TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-10-20 06:32:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/ipnserver: add TS_PERMIT_CERT_UID envknob to give webservers cert access

Browse Source 
So you can run Caddy etc as a non-root user and let it have access to
get certs.

Updates caddyserver/caddy#4541

Change-Id: Iecc5922274530e2b00ba107d4b536580f374109b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick
2022-01-25 10:33:11 -08:00
committed by Brad Fitzpatrick
parent 508f332bb2
commit ca774c3249
3 changed files with 30 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ipn/localapi/localapi.go
View File

@@ -52,8 +52,15 @@ type Handler struct {
PermitRead bool
// PermitWrite is whether mutating HTTP handlers are allowed.
// If PermitWrite is true, everything is allowed.
// It effectively means that the user is root or the admin
// (operator user).
PermitWrite bool
// PermitCert is whether the client is additionally granted
// cert fetching access.
PermitCert bool
b *ipnlocal.LocalBackend
logf logger.Logf
backendLogID string