Headscale — The Cyber Toolchain

Headscale v0.29.7

Fri, 30 Oct 2026 09:55:40 GMT

Headscale v0.29.7 adds SSH agent and port forwarding controls and tightens metrics, registration, and route-serving security⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Disable SSH agent and port forwarding on a node by setting `TS_SSH_DISABLE_FORWARDING=1` in the `tailscaled` service environment; applies to all Tailscale SSH sessions on that node and works on older clients too.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Metrics are no longer exposed to unregistered clients through the Noise protocol and remain available only on the configured `metrics_listen_addr`; setting `metrics_listen_addr` to empty disables the listener entirely. • Re-registering an expired tagged node now requires a valid pre-auth key, and another user's key or login on a tagged machine now creates a new device for that user instead of re-authenticating the tagged node. • Pending registration capacity is now bounded: pending interactive registrations and OIDC logins are kept at capacity rather than evicted, new requests get a retry response, registered nodes keep capacity for SSH checks, and stored pending registration data is capped at 64 KiB (keeping tags and expiry), with oversized interactive registrations rejected. • Key expiry values outside the years 0–9999 UTC are now refused at registration, on the OIDC token-expiry path, and in `headscale nodes expire` / `POST /api/v1/node/{node_id}/expire` (HTTP 400). • Client reports are now bounded to the first 256 endpoints and 4096 announced routes, with oversized hostnames, requested tags, or other metadata returning a registration error or HTTP 413 on map updates and zoned IPv6 endpoints refused; at startup, Headscale trims stored hostnames, endpoints, and routes to these limits and removes zoned endpoints. • A stalled request body, or a Noise tunnel with no open request, is now closed after 30 seconds. • SSH policy `acceptEnv` now works correctly, allowing configured environment variables to reach SSH sessions (upgrade SSH destination nodes to Tailscale v1.104.4 or newer before using `acceptEnv`, as older clients can disclose forwarded values). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.29.4

Wed, 23 Sep 2026 19:36:28 GMT

Headscale v0.29.4 adds mapper and node-store metrics and reduces peer-map rebuild churn via node-ID keying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `headscale_mapper_changes_dropped_total` and `headscale_ha_health_updates_total` Prometheus metrics to track suppressed no-op map updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `headscale_nodestore_snapshot_builds_total` Prometheus metric to track peer-map snapshot rebuilds. • Peers the peer map by node ID and reuses it for writes that cannot change peer visibility, so routine map requests no longer trigger a full rebuild. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.29.0

Wed, 17 Jun 2026 09:21:39 GMT

Headscale v0.29.0 adds SSH check-mode auth, policy tests, grants, nodeAttrs, Taildrive, and HA subnet router probing. • Adds SSH `check` action support: when a policy rule uses `"action": "check"`, connecting users must authenticate via OIDC or CLI approval before SSH access is granted. • New `headscale auth` CLI command group with `approve`, `reject`, and `register` subcommands for managing pending SSH-check and web-auth flows. • Evaluates the `tests` block in policy files (beta): reachability assertions run on `headscale policy set`, SIGHUP reload, and `headscale policy check`, rejecting bad policy before it is applied. • Evaluates the `sshTests` block in policy files (beta): per-SSH-rule accept/deny/check reachability assertions with the same rejection semantics as the `tests` block. • Supports Tailscale `grants` in policy files, enabling application-level controls (`app` field for Taildrive, peer relay) and traffic steering (`via` field for subnet routers/exit nodes) alongside ACLs. • Adds `autogroup:danger-all` as a source that resolves to `0.0.0.0/0` and `::/0` for policies that need to match all IPs including non-Tailscale addresses. • Supports `nodeAttrs` block in ACL policy files to assign Tailscale node capabilities (e.g. `disable-captive-portal-detection`, `nextdns:`, `drive:share`, `drive:access`) to targeted nodes. • Adds top-level `randomizeClientPort` policy field to control per-node client port randomization tailnet-wide. • Adds `auto_update.enabled` config option to set the tailnet-wide default for client auto-update via CapMap. • Taildrive file-sharing is now configurable through policy using `drive:share`/`drive:access` node attributes and `tailscale.com/cap/drive` grants. • Hostname sanitisation now uses Tailscale's MagicDNS rules, allowing previously-rejected hostnames with apostrophes, special characters, and dots to register successfully. • Enforces a strict one-minor-version-at-a-time upgrade path; skipping minor versions or downgrading is now blocked at startup. Breaking changes: • Wildcard (`*`) in ACL sources and destinations now resolves to the Tailscale CGNAT range (`100.64.0.0/10`) and ULA range (`fd7a:115c:a1e0::/48`) instead of all IPs (`0.0.0.0/0` and `::/0`); policies that need to match all IPs must use `autogroup:danger-all` as a source or explicit CIDR ranges as destinations. • The `randomize_client_port` server-config key is removed; headscale refuses to start when it is set. Move the toggle to the policy file as the top-level `randomizeClientPort` field. • The `GivenName` collision suffix changed from an 8-char random hash (`laptop-abc12xyz`) to a monotonic numeric suffix (`laptop-1`, `laptop-2`, …); MagicDNS names change on upgrade for any node whose label was previously in random-suffix form. • Empty or all-non-ASCII hostnames now resolve to the literal `node` instead of `invalid-`. • `proto:icmp` now matches only ICMPv4 (protocol 1); it no longer includes ICMPv6. Use `proto:ipv6-icmp` or protocol number `58` for ICMPv6. • Tags, hosts, and IP addresses are now rejected as sources for `autogroup:self` destinations; policies using them will fail validation. • Skipping minor versions (e.g. 0.27 → 0.29) or downgrading to a previous minor version is blocked; upgrade one minor version at a time. • Minimum supported Tailscale client version is now v1.80.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.29.0

Wed, 17 Jun 2026 09:21:39 GMT

Headscale v0.29.0 adds SSH check-mode auth, policy tests, grants, Taildrive, nodeAttrs, and HA subnet router health probing. • New `headscale auth` CLI command group: `approve`, `reject`, and `register` subcommands manage SSH check-mode and web auth approval flows. • Supports Tailscale SSH `"action": "check"` rules, prompting OIDC or CLI approval before granting SSH access to a node. • Evaluates the `tests` block in policy files (beta), asserting reachability between sources and destinations; failing tests block writes before they are applied. • Evaluates the `sshTests` block in policy files (beta), asserting SSH reachability with `accept`, `deny`, and `check` user lists per source/destination pair. • Adds support for Tailscale Grants (`grants` block in policy), enabling application-level controls like Taildrive file sharing and traffic steering via tagged subnet routers or exit nodes. • Introduces `autogroup:danger-all` as a source-only ACL target resolving to all IPs (`0.0.0.0/0` and `::/0`), replacing the prior behavior of wildcard `*`. • New `nodeAttrs` policy block distributes Tailscale node capabilities (e.g., `disable-captive-portal-detection`, `nextdns:`, `drive:share`, `drive:access`) to matched nodes. • Adds `randomizeClientPort` as a top-level policy file field (replaces removed `randomize_client_port` server-config key). • New `auto_update.enabled` config option sets the tailnet-wide default for client auto-update via CapMap. • Taildrive file-sync is now configurable through policy using `drive:share`, `drive:access` nodeAttrs and `tailscale.com/cap/drive` grants. • Hostname sanitisation now uses Tailscale's MagicDNS rules, supporting hostnames with apostrophes, special characters, and non-ASCII characters. • GivenName collision suffix changed from random 8-char hash to monotonic numeric suffix (`laptop`, `laptop-1`, `laptop-2`, …), matching Tailscale SaaS. • BREAKING: `proto:icmp` now covers only ICMPv4; use `proto:ipv6-icmp` or protocol `58` for ICMPv6. • BREAKING: `autogroup:self` destinations now reject tags, hosts, and IPs as sources, matching Tailscale validation. • BREAKING: Headscale enforces a strict sequential upgrade path — skipping minor versions (e.g., 0.27 → 0.29) and downgrading are blocked. • BREAKING: `randomize_client_port` server-config key removed; headscale refuses to start if the old key is present — move it to the policy file. • Raises minimum supported Tailscale client version to v1.80.0. Breaking changes: • MagicDNS `GivenName` collision suffix changed from 8-char random hash (`laptop-abc12xyz`) to monotonic numeric suffix (`laptop`, `laptop-1`, `laptop-2`, …); MagicDNS names change on upgrade for any node whose previous label was a random-suffix form • Empty or all-non-ASCII hostnames now fall back to the literal `node` instead of `invalid-` • Wildcard (`*`) in ACL sources and destinations now resolves to the Tailscale CGNAT range (`100.64.0.0/10`) and ULA range (`fd7a:115c:a1e0::/48`) instead of all IPs (`0.0.0.0/0` and `::/0`); policies relying on `*` to match all IP addresses must switch to `autogroup:danger-all` (source only) or explicit CIDR ranges (destinations) • Policies using tags, hosts, or IP addresses as sources for `autogroup:self` destinations now fail validation • `proto:icmp` now only includes ICMPv4 (protocol 1); ICMPv6 must be specified explicitly as `proto:ipv6-icmp` or protocol number `58` • Skipping minor versions (e.g. 0.27 → 0.29) is blocked; upgrades must proceed one minor version at a time, and downgrading to a previous minor version is blocked • The `randomize_client_port` server-config key was removed; headscale refuses to start when the old key is present — the toggle must be moved to the policy file as the top-level `randomizeClientPort` field • Minimum supported Tailscale client version is now v1.80.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.29.0

Wed, 17 Jun 2026 09:21:39 GMT

Headscale v0.27.1

Tue, 11 Nov 2025 19:32:29 GMT

Headscale v0.27.1 adds custom-timestamp node expiry and improves exit node ACL enforcement. • Supports expiring nodes with a custom timestamp, enabling precise lifecycle control over node access. • Distinguishes subnet routes from exit node routes internally, improving ACL granularity for exit node visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.27.0

Mon, 27 Oct 2025 11:16:35 GMT

Headscale v0.27.0 adds autogroup:self/member/tagged support, a new healthcheck command, in-memory node store, and policy direct-manipulation flag. • Adds support for `autogroup:member` and `autogroup:tagged` autogroups in ACL policy. • Adds experimental support for `autogroup:self` autogroup (may be expensive on large installations; report bugs). • Adds a `healthcheck` CLI command for checking instance health. • Adds a flag to directly manipulate policy stored in the database. • Adds in-memory `NodeStore` data structure to reduce database reads/writes and improve performance on read-heavy workloads. • Policy now rejects invalid/unknown fields, making spelling errors easier to detect. • DERPMap update mechanism now retries on failure and preserves the previous map if an update fails. • OIDC: Group claims are now sourced from UserInfo, and user details are updated from UserInfo claims before evaluating allowed groups, email, and domain. • Adds `/version` HTTP endpoint to the headscale server. • Default `derp.update_frequency` changed from 24 hours to 3 hours for faster propagation of upstream DERP changes. Breaking changes: • 32-bit binaries are no longer produced or supported. • Policy: Zero or empty destination port is no longer allowed in ACL rules. • Stricter hostname validation is enforced: hostnames must be 2–63 characters, alphanumeric and hyphens only, and cannot start or end with a hyphen. During client registration, invalid hostnames are automatically renamed to `invalid-XXXXXX`; during hostinfo updates and CLI operations, invalid hostnames are rejected with an error. • Ubuntu 20.04 is no longer supported by the Debian/Ubuntu packaging. • Policy v1 code has been removed. • SQLite databases undergo a significant schema migration on upgrade — back up your `db.sqlite` (and WAL/SHM files) before upgrading. • The minimum supported Tailscale client version is now v1.64.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.26.0

Wed, 14 May 2025 15:12:14 GMT

Headscale v0.26 rewrites route and policy internals, adds `headscale nodes list-routes`, `approve-routes`, and `policy check` commands. • New `headscale nodes list-routes` command shows approved, available, and serving (primary) routes per node. • New `headscale nodes approve-routes --identifier --routes ` command replaces the old dedicated route API/CLI for managing node routes. • New `headscale policy check --file ` command validates a policy file for errors before loading it. • Routes are now managed via the Node API; route state is kept in-memory rather than a dedicated database table. • Expanded `/debug` endpoint now exposes running goroutines, CPU/memory profiles, config, policy, per-node SSH policy and filter, connected nodes, and DERPmap. • OIDC integration now fetches UserInfo to populate `email_verified`, name, email, and username when the ID token omits them. • Restores support for 'Override local DNS' behaviour. • Performance improvement: node update queries now fetch only nodes relevant to the requesting node. Breaking changes: • The dedicated Route API and Route CLI (`headscale routes …`) have been removed; route management now goes through `headscale nodes list-routes` and `headscale nodes approve-routes`. • Policy v2 is now the default: all usernames in policy rules must contain an `@` character (e.g. `john` must be written as `john@`); policies that previously loaded but failed at runtime will now fail at load time. • The `oidc.map_legacy_users` and `oidc.strip_email_domain` config keys have been removed. • `server_url` and `base_domain` are no longer allowed to be equal. • The pre-auth key API/CLI now uses the numeric ID instead of username to identify keys. • The pre-auth key API now returns a full user object instead of a username string. • Node FQDNs in the netmap now include a trailing dot (`.`), aligning with tailscale.com behaviour — clients that parse FQDNs without expecting a trailing dot may break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.25.0

Tue, 11 Feb 2025 12:16:41 GMT

Headscale v0.25.0 rewrites auth flow, tightens pre-auth key lifecycle, and improves HTTP error reporting. • Registering a node with a new user now creates a distinct new node instead of reusing an existing one. • A logged-out node re-authenticating with the same user replaces the existing node entry. • Pre-auth keys belonging to a user are no longer deleted when the user is deleted. • Pre-auth keys actively used by a node can no longer be deleted. • Outdated nodes now display their Tailscale version instead of raw capability version numbers. • HTTP error responses overhauled to return more accurate status codes and descriptive messages. • Minimum hostname length reduced to 2 characters. • OIDC-managed users can no longer be renamed via OIDC. Breaking changes: • Tailscale clients older than version 1.62 (capability version 87) are no longer supported and will not be able to connect. • `oidc.map_legacy_users` now defaults to `false`; existing deployments relying on legacy OIDC user mapping must explicitly set `oidc.map_legacy_users: true` to preserve prior behaviour. • A node re-registered with a different (new) user is now registered as a brand-new node rather than updating the existing node record — existing node identities tied to user changes will be affected. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.24.0

Fri, 17 Jan 2025 11:58:05 GMT

Headscale v0.24.0 hardens OIDC identity with `iss`/`sub` claims, adds PKCE, SSH agent forwarding, and a new `dns.extra_records_path` option. • Automatically syncs OIDC profile fields (`email`, `name`, `preferred_username`, `picture`) to Headscale user records on every login. • Adds `map_legacy_users` config option to automatically migrate existing OIDC accounts to the new `iss`/`sub` identity model. • Adds PKCE (Proof Key for Code Exchange) verifier support for OIDC authentication flows. • Allows nodes to use SSH agent forwarding. • Adds `dns.extra_records_path` configuration option for supplying additional DNS records. • Supports client certificate verification for DERP connections. • Improves built-in DERP server compatibility with clients connecting over WebSocket. • CLI user management commands now accept `--identifier` in addition to `--name` for referencing users by ID. Breaking changes: • The `dns.use_username_in_magic_dns` configuration option has been removed; usernames in Magic DNS are no longer possible. • Tailscale client versions older than 1.56 are no longer supported. • `GET /api/v1/user/{name}` and the `GetUser` RPC have been removed; use `ListUsers` with an ID parameter instead. • `RenameUser` and `DeleteUser` now require a user ID instead of a name. • On OIDC migration, Headscale renames the account's username to `preferred_username`, which may break ACLs or policies that match by username. • `map_legacy_users` will default to `false` in v0.25.0 and the migration mechanism will be removed in v0.26.0; unmigrated users will receive new accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.23.0

Wed, 18 Sep 2024 08:56:54 GMT

Headscale v0.23.0 adds SSH support, delta network updates, policy APIs, and API key deletion with significant breaking config changes. • Adds Tailscale SSH support, enabling SSH access control through Headscale policy. • Supports delta network map updates — nodes now receive only changed/added/removed node info instead of full network state on every update. • Adds real-time update delivery via go channels (notifier package), replacing fixed-interval polling for lower-latency propagation to connected clients. • New APIs for managing Headscale ACL/policy (read and write policy via API). • Adds support for deleting API keys. • Adds `autogroup:internet` group to policy, matching Tailscale's policy model. • Adds command to backfill IP addresses for nodes missing IPs from configured prefixes. • Supports manual DERP map entry creation with custom configuration instead of automatic generation only. • IP prefix configuration now split into separate `prefixes.v4` and `prefixes.v6` ranges, with new `prefixes.allocation` option supporting `sequential` or `random` IP assignment. • Write-ahead logging (WAL) for SQLite is now on by default and configurable. • PostgreSQL database configuration gains new options for max open connections, idle connections, and idle connection lifetime. • CLI commands (all except `serve`) now require only minimal configuration — no errors or warnings from unset settings. • CLI results are now consistently sent to stdout and errors to stderr. • Logs are now sent to stderr by default. • HuJSON is now the sole supported format for Headscale policy files. Breaking changes: • Database configuration structure has changed and the old structure has been removed — configuration must be converted to the new structure (see config-example.yaml). • The API renames `Machine` to `Node` across all endpoints and responses. • Tailscale clients older than version 1.42 are no longer supported. • Headscale now fails to start if no DERP server is configured (cannot load DERPMap from file or URL). • Embedded DERP server now requires a private key — add a filepath entry to `derp.server.private_key_path` in config. • Docker container image entrypoint changed from shell to headscale binary — `headscale serve` must be changed to `serve` in container commands. • Docker container no longer automatically creates `/var/lib/headscale` and `/var/run/headscale` directories. • `ip_prefixes` config option is renamed to `prefixes.v4` and `prefixes.v6`. • MagicDNS domains no longer contain usernames by default — use `use_username_in_magic_dns` to restore old behavior (this option will be removed when tags are fixed). • `dns.base_domain` can no longer be the same as or part of `server_url`. • YAML format is no longer supported for Headscale policy files — HuJSON is now the only accepted format. • DNS configuration has been restructured — review the new config-example.yaml for the updated layout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.22.2

Thu, 11 May 2023 06:07:41 GMT

Adds Go profiling flags to enable pprof and fixes systemd service file location in .deb packages • Add environment flags to enable pprof (profiling) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.21.0

Mon, 20 Mar 2023 12:56:15 GMT

Adds `configtest` CLI command and route deletion capability • Adds `configtest` CLI command to validate configuration files before starting • Allows deleting routes via the management API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.20.0

Fri, 03 Feb 2023 08:34:42 GMT

Split DNS configuration now works without global nameservers; exit node routes support simultaneous IPv4/IPv6. • Allow split DNS configuration without requiring global nameservers • Enable both exit node routes (IPv4 and IPv6) at the same time Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.18.0

Sat, 14 Jan 2023 18:27:13 GMT

Headscale v0.18.0 adds subnet router failover support and OIDC AllowGroups configuration options. • Adds `oidc.allow_groups` config option to restrict access by group in the `[auth]` section of `headscale.yaml` • Enables subnet router failover via a reworked routing implementation, allowing multiple routes to be active for redundancy • Supports OIDC client secret from file via new config key `oidc.client_secret_file` alongside the existing `oidc.client_secret` option Breaking changes: • `db_ssl` defaults to `false` instead of previous default; if your database requires SSL, you must explicitly set `db_ssl = true` in your config file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.17.0

Sat, 26 Nov 2022 11:07:26 GMT

Headscale v0.17.0 adds TS2021 support, experimental SSH ACLs, and new noise config • `noise.private_key_path` config key is now required to enable the new noise protocol • Added `HEADSCALE_EXPERIMENTAL_FEATURE_SSH=1` environment variable to enable experimental SSH ACLs • Added `HEADSCALE_CONFIG` environment variable to specify custom config file location • Added `dns_config.override_local_dns` option for DNS configuration Breaking changes: • `noise.private_key_path` is now a required config key for the new noise protocol • Log level moved to `log.level` config section; `log_level` top-level key is removed • Alpine Linux container image support removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.16.4

Sun, 21 Aug 2022 09:57:01 GMT

Headscale v0.16.4 adds PostgreSQL TLS/SSL support • Adds ability to connect to PostgreSQL over TLS/SSL Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.16.1

Fri, 12 Aug 2022 08:06:10 GMT

Headscale v0.16.1 adds PostgreSQL unix socket support and switches NodeKey as main identifier • Switches to using `NodeKey` as the primary identifier for nodes in registration protocol Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.16.0

Mon, 25 Jul 2022 08:30:57 GMT

Headscale v0.16.0 adds node management CLI commands, SIGHUP ACL reloads, and new OpenID Connect options • `headscale nodes move` command to migrate nodes between namespaces • `headscale tags create` command to assign tags to a node • `headscale tags list` command to view node tags • -c flag on the CLI to specify a custom config file path • `allow_random_port` configuration key allowing Tailscale clients to use random WireGuard ports • SIGHUP signal support for hot-reloading ACL policies without restart • New OpenID Connect configuration keys: `scopes`, `freeform_parameters`, `domain`, and `user_allowlist` Breaking changes: • Old ACL syntax using 'users' and 'ports' is removed; migrate to 'src' and 'dst' • 32-bit armhf binary builds are no longer published Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.15.0

Sun, 20 Mar 2022 14:22:39 GMT

v0.15.0 adds YAML ACL support, embedded DERP/STUN server, and a `/windows` configuration endpoint • Adds `metrics_listen_addr` config key to `.headscale/config.yaml` for configurable metrics endpoint • Adds `/windows` API endpoint to return Windows configuration instructions and registry file download • Enables writing ACL files with YAML format instead of only JSON • Allows using emails in ACL groups Breaking changes: • Boundaries between Namespaces have been removed; all nodes can communicate by default. Use `config.yaml` ACLs to limit access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.14.0

Thu, 24 Feb 2022 11:37:38 GMT

Headscale v0.14.0 adds configurable mTLS and rewrites ACLs to align with Tailscale • Adds support for configurable mTLS via the `tls_client_auth_mode` setting • Rewrites ACL engine to treat namespaces as Users and allow default inter-machine communication Breaking changes: • ACLs rewritten: Namespaces are now treated as Users, meaning all machines can communicate with all machines by default unless restricted via ACLs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.13.0

Fri, 18 Feb 2022 18:43:21 GMT

Headscale v0.13.0 enables IPv6 addressing and introduces API key authentication for both CLI and HTTP API access, moving away from the legacy `ip_prefix` config field. • Headscale v0.13.0 enables IPv6 addressing and introduces API key authentication for both CLI and HTTP API access, moving away from the legacy `ip_prefix` config field. Breaking changes: • `ip_prefix` in configuration is replaced by `ip_prefixes`; using the old key will no longer work. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.12.4

Sun, 30 Jan 2022 10:34:30 GMT

Adds `headscale keys generate` command and makes gRPC Unix socket permissions configurable via `grpc.socket.mode`. • Adds a new `keys generate` subcommand to create a private key for headscale. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.12.1

Sat, 25 Dec 2021 10:14:18 GMT

v0.12.1 adds a gRPC server and HTTP API, plus beta OIDC auth • Adds a `headscale` gRPC server for CLI communication • Adds an HTTP API endpoint suite (currently disabled) • Adds beta OpenID Connect authentication support Breaking changes: • The private key format changes to match Tailscale 1.18; the old key file must be deleted and `headscale` restarted to auto-generate a new one Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale

Headscale v0.11.0

Mon, 25 Oct 2021 19:23:03 GMT

Headscale v0.11.0 unifies DERP config into a single `config.yaml` and bundles certificates for DERP map discovery. • Unifies `derp.yaml` into the main `config.yaml`, eliminating the need for multiple configuration files • Bundles TLS certificates in the Docker image to allow fetching the DERP map directly from Tailscale • Adds helper functions for building DERP maps from URLs or local files Breaking changes: • The separate `derp.yaml` file is removed; all DERP settings must now be defined in `config.yaml` according to the updated schema in `/config-example.yaml` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/headscale