && dnsConfigOrig.Proxied { // if MagicDNS is enabled
+		// Only inject the Search Domain of the current namespace - shared nodes should use their full FQDN
+		dnsConfig = dnsConfigOrig.Clone()
+		dnsConfig.Domains = append(dnsConfig.Domains, fmt.Sprintf("%s.%s", m.Namespace.Name, baseDomain))
+
+		namespaceSet := set.New(set.ThreadSafe)
+		namespaceSet.Add(m.Namespace)
+		for _, p := range peers {
+			namespaceSet.Add(p.Namespace)
+		}
+		for _, namespace := range namespaceSet.List() {
+			dnsRoute := fmt.Sprintf("%s.%s", namespace.(Namespace).Name, baseDomain)
+			dnsConfig.Routes[dnsRoute] = nil
+		}
+	} else {
+		dnsConfig = dnsConfigOrig
+	}
+	return dnsConfig, nil
+}
--- a/dns_test.go
+++ b/dns_test.go
@@ -0,0 +1,306 @@
+package headscale
+
+import (
+	"fmt"
+
+	"gopkg.in/check.v1"
+	"inet.af/netaddr"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/dnstype"
+)
+
+func (s *Suite) TestMagicDNSRootDomains100(c *check.C) {
+	prefix := netaddr.MustParseIPPrefix("100.64.0.0/10")
+	domains, err := generateMagicDNSRootDomains(prefix, "foobar.headscale.net")
+	c.Assert(err, check.IsNil)
+
+	found := false
+	for _, domain := range domains {
+		if domain == "64.100.in-addr.arpa." {
+			found = true
+			break
+		}
+	}
+	c.Assert(found, check.Equals, true)
+
+	found = false
+	for _, domain := range domains {
+		if domain == "100.100.in-addr.arpa." {
+			found = true
+			break
+		}
+	}
+	c.Assert(found, check.Equals, true)
+
+	found = false
+	for _, domain := range domains {
+		if domain == "127.100.in-addr.arpa." {
+			found = true
+			break
+		}
+	}
+	c.Assert(found, check.Equals, true)
+}
+
+func (s *Suite) TestMagicDNSRootDomains172(c *check.C) {
+	prefix := netaddr.MustParseIPPrefix("172.16.0.0/16")
+	domains, err := generateMagicDNSRootDomains(prefix, "headscale.net")
+	c.Assert(err, check.IsNil)
+
+	found := false
+	for _, domain := range domains {
+		if domain == "0.16.172.in-addr.arpa." {
+			found = true
+			break
+		}
+	}
+	c.Assert(found, check.Equals, true)
+
+	found = false
+	for _, domain := range domains {
+		if domain == "255.16.172.in-addr.arpa." {
+			found = true
+			break
+		}
+	}
+	c.Assert(found, check.Equals, true)
+}
+
+func (s *Suite) TestDNSConfigMapResponseWithMagicDNS(c *check.C) {
+	n1, err := h.CreateNamespace("shared1")
+	c.Assert(err, check.IsNil)
+
+	n2, err := h.CreateNamespace("shared2")
+	c.Assert(err, check.IsNil)
+
+	n3, err := h.CreateNamespace("shared3")
+	c.Assert(err, check.IsNil)
+
+	pak1n1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak2n2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak3n3, err := h.CreatePreAuthKey(n3.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak4n1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
+	c.Assert(err, check.NotNil)
+
+	m1 := &Machine{
+		ID:             1,
+		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		Name:           "test_get_shared_nodes_1",
+		NamespaceID:    n1.ID,
+		Namespace:      *n1,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.1",
+		AuthKeyID:      uint(pak1n1.ID),
+	}
+	h.db.Save(m1)
+
+	_, err = h.GetMachine(n1.Name, m1.Name)
+	c.Assert(err, check.IsNil)
+
+	m2 := &Machine{
+		ID:             2,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_2",
+		NamespaceID:    n2.ID,
+		Namespace:      *n2,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.2",
+		AuthKeyID:      uint(pak2n2.ID),
+	}
+	h.db.Save(m2)
+
+	_, err = h.GetMachine(n2.Name, m2.Name)
+	c.Assert(err, check.IsNil)
+
+	m3 := &Machine{
+		ID:             3,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_3",
+		NamespaceID:    n3.ID,
+		Namespace:      *n3,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.3",
+		AuthKeyID:      uint(pak3n3.ID),
+	}
+	h.db.Save(m3)
+
+	_, err = h.GetMachine(n3.Name, m3.Name)
+	c.Assert(err, check.IsNil)
+
+	m4 := &Machine{
+		ID:             4,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_4",
+		NamespaceID:    n1.ID,
+		Namespace:      *n1,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.4",
+		AuthKeyID:      uint(pak4n1.ID),
+	}
+	h.db.Save(m4)
+
+	err = h.AddSharedMachineToNamespace(m2, n1)
+	c.Assert(err, check.IsNil)
+
+	baseDomain := "foobar.headscale.net"
+	dnsConfigOrig := tailcfg.DNSConfig{
+		Routes:  make(map[string][]dnstype.Resolver),
+		Domains: []string{baseDomain},
+		Proxied: true,
+	}
+
+	m1peers, err := h.getPeers(m1)
+	c.Assert(err, check.IsNil)
+
+	dnsConfig, err := getMapResponseDNSConfig(&dnsConfigOrig, baseDomain, *m1, m1peers)
+	c.Assert(err, check.IsNil)
+	c.Assert(dnsConfig, check.NotNil)
+	c.Assert(len(dnsConfig.Routes), check.Equals, 2)
+
+	routeN1 := fmt.Sprintf("%s.%s", n1.Name, baseDomain)
+	_, ok := dnsConfig.Routes[routeN1]
+	c.Assert(ok, check.Equals, true)
+
+	routeN2 := fmt.Sprintf("%s.%s", n2.Name, baseDomain)
+	_, ok = dnsConfig.Routes[routeN2]
+	c.Assert(ok, check.Equals, true)
+
+	routeN3 := fmt.Sprintf("%s.%s", n3.Name, baseDomain)
+	_, ok = dnsConfig.Routes[routeN3]
+	c.Assert(ok, check.Equals, false)
+}
+
+func (s *Suite) TestDNSConfigMapResponseWithoutMagicDNS(c *check.C) {
+	n1, err := h.CreateNamespace("shared1")
+	c.Assert(err, check.IsNil)
+
+	n2, err := h.CreateNamespace("shared2")
+	c.Assert(err, check.IsNil)
+
+	n3, err := h.CreateNamespace("shared3")
+	c.Assert(err, check.IsNil)
+
+	pak1n1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak2n2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak3n3, err := h.CreatePreAuthKey(n3.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak4n1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
+	c.Assert(err, check.NotNil)
+
+	m1 := &Machine{
+		ID:             1,
+		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		Name:           "test_get_shared_nodes_1",
+		NamespaceID:    n1.ID,
+		Namespace:      *n1,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.1",
+		AuthKeyID:      uint(pak1n1.ID),
+	}
+	h.db.Save(m1)
+
+	_, err = h.GetMachine(n1.Name, m1.Name)
+	c.Assert(err, check.IsNil)
+
+	m2 := &Machine{
+		ID:             2,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_2",
+		NamespaceID:    n2.ID,
+		Namespace:      *n2,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.2",
+		AuthKeyID:      uint(pak2n2.ID),
+	}
+	h.db.Save(m2)
+
+	_, err = h.GetMachine(n2.Name, m2.Name)
+	c.Assert(err, check.IsNil)
+
+	m3 := &Machine{
+		ID:             3,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_3",
+		NamespaceID:    n3.ID,
+		Namespace:      *n3,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.3",
+		AuthKeyID:      uint(pak3n3.ID),
+	}
+	h.db.Save(m3)
+
+	_, err = h.GetMachine(n3.Name, m3.Name)
+	c.Assert(err, check.IsNil)
+
+	m4 := &Machine{
+		ID:             4,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_4",
+		NamespaceID:    n1.ID,
+		Namespace:      *n1,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.4",
+		AuthKeyID:      uint(pak4n1.ID),
+	}
+	h.db.Save(m4)
+
+	err = h.AddSharedMachineToNamespace(m2, n1)
+	c.Assert(err, check.IsNil)
+
+	baseDomain := "foobar.headscale.net"
+	dnsConfigOrig := tailcfg.DNSConfig{
+		Routes:  make(map[string][]dnstype.Resolver),
+		Domains: []string{baseDomain},
+		Proxied: false,
+	}
+
+	m1peers, err := h.getPeers(m1)
+	c.Assert(err, check.IsNil)
+
+	dnsConfig, err := getMapResponseDNSConfig(&dnsConfigOrig, baseDomain, *m1, m1peers)
+	c.Assert(err, check.IsNil)
+	c.Assert(dnsConfig, check.NotNil)
+	c.Assert(len(dnsConfig.Routes), check.Equals, 0)
+	c.Assert(len(dnsConfig.Domains), check.Equals, 1)
+}
--- a/docs/Configuration.md
+++ b/docs/Configuration.md
@@ -0,0 +1,80 @@
+# Configuration reference
+
+Headscale will look for a configuration file named `config.yaml` (or `config.json`) in the following order:
+
+- `/etc/headscale`
+- `~/.headscale`
+- current working directory
+
+```yaml
+server_url: http://headscale.mydomain.net
+listen_addr: 0.0.0.0:8080
+ip_prefix: 100.64.0.0/10
+disable_check_updates: false
+```
+
+`server_url` is the external URL via which Headscale is reachable. `listen_addr` is the IP address and port the Headscale program should listen on. `ip_prefix` is the IP prefix (range) in which IP addresses for nodes will be allocated (default 100.64.0.0/10, e.g., 192.168.4.0/24, 10.0.0.0/8). `disable_check_updates` disables the automatic check for updates.
+
+```yaml
+log_level: debug
+```
+
+`log_level` can be used to set the Log level for Headscale, it defaults to `debug`, and the available levels are: `trace`, `debug`, `info`, `warn` and `error`.
+
+```yaml
+private_key_path: private.key
+```
+
+`private_key_path` is the path to the Wireguard private key. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from.
+
+```yaml
+derp_map_path: derp.yaml
+```
+
+`derp_map_path` is the path to the [DERP](https://pkg.go.dev/tailscale.com/derp) map file. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from.
+
+```yaml
+ephemeral_node_inactivity_timeout": "30m"
+```
+
+`ephemeral_node_inactivity_timeout` is the timeout after which inactive ephemeral node records will be deleted from the database. The default is 30 minutes. This value must be higher than 65 seconds (the keepalive timeout for the HTTP long poll is 60 seconds, plus a few seconds to avoid race conditions).
+
+PostgresSQL
+
+```yaml
+db_host: localhost
+db_port: 5432
+db_name: headscale
+db_user: foo
+db_pass: bar
+```
+
+SQLite
+
+```yaml
+db_type: sqlite3
+db_path: db.sqlite
+```
+
+The fields starting with `db_` are used for the DB connection information.
+
+### TLS configuration
+
+Please check [`TLS.md`](TLS.md).
+
+### DNS configuration
+
+Please refer to [`DNS.md`](DNS.md).
+
+### Policy ACLs
+
+Headscale implements the same policy ACLs as Tailscale.com, adapted to the self-hosted environment.
+
+For instance, instead of referring to users when defining groups you must
+use namespaces (which are the equivalent to user/logins in Tailscale.com).
+
+Please check https://tailscale.com/kb/1018/acls/, and `./tests/acls/` in this repo for working examples.
+
+### Apple devices
+
+An endpoint with information on how to connect your Apple devices (currently macOS only) is available at `/apple` on your running instance.
--- a/docs/DNS.md
+++ b/docs/DNS.md
@@ -0,0 +1,38 @@
+# DNS in headscale
+
+headscale supports Tailscale's DNS configuration and MagicDNS. Please have a look to their KB to better understand what this means:
+
+- https://tailscale.com/kb/1054/dns/
+- https://tailscale.com/kb/1081/magicdns/
+- https://tailscale.com/blog/2021-09-private-dns-with-magicdns/
+
+Long story short, you can define the DNS servers you want to use in your tailnets, activate MagicDNS (so you don't have to remember the IP addresses of your nodes), define search domains, as well as predefined hosts. headscale will inject that settings into your nodes.
+
+## Configuration reference
+
+The setup is done via the `config.yaml` file, under the `dns_config` key.
+
+```yaml
+server_url: http://127.0.0.1:8001
+listen_addr: 0.0.0.0:8001
+private_key_path: private.key
+dns_config:
+  nameservers:
+    - 1.1.1.1
+    - 8.8.8.8
+  restricted_nameservers:
+    foo.bar.com:
+      - 1.1.1.1
+    darp.headscale.net:
+      - 1.1.1.1
+      - 8.8.8.8
+  domains: []
+  magic_dns: true
+  base_domain: example.com
+```
+
+- `nameservers`: The list of DNS servers to use.
+- `domains`: Search domains to inject.
+- `magic_dns`: Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/). Only works if there is at least a nameserver defined.
+- `base_domain`: Defines the base domain to create the hostnames for MagicDNS. `base_domain` must be a FQDNs, without the trailing dot. The FQDN of the hosts will be `hostname.namespace.base_domain` (e.g., _myhost.mynamespace.example.com_).
+- `restricted_nameservers`: Split DNS (see https://tailscale.com/kb/1054/dns/), list of search domains and the DNS to query for each one.
--- a/docs/Glossary.md
+++ b/docs/Glossary.md
@@ -0,0 +1,3 @@
+# Glossary
+
+- Namespace: Collection of Taiscale nodes that can see each other. In Tailscale.com is called Tailnet.
--- a/docs/Running.md
+++ b/docs/Running.md
@@ -0,0 +1,149 @@
+# Running headscale
+
+1. Download the headscale binary https://github.com/juanfont/headscale/releases, and place it somewhere in your $PATH or use the docker container
+
+   ```shell
+   docker pull headscale/headscale:x.x.x
+   ```
+
+   <!--
+    or
+    ```shell
+    docker pull ghrc.io/juanfont/headscale:x.x.x
+    ``` -->
+
+2. (Optional, you can also use SQLite) Get yourself a PostgreSQL DB running
+
+   ```shell
+   docker run --name headscale \
+     -e POSTGRES_DB=headscale
+     -e POSTGRES_USER=foo \
+     -e POSTGRES_PASSWORD=bar \
+     -p 5432:5432 \
+     -d postgres
+   ```
+
+3. Create a WireGuard private key and headscale configuration
+
+   ```shell
+   wg genkey > private.key
+
+   cp config.yaml.example config.yaml
+   ```
+
+4. Create a namespace
+
+   ```shell
+   headscale namespaces create myfirstnamespace
+   ```
+
+   or docker:
+
+   the db.sqlite mount is only needed if you use sqlite
+
+   ```shell
+   touch db.sqlite
+   docker run \
+     -v $(pwd)/private.key:/private.key \
+     -v $(pwd)/config.json:/config.json \
+     -v $(pwd)/derp.yaml:/derp.yaml \
+     -v $(pwd)/db.sqlite:/db.sqlite \
+     -p 127.0.0.1:8080:8080 \
+     headscale/headscale:x.x.x \
+     headscale namespaces create myfirstnamespace
+   ```
+
+   or if your server is already running in docker:
+
+   ```shell
+   docker exec <container_name> headscale create myfirstnamespace
+   ```
+
+5. Run the server
+
+   ```shell
+   headscale serve
+   ```
+
+   or docker:
+
+   the db.sqlite mount is only needed if you use sqlite
+
+   ```shell
+   docker run \
+     -v $(pwd)/private.key:/private.key \
+     -v $(pwd)/config.json:/config.json \
+     -v $(pwd)/derp.yaml:/derp.yaml \
+     -v $(pwd)/db.sqlite:/db.sqlite \
+     -p 127.0.0.1:8080:8080 \
+     headscale/headscale:x.x.x headscale serve
+   ```
+
+6. If you used tailscale.com before in your nodes, make sure you clear the tailscaled data folder
+
+   ```shell
+   systemctl stop tailscaled
+   rm -fr /var/lib/tailscale
+   systemctl start tailscaled
+   ```
+
+7. Add your first machine
+
+   ```shell
+   tailscale up --login-server YOUR_HEADSCALE_URL
+   ```
+
+8. Navigate to the URL you will get with `tailscale up`, where you'll find your machine key.
+
+9. In the server, register your machine to a namespace with the CLI
+   ```shell
+   headscale -n myfirstnamespace nodes register YOURMACHINEKEY
+   ```
+   or docker:
+   ```shell
+   docker run \
+     -v $(pwd)/private.key:/private.key \
+     -v $(pwd)/config.json:/config.json \
+     -v $(pwd)/derp.yaml:/derp.yaml \
+     headscale/headscale:x.x.x \
+     headscale -n myfirstnamespace nodes register YOURMACHINEKEY
+   ```
+   or if your server is already running in docker:
+   ```shell
+   docker exec <container_name> headscale -n myfirstnamespace nodes register YOURMACHINEKEY
+   ```
+
+Alternatively, you can use Auth Keys to register your machines:
+
+1. Create an authkey
+
+   ```shell
+   headscale -n myfirstnamespace preauthkeys create --reusable --expiration 24h
+   ```
+
+   or docker:
+
+   ```shell
+   docker run \
+     -v $(pwd)/private.key:/private.key \
+     -v $(pwd)/config.json:/config.json \
+     -v$(pwd)/derp.yaml:/derp.yaml \
+     -v $(pwd)/db.sqlite:/db.sqlite \
+     headscale/headscale:x.x.x \
+     headscale -n myfirstnamespace preauthkeys create --reusable --expiration 24h
+   ```
+
+   or if your server is already running in docker:
+
+   ```shell
+   docker exec <container_name> headscale -n myfirstnamespace preauthkeys create --reusable --expiration 24h
+   ```
+
+2. Use the authkey from your machine to register it
+   ```shell
+   tailscale up --login-server YOUR_HEADSCALE_URL --authkey YOURAUTHKEY
+   ```
+
+If you create an authkey with the `--ephemeral` flag, that key will create ephemeral nodes. This implies that `--reusable` is true.
+
+Please bear in mind that all headscale commands support adding `-o json` or `-o json-line` to get nicely JSON-formatted output.
--- a/docs/TLS.md
+++ b/docs/TLS.md
@@ -0,0 +1,27 @@
+# Running the service via TLS (optional)
+
+```yaml
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_listen: ":http"
+tls_letsencrypt_cache_dir: ".cache"
+tls_letsencrypt_challenge_type: HTTP-01
+```
+
+To get a certificate automatically via [Let's Encrypt](https://letsencrypt.org/), set `tls_letsencrypt_hostname` to the desired certificate hostname. This name must resolve to the IP address(es) headscale is reachable on (i.e., it must correspond to the `server_url` configuration parameter). The certificate and Let's Encrypt account credentials will be stored in the directory configured in `tls_letsencrypt_cache_dir`. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from. The certificate will automatically be renewed as needed.
+
+```yaml
+tls_cert_path: ""
+tls_key_path: ""
+```
+
+headscale can also be configured to expose its web service via TLS. To configure the certificate and key file manually, set the `tls_cert_path` and `tls_cert_path` configuration parameters. If the path is relative, it will be interpreted as relative to the directory the configuration file was read from.
+
+## Challenge type HTTP-01
+
+The default challenge type `HTTP-01` requires that headscale is reachable on port 80 for the Let's Encrypt automated validation, in addition to whatever port is configured in `listen_addr`. By default, headscale listens on port 80 on all local IPs for Let's Encrypt automated validation.
+
+If you need to change the ip and/or port used by headscale for the Let's Encrypt validation process, set `tls_letsencrypt_listen` to the appropriate value. This can be handy if you are running headscale as a non-root user (or can't run `setcap`). Keep in mind, however, that Let's Encrypt will _only_ connect to port 80 for the validation callback, so if you change `tls_letsencrypt_listen` you will also need to configure something else (e.g. a firewall rule) to forward the traffic from port 80 to the ip:port combination specified in `tls_letsencrypt_listen`.
+
+## Challenge type TLS-ALPN-01
+
+Alternatively, `tls_letsencrypt_challenge_type` can be set to `TLS-ALPN-01`. In this configuration, headscale listens on the ip:port combination defined in `listen_addr`. Let's Encrypt will _only_ connect to port 443 for the validation callback, so if `listen_addr` is not set to port 443, something else (e.g. a firewall rule) will be required to forward the traffic from port 443 to the ip:port combination specified in `listen_addr`.
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/opencontainers/runc v1.0.2 // indirect
 	github.com/ory/dockertest/v3 v3.7.0
-	github.com/prometheus/client_golang v1.11.0 // indirect
+	github.com/prometheus/client_golang v1.11.0
 	github.com/pterm/pterm v0.12.30
 	github.com/rs/zerolog v1.25.0
 	github.com/spf13/cobra v1.2.1
@@ -30,7 +30,7 @@ require (
 	github.com/tailscale/hujson v0.0.0-20210818175511-7360507a6e88
 	github.com/tcnksm/go-latest v0.0.0-20170313132115-e3007ae9052e
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/zsais/go-gin-prometheus v0.1.0 // indirect
+	github.com/zsais/go-gin-prometheus v0.1.0
 	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5
 	golang.org/x/net v0.0.0-20210913180222-943fd674d43e // indirect
 	golang.org/x/sys v0.0.0-20210910150752-751e447fb3d0 // indirect
--- a/integration_test.go
+++ b/integration_test.go
@@ -504,43 +504,43 @@ func (s *IntegrationTestSuite) TestSharedNodes() {
 		assert.Contains(s.T(), result, hostname)
 	}

-	// TODO(kradalby): Figure out why these connections are not set up
-	// // TODO: See if we can have a more deterministic wait here.
-	// time.Sleep(100 * time.Second)
+	// TODO(juanfont): We have to find out why do we need to wait
+	time.Sleep(100 * time.Second) // Wait for the nodes to receive updates

-	// mainIps, err := getIPs(main.tailscales)
-	// assert.Nil(s.T(), err)
+	mainIps, err := getIPs(main.tailscales)
+	assert.Nil(s.T(), err)

-	// sharedIps, err := getIPs(shared.tailscales)
-	// assert.Nil(s.T(), err)
+	sharedIps, err := getIPs(shared.tailscales)
+	assert.Nil(s.T(), err)

-	// for hostname, tailscale := range main.tailscales {
-	// 	for peername, ip := range sharedIps {
-	// 		s.T().Run(fmt.Sprintf("%s-%s", hostname, peername), func(t *testing.T) {
-	// 			// We currently cant ping ourselves, so skip that.
-	// 			if peername != hostname {
-	// 				// We are only interested in "direct ping" which means what we
-	// 				// might need a couple of more attempts before reaching the node.
-	// 				command := []string{
-	// 					"tailscale", "ping",
-	// 					"--timeout=1s",
-	// 					"--c=20",
-	// 					"--until-direct=true",
-	// 					ip.String(),
-	// 				}
+	for hostname, tailscale := range main.tailscales {
+		for peername, ip := range sharedIps {
+			s.T().Run(fmt.Sprintf("%s-%s", hostname, peername), func(t *testing.T) {
+				// We currently cant ping ourselves, so skip that.
+				if peername != hostname {
+					// We are only interested in "direct ping" which means what we
+					// might need a couple of more attempts before reaching the node.
+					command := []string{
+						"tailscale", "ping",
+						"--timeout=15s",
+						"--c=20",
+						"--until-direct=true",
+						ip.String(),
+					}

-	// 				fmt.Printf("Pinging from %s (%s) to %s (%s)\n", hostname, mainIps[hostname], peername, ip)
-	// 				result, err := executeCommand(
-	// 					&tailscale,
-	// 					command,
-	// 				)
-	// 				assert.Nil(t, err)
-	// 				fmt.Printf("Result for %s: %s\n", hostname, result)
-	// 				assert.Contains(t, result, "pong")
-	// 			}
-	// 		})
-	// 	}
-	// }
+					fmt.Printf("Pinging from %s (%s) to %s (%s)\n", hostname, mainIps[hostname], peername, ip)
+					result, err := executeCommand(
+						&tailscale,
+						command,
+						[]string{},
+					)
+					assert.Nil(t, err)
+					fmt.Printf("Result for %s: %s\n", hostname, result)
+					assert.Contains(t, result, "pong")
+				}
+			})
+		}
+	}
 }

 func (s *IntegrationTestSuite) TestTailDrop() {
@@ -592,7 +592,7 @@ func (s *IntegrationTestSuite) TestTailDrop() {
 							_, err = executeCommand(
 								&tailscale,
 								command,
-								[]string{"ALL_PROXY=socks5://localhost:1055/"},
+								[]string{"ALL_PROXY=socks5://localhost:1055"},
 							)
 							if err == nil {
 								break
@@ -645,6 +645,38 @@ func (s *IntegrationTestSuite) TestTailDrop() {
 	}
 }

+func (s *IntegrationTestSuite) TestMagicDNS() {
+	for namespace, scales := range s.namespaces {
+		ips, err := getIPs(scales.tailscales)
+		assert.Nil(s.T(), err)
+		for hostname, tailscale := range scales.tailscales {
+			for peername, ip := range ips {
+				s.T().Run(fmt.Sprintf("%s-%s", hostname, peername), func(t *testing.T) {
+					if peername != hostname {
+						command := []string{
+							"tailscale", "ping",
+							"--timeout=10s",
+							"--c=20",
+							"--until-direct=true",
+							fmt.Sprintf("%s.%s.headscale.net", peername, namespace),
+						}
+
+						fmt.Printf("Pinging using Hostname (magicdns) from %s (%s) to %s (%s)\n", hostname, ips[hostname], peername, ip)
+						result, err := executeCommand(
+							&tailscale,
+							command,
+							[]string{},
+						)
+						assert.Nil(t, err)
+						fmt.Printf("Result for %s: %s\n", hostname, result)
+						assert.Contains(t, result, "pong")
+					}
+				})
+			}
+		}
+	}
+}
+
 func getIPs(tailscales map[string]dockertest.Resource) (map[string]netaddr.IP, error) {
 	ips := make(map[string]netaddr.IP)
 	for hostname, tailscale := range tailscales {
--- a/integration_test/etc/config.json
+++ b/integration_test/etc/config.json
@@ -7,5 +7,13 @@
  "db_type": "sqlite3",
  "db_path": "/tmp/integration_test_db.sqlite3",
  "acl_policy_path": "",
-  "log_level": "trace"
-}
+  "log_level": "trace",
+  "dns_config": {
+    "nameservers": [
+      "1.1.1.1"
+    ],
+    "domains": [],
+    "magic_dns": true,
+    "base_domain": "headscale.net"
+  }
+}
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -1,7 +1,7 @@
-# Deploying Headscale on Kubernetes
+# Deploying headscale on Kubernetes

 This directory contains [Kustomize](https://kustomize.io) templates that deploy
-Headscale in various configurations.
+headscale in various configurations.

 These templates currently support Rancher k3s. Other clusters may require
 adaptation, especially around volume claims and ingress.
@@ -72,10 +72,10 @@ Usage:

 Available Commands:
  help        Help about any command
-  namespace   Manage the namespaces of Headscale
-  node        Manage the nodes of Headscale
-  preauthkey  Handle the preauthkeys in Headscale
-  routes      Manage the routes of Headscale
+  namespace   Manage the namespaces of headscale
+  node        Manage the nodes of headscale
+  preauthkey  Handle the preauthkeys in headscale
+  routes      Manage the routes of headscale
  serve       Launches the headscale server
  version     Print the version.

--- a/machine.go
+++ b/machine.go
@@ -63,7 +63,7 @@ func (h *Headscale) getDirectPeers(m *Machine) (Machines, error) {
 		Msg("Finding direct peers")

 	machines := Machines{}
-	if err := h.db.Where("namespace_id = ? AND machine_key <> ? AND registered",
+	if err := h.db.Preload("Namespace").Where("namespace_id = ? AND machine_key <> ? AND registered",
 		m.NamespaceID, m.MachineKey).Find(&machines).Error; err != nil {
 		log.Error().Err(err).Msg("Error accessing db")
 		return Machines{}, err
@@ -78,15 +78,15 @@ func (h *Headscale) getDirectPeers(m *Machine) (Machines, error) {
 	return machines, nil
 }

+// getShared fetches machines that are shared to the `Namespace` of the machine we are getting peers for
 func (h *Headscale) getShared(m *Machine) (Machines, error) {
 	log.Trace().
 		Str("func", "getShared").
 		Str("machine", m.Name).
 		Msg("Finding shared peers")

-	// We fetch here machines that are shared to the `Namespace` of the machine we are getting peers for
 	sharedMachines := []SharedMachine{}
-	if err := h.db.Preload("Namespace").Preload("Machine").Where("namespace_id = ?",
+	if err := h.db.Preload("Namespace").Preload("Machine").Preload("Machine.Namespace").Where("namespace_id = ?",
 		m.NamespaceID).Find(&sharedMachines).Error; err != nil {
 		return Machines{}, err
 	}
@@ -105,6 +105,37 @@ func (h *Headscale) getShared(m *Machine) (Machines, error) {
 	return peers, nil
 }

+// getSharedTo fetches the machines of the namespaces this machine is shared in
+func (h *Headscale) getSharedTo(m *Machine) (Machines, error) {
+	log.Trace().
+		Str("func", "getSharedTo").
+		Str("machine", m.Name).
+		Msg("Finding peers in namespaces this machine is shared with")
+
+	sharedMachines := []SharedMachine{}
+	if err := h.db.Preload("Namespace").Preload("Machine").Preload("Machine.Namespace").Where("machine_id = ?",
+		m.ID).Find(&sharedMachines).Error; err != nil {
+		return Machines{}, err
+	}
+
+	peers := make(Machines, 0)
+	for _, sharedMachine := range sharedMachines {
+		namespaceMachines, err := h.ListMachinesInNamespace(sharedMachine.Namespace.Name)
+		if err != nil {
+			return Machines{}, err
+		}
+		peers = append(peers, *namespaceMachines...)
+	}
+
+	sort.Slice(peers, func(i, j int) bool { return peers[i].ID < peers[j].ID })
+
+	log.Trace().
+		Str("func", "getSharedTo").
+		Str("machine", m.Name).
+		Msgf("Found peers we are shared with: %s", peers.String())
+	return peers, nil
+}
+
 func (h *Headscale) getPeers(m *Machine) (Machines, error) {
 	direct, err := h.getDirectPeers(m)
 	if err != nil {
@@ -118,13 +149,24 @@ func (h *Headscale) getPeers(m *Machine) (Machines, error) {
 	shared, err := h.getShared(m)
 	if err != nil {
 		log.Error().
-			Str("func", "getDirectPeers").
+			Str("func", "getShared").
+			Err(err).
+			Msg("Cannot fetch peers")
+		return Machines{}, err
+	}
+
+	sharedTo, err := h.getSharedTo(m)
+	if err != nil {
+		log.Error().
+			Str("func", "sharedTo").
 			Err(err).
 			Msg("Cannot fetch peers")
 		return Machines{}, err
 	}

 	peers := append(direct, shared...)
+	peers = append(peers, sharedTo...)
+
 	sort.Slice(peers, func(i, j int) bool { return peers[i].ID < peers[j].ID })

 	log.Trace().
@@ -179,6 +221,11 @@ func (h *Headscale) UpdateMachine(m *Machine) error {

 // DeleteMachine softs deletes a Machine from the database
 func (h *Headscale) DeleteMachine(m *Machine) error {
+	err := h.RemoveSharedMachineFromAllNamespaces(m)
+	if err != nil && err != errorMachineNotShared {
+		return err
+	}
+
 	m.Registered = false
 	namespaceID := m.NamespaceID
 	h.db.Save(&m) // we mark it as unregistered, just in case
@@ -191,10 +238,16 @@ func (h *Headscale) DeleteMachine(m *Machine) error {

 // HardDeleteMachine hard deletes a Machine from the database
 func (h *Headscale) HardDeleteMachine(m *Machine) error {
+	err := h.RemoveSharedMachineFromAllNamespaces(m)
+	if err != nil && err != errorMachineNotShared {
+		return err
+	}
+
 	namespaceID := m.NamespaceID
 	if err := h.db.Unscoped().Delete(&m).Error; err != nil {
 		return err
 	}
+
 	return h.RequestMapUpdates(namespaceID)
 }

@@ -273,11 +326,11 @@ func (ms MachinesP) String() string {
 	return fmt.Sprintf("[ %s ](%d)", strings.Join(temp, ", "), len(temp))
 }

-func (ms Machines) toNodes(includeRoutes bool) ([]*tailcfg.Node, error) {
+func (ms Machines) toNodes(baseDomain string, dnsConfig *tailcfg.DNSConfig, includeRoutes bool) ([]*tailcfg.Node, error) {
 	nodes := make([]*tailcfg.Node, len(ms))

 	for index, machine := range ms {
-		node, err := machine.toNode(includeRoutes)
+		node, err := machine.toNode(baseDomain, dnsConfig, includeRoutes)
 		if err != nil {
 			return nil, err
 		}
@@ -290,7 +343,7 @@ func (ms Machines) toNodes(includeRoutes bool) ([]*tailcfg.Node, error) {

 // toNode converts a Machine into a Tailscale Node. includeRoutes is false for shared nodes
 // as per the expected behaviour in the official SaaS
-func (m Machine) toNode(includeRoutes bool) (*tailcfg.Node, error) {
+func (m Machine) toNode(baseDomain string, dnsConfig *tailcfg.DNSConfig, includeRoutes bool) (*tailcfg.Node, error) {
 	nKey, err := wgkey.ParseHex(m.NodeKey)
 	if err != nil {
 		return nil, err
@@ -385,10 +438,17 @@ func (m Machine) toNode(includeRoutes bool) (*tailcfg.Node, error) {
 		keyExpiry = time.Time{}
 	}

+	var hostname string
+	if dnsConfig != nil && dnsConfig.Proxied { // MagicDNS
+		hostname = fmt.Sprintf("%s.%s.%s", m.Name, m.Namespace.Name, baseDomain)
+	} else {
+		hostname = m.Name
+	}
+
 	n := tailcfg.Node{
 		ID:         tailcfg.NodeID(m.ID),                               // this is the actual ID
 		StableID:   tailcfg.StableNodeID(strconv.FormatUint(m.ID, 10)), // in headscale, unlike tailcontrol server, IDs are permanent
-		Name:       hostinfo.Hostname,
+		Name:       hostname,
 		User:       tailcfg.UserID(m.NamespaceID),
 		Key:        tailcfg.NodeKey(nKey),
 		KeyExpiry:  keyExpiry,
--- a/namespaces.go
+++ b/namespaces.go
@@ -59,6 +59,35 @@ func (h *Headscale) DestroyNamespace(name string) error {
 	}

 	if result := h.db.Unscoped().Delete(&n); result.Error != nil {
+		return result.Error
+	}
+
+	return nil
+}
+
+// RenameNamespace renames a Namespace. Returns error if the Namespace does
+// not exist or if another Namespace exists with the new name.
+func (h *Headscale) RenameNamespace(oldName, newName string) error {
+	n, err := h.GetNamespace(oldName)
+	if err != nil {
+		return err
+	}
+	_, err = h.GetNamespace(newName)
+	if err == nil {
+		return errorNamespaceExists
+	}
+	if !errors.Is(err, errorNamespaceNotFound) {
+		return err
+	}
+
+	n.Name = newName
+
+	if result := h.db.Save(&n); result.Error != nil {
+		return result.Error
+	}
+
+	err = h.RequestMapUpdates(n.ID)
+	if err != nil {
 		return err
 	}

@@ -91,7 +120,7 @@ func (h *Headscale) ListMachinesInNamespace(name string) (*[]Machine, error) {
 	}

 	machines := []Machine{}
-	if err := h.db.Preload("AuthKey").Preload("Namespace").Where(&Machine{NamespaceID: n.ID}).Find(&machines).Error; err != nil {
+	if err := h.db.Preload("AuthKey").Preload("AuthKey.Namespace").Preload("Namespace").Where(&Machine{NamespaceID: n.ID}).Find(&machines).Error; err != nil {
 		return nil, err
 	}
 	return &machines, nil
@@ -216,3 +245,22 @@ func (n *Namespace) toUser() *tailcfg.User {
 	}
 	return &u
 }
+
+func getMapResponseUserProfiles(m Machine, peers Machines) []tailcfg.UserProfile {
+	namespaceMap := make(map[string]Namespace)
+	namespaceMap[m.Namespace.Name] = m.Namespace
+	for _, p := range peers {
+		namespaceMap[p.Namespace.Name] = p.Namespace // not worth checking if already is there
+	}
+
+	profiles := []tailcfg.UserProfile{}
+	for _, namespace := range namespaceMap {
+		profiles = append(profiles,
+			tailcfg.UserProfile{
+				ID:          tailcfg.UserID(namespace.ID),
+				LoginName:   namespace.Name,
+				DisplayName: namespace.Name,
+			})
+	}
+	return profiles
+}
--- a/namespaces_test.go
+++ b/namespaces_test.go
@@ -1,6 +1,7 @@
 package headscale

 import (
+	"github.com/rs/zerolog/log"
 	"gopkg.in/check.v1"
 )

@@ -46,3 +47,155 @@ func (s *Suite) TestDestroyNamespaceErrors(c *check.C) {
 	err = h.DestroyNamespace("test")
 	c.Assert(err, check.Equals, errorNamespaceNotEmpty)
 }
+
+func (s *Suite) TestRenameNamespace(c *check.C) {
+	n, err := h.CreateNamespace("test")
+	c.Assert(err, check.IsNil)
+	c.Assert(n.Name, check.Equals, "test")
+
+	ns, err := h.ListNamespaces()
+	c.Assert(err, check.IsNil)
+	c.Assert(len(*ns), check.Equals, 1)
+
+	err = h.RenameNamespace("test", "test_renamed")
+	c.Assert(err, check.IsNil)
+
+	_, err = h.GetNamespace("test")
+	c.Assert(err, check.Equals, errorNamespaceNotFound)
+
+	_, err = h.GetNamespace("test_renamed")
+	c.Assert(err, check.IsNil)
+
+	err = h.RenameNamespace("test_does_not_exit", "test")
+	c.Assert(err, check.Equals, errorNamespaceNotFound)
+
+	n2, err := h.CreateNamespace("test2")
+	c.Assert(err, check.IsNil)
+	c.Assert(n2.Name, check.Equals, "test2")
+
+	err = h.RenameNamespace("test2", "test_renamed")
+	c.Assert(err, check.Equals, errorNamespaceExists)
+}
+
+func (s *Suite) TestGetMapResponseUserProfiles(c *check.C) {
+	n1, err := h.CreateNamespace("shared1")
+	c.Assert(err, check.IsNil)
+
+	n2, err := h.CreateNamespace("shared2")
+	c.Assert(err, check.IsNil)
+
+	n3, err := h.CreateNamespace("shared3")
+	c.Assert(err, check.IsNil)
+
+	pak1n1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak2n2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak3n3, err := h.CreatePreAuthKey(n3.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	pak4n1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+
+	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
+	c.Assert(err, check.NotNil)
+
+	m1 := &Machine{
+		ID:             1,
+		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
+		Name:           "test_get_shared_nodes_1",
+		NamespaceID:    n1.ID,
+		Namespace:      *n1,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.1",
+		AuthKeyID:      uint(pak1n1.ID),
+	}
+	h.db.Save(m1)
+
+	_, err = h.GetMachine(n1.Name, m1.Name)
+	c.Assert(err, check.IsNil)
+
+	m2 := &Machine{
+		ID:             2,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_2",
+		NamespaceID:    n2.ID,
+		Namespace:      *n2,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.2",
+		AuthKeyID:      uint(pak2n2.ID),
+	}
+	h.db.Save(m2)
+
+	_, err = h.GetMachine(n2.Name, m2.Name)
+	c.Assert(err, check.IsNil)
+
+	m3 := &Machine{
+		ID:             3,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_3",
+		NamespaceID:    n3.ID,
+		Namespace:      *n3,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.3",
+		AuthKeyID:      uint(pak3n3.ID),
+	}
+	h.db.Save(m3)
+
+	_, err = h.GetMachine(n3.Name, m3.Name)
+	c.Assert(err, check.IsNil)
+
+	m4 := &Machine{
+		ID:             4,
+		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		Name:           "test_get_shared_nodes_4",
+		NamespaceID:    n1.ID,
+		Namespace:      *n1,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.4",
+		AuthKeyID:      uint(pak4n1.ID),
+	}
+	h.db.Save(m4)
+
+	err = h.AddSharedMachineToNamespace(m2, n1)
+	c.Assert(err, check.IsNil)
+	m1peers, err := h.getPeers(m1)
+	c.Assert(err, check.IsNil)
+
+	userProfiles := getMapResponseUserProfiles(*m1, m1peers)
+
+	log.Trace().Msgf("userProfiles %#v", userProfiles)
+	c.Assert(len(userProfiles), check.Equals, 2)
+
+	found := false
+	for _, up := range userProfiles {
+		if up.DisplayName == n1.Name {
+			found = true
+			break
+		}
+	}
+	c.Assert(found, check.Equals, true)
+
+	found = false
+	for _, up := range userProfiles {
+		if up.DisplayName == n2.Name {
+			found = true
+			break
+		}
+	}
+	c.Assert(found, check.Equals, true)
+}
--- a/preauth_keys.go
+++ b/preauth_keys.go
@@ -11,7 +11,7 @@ import (

 const errorAuthKeyNotFound = Error("AuthKey not found")
 const errorAuthKeyExpired = Error("AuthKey expired")
-const errorAuthKeyNotReusableAlreadyUsed = Error("AuthKey not reusable already used")
+const errSingleUseAuthKeyHasBeenUsed = Error("AuthKey has already been used")

 // PreAuthKey describes a pre-authorization key usable in a particular namespace
 type PreAuthKey struct {
@@ -21,6 +21,7 @@ type PreAuthKey struct {
 	Namespace   Namespace
 	Reusable    bool
 	Ephemeral   bool `gorm:"default:false"`
+	Used        bool `gorm:"default:false"`

 	CreatedAt  *time.Time
 	Expiration *time.Time
@@ -110,11 +111,10 @@ func (h *Headscale) checkKeyValidity(k string) (*PreAuthKey, error) {
 		return nil, err
 	}

-	if len(machines) != 0 {
-		return nil, errorAuthKeyNotReusableAlreadyUsed
+	if len(machines) != 0 || pak.Used {
+		return nil, errSingleUseAuthKeyHasBeenUsed
 	}

-	// missing here validation on current usage
 	return &pak, nil
 }

--- a/preauth_keys_test.go
+++ b/preauth_keys_test.go
@@ -87,7 +87,7 @@ func (*Suite) TestAlreadyUsedKey(c *check.C) {
 	h.db.Save(&m)

 	p, err := h.checkKeyValidity(pak.Key)
-	c.Assert(err, check.Equals, errorAuthKeyNotReusableAlreadyUsed)
+	c.Assert(err, check.Equals, errSingleUseAuthKeyHasBeenUsed)
 	c.Assert(p, check.IsNil)
 }

@@ -180,3 +180,16 @@ func (*Suite) TestExpirePreauthKey(c *check.C) {
 	c.Assert(err, check.Equals, errorAuthKeyExpired)
 	c.Assert(p, check.IsNil)
 }
+
+func (*Suite) TestNotReusableMarkedAsUsed(c *check.C) {
+	n, err := h.CreateNamespace("test6")
+	c.Assert(err, check.IsNil)
+
+	pak, err := h.CreatePreAuthKey(n.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+	pak.Used = true
+	h.db.Save(&pak)
+
+	_, err = h.checkKeyValidity(pak.Key)
+	c.Assert(err, check.Equals, errSingleUseAuthKeyHasBeenUsed)
+}
--- a/sharing.go
+++ b/sharing.go
@@ -4,6 +4,7 @@ import "gorm.io/gorm"

 const errorSameNamespace = Error("Destination namespace same as origin")
 const errorMachineAlreadyShared = Error("Node already shared to this namespace")
+const errorMachineNotShared = Error("Machine not shared to this namespace")

 // SharedMachine is a join table to support sharing nodes between namespaces
 type SharedMachine struct {
@@ -20,12 +21,15 @@ func (h *Headscale) AddSharedMachineToNamespace(m *Machine, ns *Namespace) error
 		return errorSameNamespace
 	}

-	sharedMachine := SharedMachine{}
-	if err := h.db.Where("machine_id = ? AND namespace_id", m.ID, ns.ID).First(&sharedMachine).Error; err == nil {
+	sharedMachines := []SharedMachine{}
+	if err := h.db.Where("machine_id = ? AND namespace_id = ?", m.ID, ns.ID).Find(&sharedMachines).Error; err != nil {
+		return err
+	}
+	if len(sharedMachines) > 0 {
 		return errorMachineAlreadyShared
 	}

-	sharedMachine = SharedMachine{
+	sharedMachine := SharedMachine{
 		MachineID:   m.ID,
 		Machine:     *m,
 		NamespaceID: ns.ID,
@@ -35,3 +39,37 @@ func (h *Headscale) AddSharedMachineToNamespace(m *Machine, ns *Namespace) error

 	return nil
 }
+
+// RemoveSharedMachineFromNamespace removes a shared machine from a namespace
+func (h *Headscale) RemoveSharedMachineFromNamespace(m *Machine, ns *Namespace) error {
+	if m.NamespaceID == ns.ID {
+		return errorSameNamespace
+	}
+
+	sharedMachine := SharedMachine{}
+	result := h.db.Where("machine_id = ? AND namespace_id = ?", m.ID, ns.ID).Unscoped().Delete(&sharedMachine)
+	if result.Error != nil {
+		return result.Error
+	}
+
+	if result.RowsAffected == 0 {
+		return errorMachineNotShared
+	}
+
+	err := h.RequestMapUpdates(ns.ID)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// RemoveSharedMachineFromAllNamespaces removes a machine as a shared node from all namespaces
+func (h *Headscale) RemoveSharedMachineFromAllNamespaces(m *Machine) error {
+	sharedMachine := SharedMachine{}
+	if result := h.db.Where("machine_id = ?", m.ID).Unscoped().Delete(&sharedMachine); result.Error != nil {
+		return result.Error
+	}
+
+	return nil
+}
--- a/sharing_test.go
+++ b/sharing_test.go
@@ -4,32 +4,26 @@ import (
 	"gopkg.in/check.v1"
 )

-func (s *Suite) TestBasicSharedNodesInNamespace(c *check.C) {
-	n1, err := h.CreateNamespace("shared1")
-	c.Assert(err, check.IsNil)
-
-	n2, err := h.CreateNamespace("shared2")
+func CreateNodeNamespace(c *check.C, namespace, node, key, IP string) (*Namespace, *Machine) {
+	n1, err := h.CreateNamespace(namespace)
 	c.Assert(err, check.IsNil)

 	pak1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
 	c.Assert(err, check.IsNil)

-	pak2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
+	_, err = h.GetMachine(n1.Name, node)
 	c.Assert(err, check.NotNil)

 	m1 := &Machine{
 		ID:             0,
-		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		Name:           "test_get_shared_nodes_1",
+		MachineKey:     key,
+		NodeKey:        key,
+		DiscoKey:       key,
+		Name:           node,
 		NamespaceID:    n1.ID,
 		Registered:     true,
 		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.1",
+		IPAddress:      IP,
 		AuthKeyID:      uint(pak1.ID),
 	}
 	h.db.Save(m1)
@@ -37,22 +31,12 @@ func (s *Suite) TestBasicSharedNodesInNamespace(c *check.C) {
 	_, err = h.GetMachine(n1.Name, m1.Name)
 	c.Assert(err, check.IsNil)

-	m2 := &Machine{
-		ID:             1,
-		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		Name:           "test_get_shared_nodes_2",
-		NamespaceID:    n2.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.2",
-		AuthKeyID:      uint(pak2.ID),
-	}
-	h.db.Save(m2)
+	return n1, m1
+}

-	_, err = h.GetMachine(n2.Name, m2.Name)
-	c.Assert(err, check.IsNil)
+func (s *Suite) TestBasicSharedNodesInNamespace(c *check.C) {
+	n1, m1 := CreateNodeNamespace(c, "shared1", "test_get_shared_nodes_1", "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66", "100.64.0.1")
+	_, m2 := CreateNodeNamespace(c, "shared2", "test_get_shared_nodes_2", "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863", "100.64.0.2")

 	p1s, err := h.getPeers(m1)
 	c.Assert(err, check.IsNil)
@@ -68,54 +52,7 @@ func (s *Suite) TestBasicSharedNodesInNamespace(c *check.C) {
 }

 func (s *Suite) TestSameNamespace(c *check.C) {
-	n1, err := h.CreateNamespace("shared1")
-	c.Assert(err, check.IsNil)
-
-	n2, err := h.CreateNamespace("shared2")
-	c.Assert(err, check.IsNil)
-
-	pak1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	pak2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
-	c.Assert(err, check.NotNil)
-
-	m1 := &Machine{
-		ID:             0,
-		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		Name:           "test_get_shared_nodes_1",
-		NamespaceID:    n1.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.1",
-		AuthKeyID:      uint(pak1.ID),
-	}
-	h.db.Save(m1)
-
-	_, err = h.GetMachine(n1.Name, m1.Name)
-	c.Assert(err, check.IsNil)
-
-	m2 := &Machine{
-		ID:             1,
-		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		Name:           "test_get_shared_nodes_2",
-		NamespaceID:    n2.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.2",
-		AuthKeyID:      uint(pak2.ID),
-	}
-	h.db.Save(m2)
-
-	_, err = h.GetMachine(n2.Name, m2.Name)
-	c.Assert(err, check.IsNil)
+	n1, m1 := CreateNodeNamespace(c, "shared1", "test_get_shared_nodes_1", "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66", "100.64.0.1")

 	p1s, err := h.getPeers(m1)
 	c.Assert(err, check.IsNil)
@@ -125,55 +62,35 @@ func (s *Suite) TestSameNamespace(c *check.C) {
 	c.Assert(err, check.Equals, errorSameNamespace)
 }

+func (s *Suite) TestUnshare(c *check.C) {
+	n1, m1 := CreateNodeNamespace(c, "shared1", "test_unshare_1", "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66", "100.64.0.1")
+	_, m2 := CreateNodeNamespace(c, "shared2", "test_unshare_2", "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863", "100.64.0.2")
+
+	p1s, err := h.getPeers(m1)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(p1s), check.Equals, 0)
+
+	err = h.AddSharedMachineToNamespace(m2, n1)
+	c.Assert(err, check.IsNil)
+
+	p1s, err = h.getShared(m1)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(p1s), check.Equals, 1)
+
+	err = h.RemoveSharedMachineFromNamespace(m2, n1)
+	c.Assert(err, check.IsNil)
+
+	p1s, err = h.getShared(m1)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(p1s), check.Equals, 0)
+
+	err = h.RemoveSharedMachineFromNamespace(m2, n1)
+	c.Assert(err, check.Equals, errorMachineNotShared)
+}
+
 func (s *Suite) TestAlreadyShared(c *check.C) {
-	n1, err := h.CreateNamespace("shared1")
-	c.Assert(err, check.IsNil)
-
-	n2, err := h.CreateNamespace("shared2")
-	c.Assert(err, check.IsNil)
-
-	pak1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	pak2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
-	c.Assert(err, check.NotNil)
-
-	m1 := &Machine{
-		ID:             0,
-		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		Name:           "test_get_shared_nodes_1",
-		NamespaceID:    n1.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.1",
-		AuthKeyID:      uint(pak1.ID),
-	}
-	h.db.Save(m1)
-
-	_, err = h.GetMachine(n1.Name, m1.Name)
-	c.Assert(err, check.IsNil)
-
-	m2 := &Machine{
-		ID:             1,
-		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		Name:           "test_get_shared_nodes_2",
-		NamespaceID:    n2.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.2",
-		AuthKeyID:      uint(pak2.ID),
-	}
-	h.db.Save(m2)
-
-	_, err = h.GetMachine(n2.Name, m2.Name)
-	c.Assert(err, check.IsNil)
+	n1, m1 := CreateNodeNamespace(c, "shared1", "test_get_shared_nodes_1", "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66", "100.64.0.1")
+	_, m2 := CreateNodeNamespace(c, "shared2", "test_get_shared_nodes_2", "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863", "100.64.0.2")

 	p1s, err := h.getPeers(m1)
 	c.Assert(err, check.IsNil)
@@ -186,54 +103,8 @@ func (s *Suite) TestAlreadyShared(c *check.C) {
 }

 func (s *Suite) TestDoNotIncludeRoutesOnShared(c *check.C) {
-	n1, err := h.CreateNamespace("shared1")
-	c.Assert(err, check.IsNil)
-
-	n2, err := h.CreateNamespace("shared2")
-	c.Assert(err, check.IsNil)
-
-	pak1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	pak2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
-	c.Assert(err, check.NotNil)
-
-	m1 := &Machine{
-		ID:             0,
-		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		Name:           "test_get_shared_nodes_1",
-		NamespaceID:    n1.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.1",
-		AuthKeyID:      uint(pak1.ID),
-	}
-	h.db.Save(m1)
-
-	_, err = h.GetMachine(n1.Name, m1.Name)
-	c.Assert(err, check.IsNil)
-
-	m2 := &Machine{
-		ID:             1,
-		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		Name:           "test_get_shared_nodes_2",
-		NamespaceID:    n2.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.2",
-		AuthKeyID:      uint(pak2.ID),
-	}
-	h.db.Save(m2)
-
-	_, err = h.GetMachine(n2.Name, m2.Name)
-	c.Assert(err, check.IsNil)
+	n1, m1 := CreateNodeNamespace(c, "shared1", "test_get_shared_nodes_1", "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66", "100.64.0.1")
+	_, m2 := CreateNodeNamespace(c, "shared2", "test_get_shared_nodes_2", "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863", "100.64.0.2")

 	p1s, err := h.getPeers(m1)
 	c.Assert(err, check.IsNil)
@@ -249,86 +120,18 @@ func (s *Suite) TestDoNotIncludeRoutesOnShared(c *check.C) {
 }

 func (s *Suite) TestComplexSharingAcrossNamespaces(c *check.C) {
-	n1, err := h.CreateNamespace("shared1")
-	c.Assert(err, check.IsNil)
-
-	n2, err := h.CreateNamespace("shared2")
-	c.Assert(err, check.IsNil)
-
-	n3, err := h.CreateNamespace("shared3")
-	c.Assert(err, check.IsNil)
-
-	pak1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	pak2, err := h.CreatePreAuthKey(n2.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
-
-	pak3, err := h.CreatePreAuthKey(n3.Name, false, false, nil)
-	c.Assert(err, check.IsNil)
+	n1, m1 := CreateNodeNamespace(c, "shared1", "test_get_shared_nodes_1", "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66", "100.64.0.1")
+	_, m2 := CreateNodeNamespace(c, "shared2", "test_get_shared_nodes_2", "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863", "100.64.0.2")
+	_, m3 := CreateNodeNamespace(c, "shared3", "test_get_shared_nodes_3", "6e704bee83eb93db6fc2c417d7882964cd3f8cc87082cbb645982e34020c76c8", "100.64.0.3")

 	pak4, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
 	c.Assert(err, check.IsNil)

-	_, err = h.GetMachine(n1.Name, "test_get_shared_nodes_1")
-	c.Assert(err, check.NotNil)
-
-	m1 := &Machine{
-		ID:             0,
-		MachineKey:     "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		NodeKey:        "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		DiscoKey:       "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66",
-		Name:           "test_get_shared_nodes_1",
-		NamespaceID:    n1.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.1",
-		AuthKeyID:      uint(pak1.ID),
-	}
-	h.db.Save(m1)
-
-	_, err = h.GetMachine(n1.Name, m1.Name)
-	c.Assert(err, check.IsNil)
-
-	m2 := &Machine{
-		ID:             1,
-		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		Name:           "test_get_shared_nodes_2",
-		NamespaceID:    n2.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.2",
-		AuthKeyID:      uint(pak2.ID),
-	}
-	h.db.Save(m2)
-
-	_, err = h.GetMachine(n2.Name, m2.Name)
-	c.Assert(err, check.IsNil)
-
-	m3 := &Machine{
-		ID:             2,
-		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		Name:           "test_get_shared_nodes_3",
-		NamespaceID:    n3.ID,
-		Registered:     true,
-		RegisterMethod: "authKey",
-		IPAddress:      "100.64.0.3",
-		AuthKeyID:      uint(pak3.ID),
-	}
-	h.db.Save(m3)
-
-	_, err = h.GetMachine(n3.Name, m3.Name)
-	c.Assert(err, check.IsNil)
-
 	m4 := &Machine{
-		ID:             3,
-		MachineKey:     "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		NodeKey:        "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
-		DiscoKey:       "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863",
+		ID:             4,
+		MachineKey:     "4c3e07c3ecd40e9c945bb6797557c451850691c0409740578325e17009dd298f",
+		NodeKey:        "4c3e07c3ecd40e9c945bb6797557c451850691c0409740578325e17009dd298f",
+		DiscoKey:       "4c3e07c3ecd40e9c945bb6797557c451850691c0409740578325e17009dd298f",
 		Name:           "test_get_shared_nodes_4",
 		NamespaceID:    n1.ID,
 		Registered:     true,
@@ -341,10 +144,64 @@ func (s *Suite) TestComplexSharingAcrossNamespaces(c *check.C) {
 	_, err = h.GetMachine(n1.Name, m4.Name)
 	c.Assert(err, check.IsNil)

+	p1s, err := h.getPeers(m1)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(p1s), check.Equals, 1) // node1 can see node4
+	c.Assert(p1s[0].Name, check.Equals, m4.Name)
+
+	err = h.AddSharedMachineToNamespace(m2, n1)
+	c.Assert(err, check.IsNil)
+
+	p1sAfter, err := h.getPeers(m1)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(p1sAfter), check.Equals, 2) // node1 can see node2 (shared) and node4 (same namespace)
+	c.Assert(p1sAfter[0].Name, check.Equals, m2.Name)
+	c.Assert(p1sAfter[1].Name, check.Equals, m4.Name)
+
+	node1shared, err := h.getShared(m1)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(node1shared), check.Equals, 1) // node1 can see node2 as shared
+	c.Assert(node1shared[0].Name, check.Equals, m2.Name)
+
+	pAlone, err := h.getPeers(m3)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(pAlone), check.Equals, 0) // node3 is alone
+
+	pSharedTo, err := h.getPeers(m2)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(pSharedTo), check.Equals, 2) // node2 should see node1 (sharedTo) and node4 (sharedTo), as is shared in namespace1
+	c.Assert(pSharedTo[0].Name, check.Equals, m1.Name)
+	c.Assert(pSharedTo[1].Name, check.Equals, m4.Name)
+}
+
+func (s *Suite) TestDeleteSharedMachine(c *check.C) {
+	n1, m1 := CreateNodeNamespace(c, "shared1", "test_get_shared_nodes_1", "686824e749f3b7f2a5927ee6c1e422aee5292592d9179a271ed7b3e659b44a66", "100.64.0.1")
+	_, m2 := CreateNodeNamespace(c, "shared2", "test_get_shared_nodes_2", "dec46ef9dc45c7d2f03bfcd5a640d9e24e3cc68ce3d9da223867c9bc6d5e9863", "100.64.0.2")
+	_, m3 := CreateNodeNamespace(c, "shared3", "test_get_shared_nodes_3", "6e704bee83eb93db6fc2c417d7882964cd3f8cc87082cbb645982e34020c76c8", "100.64.0.3")
+
+	pak4n1, err := h.CreatePreAuthKey(n1.Name, false, false, nil)
+	c.Assert(err, check.IsNil)
+	m4 := &Machine{
+		ID:             4,
+		MachineKey:     "4c3e07c3ecd40e9c945bb6797557c451850691c0409740578325e17009dd298f",
+		NodeKey:        "4c3e07c3ecd40e9c945bb6797557c451850691c0409740578325e17009dd298f",
+		DiscoKey:       "4c3e07c3ecd40e9c945bb6797557c451850691c0409740578325e17009dd298f",
+		Name:           "test_get_shared_nodes_4",
+		NamespaceID:    n1.ID,
+		Registered:     true,
+		RegisterMethod: "authKey",
+		IPAddress:      "100.64.0.4",
+		AuthKeyID:      uint(pak4n1.ID),
+	}
+	h.db.Save(m4)
+
+	_, err = h.GetMachine(n1.Name, m4.Name)
+	c.Assert(err, check.IsNil)
+
 	p1s, err := h.getPeers(m1)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(p1s), check.Equals, 1) // nodes 1 and 4
-	c.Assert(p1s[0].Name, check.Equals, "test_get_shared_nodes_4")
+	c.Assert(p1s[0].Name, check.Equals, m4.Name)

 	err = h.AddSharedMachineToNamespace(m2, n1)
 	c.Assert(err, check.IsNil)
@@ -352,15 +209,26 @@ func (s *Suite) TestComplexSharingAcrossNamespaces(c *check.C) {
 	p1sAfter, err := h.getPeers(m1)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(p1sAfter), check.Equals, 2) // nodes 1, 2, 4
-	c.Assert(p1sAfter[0].Name, check.Equals, "test_get_shared_nodes_2")
-	c.Assert(p1sAfter[1].Name, check.Equals, "test_get_shared_nodes_4")
+	c.Assert(p1sAfter[0].Name, check.Equals, m2.Name)
+	c.Assert(p1sAfter[1].Name, check.Equals, m4.Name)

 	node1shared, err := h.getShared(m1)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(node1shared), check.Equals, 1) // nodes 1, 2, 4
-	c.Assert(node1shared[0].Name, check.Equals, "test_get_shared_nodes_2")
+	c.Assert(node1shared[0].Name, check.Equals, m2.Name)

 	pAlone, err := h.getPeers(m3)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(pAlone), check.Equals, 0) // node 3 is alone
+
+	sharedMachines, err := h.ListSharedMachinesInNamespace(n1.Name)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(*sharedMachines), check.Equals, 1)
+
+	err = h.DeleteMachine(m2)
+	c.Assert(err, check.IsNil)
+
+	sharedMachines, err = h.ListSharedMachinesInNamespace(n1.Name)
+	c.Assert(err, check.IsNil)
+	c.Assert(len(*sharedMachines), check.Equals, 0)
 }
Author	SHA1	Message	Date
Juan Font	f822816cdb	Merge pull request #193 from juanfont/fix-again-contributors Another fix for the contributors section in README	2021-10-21 23:55:41 +02:00
Juan Font Alonso	f3bf9b4bbb	Contributors again fixed	2021-10-21 23:54:20 +02:00
Juan Font	9fbfa7c1f5	Merge pull request #191 from juanfont/fix-contributors Fix contributors	2021-10-21 23:32:43 +02:00
Juan Font Alonso	d5aef85bf2	Fix contributors	2021-10-21 23:21:38 +02:00
Juan Font Alonso	e425e3ffd3	Fix contributors	2021-10-21 22:53:30 +02:00
Juan Font	355483fd86	Merge pull request #184 from juanfont/doc-reorg-v1 Move documentation away from README and use YAML everywhere	2021-10-21 22:38:59 +02:00
Juan Font Alonso	672d8474b9	PRettier on the yamls	2021-10-21 21:18:50 +02:00
Juan Font Alonso	73e4d38670	Merge branch 'doc-reorg-v1' of https://github.com/juanfont/headscale into doc-reorg-v1	2021-10-21 21:01:57 +02:00
Juan Font Alonso	561c15bbe8	Prettier	2021-10-21 21:01:52 +02:00
Juan Font Alonso	b93aa723cb	Run contributors on merge to master	2021-10-21 20:58:30 +02:00
Juan Font Alonso	636943c715	Improved docker cmd	2021-10-21 20:57:18 +02:00
Juan Font	0a6a67da85	Merge branch 'main' into doc-reorg-v1	2021-10-21 20:55:48 +02:00
Juan Font Alonso	e9ffd366dd	Improvements here and there	2021-10-21 20:54:41 +02:00
Juan Font Alonso	4be0b3f556	Mention disable check updates in the doc	2021-10-21 20:54:29 +02:00
Juan Font Alonso	a0bfad6d6e	Headscale is not capitalized	2021-10-21 20:48:29 +02:00
Juan Font Alonso	bb1f17f5af	Added glossary	2021-10-21 20:46:19 +02:00
Juan Font	95bc2ee241	Merge pull request #190 from juanfont/fix-arm64 Fix arm64 (now for good)	2021-10-21 20:40:17 +02:00
Juan Font Alonso	16a90e799c	Contributors should be working	2021-10-21 20:36:26 +02:00
Juan Font Alonso	4c2f84b211	Add contributors Action	2021-10-21 20:33:58 +02:00
Juan Font Alonso	b799635fbb	Merge branch 'fix-arm64' of https://github.com/juanfont/headscale into fix-arm64	2021-10-21 19:56:51 +02:00
Juan Font Alonso	bc145952d4	Finally fix arm64 build	2021-10-21 19:56:36 +02:00
Kristoffer Dalby	2c5701917d	Merge branch 'main' into doc-reorg-v1	2021-10-21 18:46:29 +01:00
Juan Font	ed7b840fea	Merge pull request #188 from juanfont/fix-arm64 Fixed ARM64 compiler name	2021-10-21 19:10:14 +02:00
Kristoffer Dalby	23372e29cd	Merge branch 'main' into fix-arm64	2021-10-21 17:03:46 +01:00
Juan Font Alonso	fb569b0483	Fixed ARM64 compiler name	2021-10-21 17:47:10 +02:00
Juan Font	e2b5638ca0	Merge pull request #187 from juanfont/fix-arm64 Use CGO_ENABLED=1 when building arm64	2021-10-21 00:00:47 +02:00
Juan Font Alonso	8f5a1dce3e	Merge branch 'doc-reorg-v1' of https://github.com/juanfont/headscale into doc-reorg-v1	2021-10-20 23:34:27 +02:00
Juan Font Alonso	6b0f5da113	Separate config examples for sqlite and postgres for the time being	2021-10-20 23:27:59 +02:00
Juan Font Alonso	5159b6d085	Trying to fix arm64	2021-10-20 23:10:59 +02:00
Juan Font	03d97c3872	Merge pull request #183 from juanfont/split-dns Add support for Split DNS (Restricted Nameservers)	2021-10-20 10:53:52 +02:00
Juan Font	41c5a0ddf5	Apply suggestions from code review Co-authored-by: Kristoffer Dalby <kradalby@kradalby.no>	2021-10-20 09:35:56 +02:00
Juan Font	19165a40d2	Merge branch 'main' into split-dns	2021-10-20 00:19:34 +02:00
Juan Font	d1ebcb59f1	Merge branch 'main' into doc-reorg-v1	2021-10-20 00:19:21 +02:00
Juan Font Alonso	31344128a0	Switch json for yaml in README	2021-10-20 00:17:47 +02:00
Juan Font Alonso	86ecc2a234	Switch to YAML config	2021-10-20 00:17:08 +02:00
Juan Font Alonso	d1e8ac7ba5	Moved TLS config to another file	2021-10-20 00:07:05 +02:00
Juan Font Alonso	efe208fef5	Merge branch 'doc-reorg-v1' of https://github.com/juanfont/headscale into doc-reorg-v1	2021-10-19 23:54:32 +02:00
Juan Font Alonso	7b40e99aec	Added notes on SQLite	2021-10-19 23:45:20 +02:00
Juan Font	06706aab9a	Update docs/Running.md Co-authored-by: Kristoffer Dalby <kradalby@kradalby.no>	2021-10-19 23:41:08 +02:00
Juan Font	0318af5a33	Apply suggestions from code review Co-authored-by: Kristoffer Dalby <kradalby@kradalby.no>	2021-10-19 23:22:56 +02:00
Juan Font Alonso	995dcfc6ae	Reference doc/	2021-10-19 21:02:45 +02:00
Juan Font Alonso	2236cc8bf7	Improve wording here and there	2021-10-19 21:01:36 +02:00
Juan Font Alonso	7bb354117b	Move README documentation to doc/	2021-10-19 20:59:33 +02:00
Juan Font Alonso	18b00b5d8d	Add support for Split DNS (implements #179 )	2021-10-19 20:51:43 +02:00
Juan Font	d2a162e3ee	Merge pull request #178 from cure/refactor-sharing-tests Apply some DRY to the sharing tests.	2021-10-19 18:45:37 +02:00
Ward Vandewege	d35f5fe498	Apply some DRY to the sharing tests.	2021-10-18 17:52:38 -04:00
Juan Font	9e1253ada1	Merge pull request #177 from cure/cli-unshare-node Cli unshare node	2021-10-18 12:51:53 +02:00
Juan Font	244e79f575	Merge branch 'main' into cli-unshare-node	2021-10-18 12:34:13 +02:00
Juan Font	b4e6a32b4b	Merge pull request #176 from cure/fix-sharing-check Bugfix: the check to see if a node was already shared into a namespace	2021-10-18 12:34:04 +02:00
Juan Font	023cd8f4cd	Merge branch 'main' into fix-sharing-check	2021-10-18 12:20:43 +02:00
Juan Font	10d24e64cd	Merge pull request #174 from juanfont/fix-magic-dns-base-domain Fix MagicDNS base domain	2021-10-18 12:16:07 +02:00
Juan Font Alonso	37e191a75d	Solved merge	2021-10-17 23:59:44 +02:00
Juan Font Alonso	01a5fe3c51	Added tests, solved some bugs, and code reorg	2021-10-17 23:58:09 +02:00
Ward Vandewege	9e3339b4f1	Add cli support for unsharing a node from a namespace.	2021-10-17 16:29:46 -04:00
Ward Vandewege	b06e34f144	Bugfix: the check to see if a node was already shared into a namespace was incorrect.	2021-10-17 15:53:39 -04:00
Kristoffer Dalby	ddf042cab1	Merge branch 'main' into fix-magic-dns-base-domain	2021-10-17 13:23:21 +01:00
Juan Font Alonso	687e8d12be	Do not use the full application for getMapResponseDNSConfig	2021-10-17 12:10:03 +02:00
Juan Font Alonso	01f755ecf9	Send UserProfile info for the peers' namespaces	2021-10-17 12:07:01 +02:00
Juan Font Alonso	8094e6fdef	Preload the Namespace from SharedMachines	2021-10-17 11:59:08 +02:00
Juan Font Alonso	061efa1822	Do not include BaseDomain as full route in DNSConfig + code reorg	2021-10-17 11:57:53 +02:00
Juan Font	9a7472218e	Merge pull request #172 from cure/rename-namespaces Rename namespaces	2021-10-17 00:30:36 +02:00
Ward Vandewege	7dcf4a5147	Add support for renaming namespaces.	2021-10-16 11:20:06 -04:00
Ward Vandewege	306a80cf57	Bugfix: when namespace destruction causes a database error, return the error, not nil.	2021-10-16 11:14:37 -04:00
Juan Font	a9a1a8fb3c	Merge pull request #171 from juanfont/force-flag Added --force flag on node delete	2021-10-16 14:21:35 +02:00
Juan Font	85ddc0db33	Merge branch 'main' into force-flag	2021-10-16 14:09:59 +02:00
Juan Font	fddc2aa8fa	Merge pull request #150 from juanfont/fix-shared-nodes Fix shared nodes	2021-10-16 14:09:23 +02:00
Juan Font Alonso	be3a379d10	Added --force flag on node delete (fixes #164 )	2021-10-16 12:30:52 +02:00
Juan Font Alonso	d0daff180e	Added TODO in waiting	2021-10-16 11:36:16 +02:00
Juan Font Alonso	be36480a64	Reverted back values in integration tests	2021-10-16 11:06:33 +02:00
Juan Font	9f52a64a6a	Merge branch 'main' into fix-shared-nodes	2021-10-16 10:22:42 +02:00
Juan Font	52511af8e4	Merge pull request #169 from juanfont/arm64-binaries Generate arm64 binaries in goreleaser	2021-10-16 10:22:24 +02:00
Juan Font	ddb6bd795c	Merge branch 'main' into arm64-binaries	2021-10-16 10:10:54 +02:00
Juan Font	271660a284	Merge pull request #167 from juanfont/authkey-namespace-preload Preload AuthKey Namespace on list nodes	2021-10-16 10:10:42 +02:00
Juan Font	0b0f7db534	Merge branch 'main' into authkey-namespace-preload	2021-10-16 09:59:34 +02:00
Juan Font	5a7b377f6f	Merge pull request #166 from juanfont/complete-expire-command Improve help message to expire key	2021-10-16 09:59:15 +02:00
Juan Font	654d2b9910	Merge branch 'main' into complete-expire-command	2021-10-16 09:41:14 +02:00
Juan Font	829a8c4381	Merge pull request #165 from juanfont/expire-json Show JSON on error when expiring key	2021-10-16 09:40:48 +02:00
Juan Font Alonso	5807562b56	Add arm64 binaries	2021-10-15 17:00:04 +02:00
Juan Font Alonso	985c6e7cc9	Preload AuthKey Namespace on list nodes (fixes #163 )	2021-10-15 00:04:04 +02:00
Juan Font Alonso	0d13e16fed	Improve help message to expire key (fixes #161 )	2021-10-14 23:58:15 +02:00
Juan Font Alonso	91d135e069	Show JSON when error on expire key (fixes #162 )	2021-10-14 23:54:07 +02:00
Juan Font Alonso	3e1e07e8c1	Fixed integration tests for shared nodes	2021-10-14 22:37:44 +02:00
Juan Font	6c4c761408	Merge branch 'main' into fix-shared-nodes	2021-10-13 23:54:30 +02:00
Juan Font	abfb1791f1	Merge pull request #159 from juanfont/better-pak-management Add field AlreadyUsed to AuthKeys	2021-10-13 23:45:10 +02:00
Juan Font Alonso	7ce8c4c649	Fixed merge	2021-10-13 23:28:47 +02:00
Juan Font Alonso	2ddca366f2	Merge branch 'main' of https://github.com/juanfont/headscale into main	2021-10-13 23:23:12 +02:00
Juan Font Alonso	9a6ac6e3e6	Reword errSingleUseAuthKeyHasBeenUsed	2021-10-13 23:23:07 +02:00
Juan Font	cc3e8705bd	Merge branch 'main' into better-pak-management	2021-10-13 23:04:00 +02:00
Juan Font	809a5b84e7	Merge pull request #156 from juanfont/disable-version-check-on-json Disable version checker when using JSON output	2021-10-13 23:00:51 +02:00
Juan Font	06ae2a6c50	Merge branch 'main' into better-pak-management	2021-10-13 23:00:38 +02:00
Juan Font	93517aa6f8	Apply suggestions from code review Renamed AlreadyUsed to Used Co-authored-by: Kristoffer Dalby <kradalby@kradalby.no>	2021-10-13 22:51:55 +02:00
Juan Font	5f0f3705c0	Merge branch 'main' into disable-version-check-on-json	2021-10-13 22:44:18 +02:00
Juan Font	70ae18c3a8	Merge pull request #155 from juanfont/fix-json-delete-node Add JSON output when deleting node	2021-10-13 22:44:00 +02:00
Juan Font Alonso	6aa763a1ae	Expanded unit tests to better cover sharing nodes	2021-10-13 20:56:32 +02:00
Juan Font Alonso	ebfb8c8c5e	Fix tests, as IDs of Machines where wrongly starting in 0	2021-10-13 20:48:50 +02:00
Juan Font Alonso	30788e1a70	Add AlreadyUsed field to Auth Keys (fixes #157 and #158 )	2021-10-13 18:13:26 +02:00
Juan Font Alonso	27947c6746	This commit disables the version checker when JSON output (#153 )	2021-10-13 00:18:55 +02:00
Juan Font Alonso	6924b7bf4c	Output json when deleting node (fixes #152 )	2021-10-12 23:48:08 +02:00
Juan Font Alonso	fa8cd96108	Get peers from namespaces where shared nodes are shared to This is rather shameful. Shared nodes should have never worked without this.	2021-10-12 17:20:14 +02:00
Juan Font	dd1e425d02	Merge pull request #147 from juanfont/fix-delete-shared-nodes Fix error 500 when deleting a shared node	2021-10-11 18:19:36 +02:00
Juan Font Alonso	7f2027d7f2	Added unit tests	2021-10-10 23:55:18 +02:00
Juan Font Alonso	48f5a9a18c	Fix error 500 when deleting shared node (fixes #133 )	2021-10-10 23:55:03 +02:00
Kristoffer Dalby	087c461762	Merge pull request #145 from juanfont/discord Remove gitter for discord	2021-10-10 12:24:50 +01:00
Juan Font	d579c1718c	Merge branch 'main' into discord	2021-10-10 13:05:33 +02:00
Juan Font	4c5f667504	Merge pull request #129 from juanfont/magic-dns-support Add support for MagicDNS	2021-10-10 13:05:16 +02:00
Kristoffer Dalby	4c4c95198b	Remove gitter for discord	2021-10-10 12:00:45 +01:00
Juan Font Alonso	5ce1526a06	Do not return a pointer	2021-10-10 12:43:41 +02:00
Juan Font Alonso	d70c3d6189	Added more comments, plus renamed vars with better names	2021-10-10 12:34:55 +02:00
Juan Font Alonso	9a0c9768ad	Merge branch 'magic-dns-support' of https://github.com/juanfont/headscale into magic-dns-support	2021-10-10 00:40:35 +02:00
Juan Font Alonso	6884798404	Added some comments	2021-10-10 00:40:25 +02:00
Juan Font	c4487b73c4	Merge branch 'main' into magic-dns-support	2021-10-09 12:24:07 +02:00
Juan Font Alonso	32c3f09eb4	Fixed conflict	2021-10-09 12:23:05 +02:00
Juan Font Alonso	d4dc133e20	Added unit tests	2021-10-09 12:22:21 +02:00
Juan Font Alonso	fc5153af3e	Generate MagicDNS search domains for any tailnet range	2021-10-09 12:22:13 +02:00
Juan Font	1a0f6f6e39	Added note on TODO	2021-10-05 19:01:56 +02:00
Juan Font	6981543db6	Only search domain from current namespace in MapResponse	2021-10-05 19:00:40 +02:00
Juan Font	c9a411e341	Preload namespace	2021-10-05 17:47:21 +02:00
Juan Font Alonso	b02a9f9769	Go mod updates	2021-10-04 23:50:26 +02:00
Juan Font Alonso	a0fa652449	MagicDNS changes merged back	2021-10-04 23:49:16 +02:00
Juan Font Alonso	2eef535b4b	Merged main	2021-10-04 23:43:42 +02:00
Juan Font Alonso	61870a275f	WIP preparation for merge	2021-10-04 22:51:05 +02:00
Juan Font Alonso	088e8248d3	Improved doc	2021-10-04 22:50:33 +02:00
Juan Font Alonso	da4a9dadd5	Warn users when MagicDNS is set with no DNS servers	2021-10-04 22:16:53 +02:00
Juan Font	02bc7314f4	Update dns.go Co-authored-by: Kristoffer Dalby <kradalby@kradalby.no>	2021-10-04 21:47:09 +02:00
Juan Font Alonso	1a41a9f2c7	Updated readme	2021-10-04 20:27:45 +02:00
Juan Font	040a18e6f8	Merge branch 'main' into magic-dns-support	2021-10-04 19:45:12 +02:00
Juan Font Alonso	ec911981c2	Do not allow magicdns if not nameservers set up	2021-10-04 19:43:58 +02:00
Juan Font Alonso	ef0f7c0c09	Integration tests for MagicDNS working	2021-10-04 18:04:08 +02:00
Juan Font Alonso	e60ceefea9	Fixing nil issue	2021-10-04 18:03:44 +02:00
Juan Font Alonso	64185cc2bc	Fixed go mod	2021-10-02 15:18:05 +02:00
Juan Font	990ff153c0	Merge branch 'main' into magic-dns-support	2021-10-02 15:16:51 +02:00
Juan Font Alonso	47dcc940c0	Fixed issue in tests	2021-10-02 14:49:14 +02:00
Juan Font Alonso	8d60ae2c7e	Tidy gomod	2021-10-02 13:03:41 +02:00
Juan Font Alonso	19492650d4	Fixed error on assign	2021-10-02 13:03:08 +02:00
Juan Font Alonso	36ae14bccf	Send search domains	2021-10-02 12:13:19 +02:00
Juan Font Alonso	45e71ecba0	Generated MagicDNS search domains (only in 100.64.0.0/10)	2021-10-02 12:13:05 +02:00
Juan Font Alonso	e432e98413	Send hostname in toNode	2021-10-02 12:12:22 +02:00
Juan Font Alonso	656237e167	Propagate dns config vales across Headscale	2021-10-02 11:20:42 +02:00
Juan Font Alonso	5dbf6b5127	Extended DNS config unit tests	2021-10-02 11:14:18 +02:00
Juan Font Alonso	c9e4da3ff5	Improving documentation for DNS config	2021-10-02 11:11:18 +02:00
Juan Font Alonso	3f3cfedffa	Add support for MagicDNS	2021-09-28 00:22:29 +02:00