-
-
Notifications
You must be signed in to change notification settings - Fork 72
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[FEAT] add OAuth key integration and additional URL-style params to -…
…-auth-key flags (ephemeral & preauthorized) (#399) * Add auth-key additional params * fix bool * fix identation * add tailscale_authkey_sting, more docs * add key info * fix headscale case and README * make md linter happy * Update README.md Co-authored-by: Ari Kalfus <[email protected]> * Update README.md Co-authored-by: Ari Kalfus <[email protected]> * Update README.md Co-authored-by: Ari Kalfus <[email protected]> * Update README.md Co-authored-by: Ari Kalfus <[email protected]> * Update README.md Co-authored-by: Ari Kalfus <[email protected]> * Update defaults/main.yml Co-authored-by: Ari Kalfus <[email protected]> * Update README.md Co-authored-by: Ari Kalfus <[email protected]> * Update README.md Co-authored-by: Ari Kalfus <[email protected]> * Apply suggestions from code review Co-authored-by: Ari Kalfus <[email protected]> * molecule fix * fix linter --------- Co-authored-by: Ari Kalfus <[email protected]>
- Loading branch information
Showing
11 changed files
with
212 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| --- | ||
| - name: Cleanup | ||
| hosts: instance | ||
| tasks: | ||
| - name: De-register Tailscale node | ||
| become: true | ||
| ansible.builtin.command: tailscale logout | ||
| changed_when: false |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| --- | ||
| - name: Converge | ||
| hosts: instance | ||
| tasks: | ||
| - name: Init tailscale credentials variables | ||
| ansible.builtin.include_tasks: init_tailscale_vars.yml | ||
|
|
||
| - name: "Include artis3n.tailscale" | ||
| ansible.builtin.include_role: | ||
| name: artis3n.tailscale | ||
| vars: | ||
| verbose: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| # minimal Headscale configuration for local testing | ||
| # See upstream example file for full description of all options: | ||
| # https://github.com/juanfont/headscale/blob/main/config-example.yaml | ||
| server_url: http://headscale:8080 | ||
| listen_addr: 0.0.0.0:8080 | ||
| metrics_listen_addr: 0.0.0.0:9090 | ||
| private_key_path: /etc/headscale/private.key | ||
| noise: | ||
| private_key_path: /etc/headscale/noise_private.key | ||
| db_type: sqlite3 | ||
| db_path: /etc/headscale/db.sqlite | ||
|
|
||
| # Default Tailscale prefixes | ||
| ip_prefixes: | ||
| - fd7a:115c:a1e0::/48 | ||
| - 100.64.0.0/10 | ||
|
|
||
| # Disable TLS | ||
| tls_cert_path: "" | ||
| tls_key_path: "" | ||
|
|
||
| # Add DNS configuration so we can --accept-dns | ||
| dns_config: | ||
| override_local_dns: true | ||
| nameservers: | ||
| - 1.1.1.1 | ||
|
|
||
| derp: | ||
| server: | ||
| enabled: true | ||
| region_id: 999 | ||
| region_code: "headscale" | ||
| region_name: "Headscale Embedded DERP" | ||
| stun_listen_addr: "0.0.0.0:3478" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| --- | ||
| - name: Use tailscale service | ||
| ansible.builtin.set_fact: | ||
| tailscale_authkey: "{{ lookup('ansible.builtin.env', 'TAILSCALE_OAUTH_CLIENT_SECRET') }}" | ||
| when: not lookup('ansible.builtin.env', 'USE_HEADSCALE', default=false) | ||
|
|
||
| - name: Fetch headscale preauth key | ||
| delegate_to: localhost | ||
| changed_when: false | ||
| community.docker.docker_container_exec: | ||
| container: headscale | ||
| command: headscale preauthkeys list -u test -o json | ||
| register: preauth_list | ||
| when: lookup('ansible.builtin.env', 'USE_HEADSCALE', default=false) | ||
|
|
||
| - name: Use headscale service | ||
| vars: | ||
| combined_args: "{{ tailscale_args|default('') }} --login-server=http://headscale:8080" | ||
| ansible.builtin.set_fact: | ||
| tailscale_authkey: "{{ (preauth_list.stdout|from_json)[0].key }}" | ||
| tailscale_args: "{{ combined_args }}" | ||
| when: lookup('ansible.builtin.env', 'USE_HEADSCALE', default=false) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| --- | ||
| dependency: | ||
| name: galaxy | ||
| options: | ||
| requirements-file: requirements.yml | ||
| driver: | ||
| name: docker | ||
| platforms: | ||
| - name: instance | ||
| image: ${MOLECULE_DISTRO:-geerlingguy/docker-ubuntu2204-ansible:latest} | ||
| command: ${MOLECULE_COMMAND:-/usr/sbin/init} | ||
| volumes: | ||
| - /sys/fs/cgroup:/sys/fs/cgroup:rw | ||
| docker_networks: | ||
| - name: headscale | ||
| networks: | ||
| - name: bridge | ||
| - name: headscale | ||
| cgroupns_mode: host | ||
| privileged: true | ||
| pre_build_image: true | ||
| - name: headscale | ||
| image: ${HEADSCALE_IMAGE:-headscale/headscale:latest} | ||
| command: headscale serve | ||
| pre_build_image: true | ||
| networks: | ||
| - name: headscale | ||
| volumes: | ||
| - "${MOLECULE_PROJECT_DIRECTORY}/molecule/default/headscale.config.yaml:/etc/headscale/config.yaml" | ||
| provisioner: | ||
| name: ansible | ||
| verifier: | ||
| name: ansible | ||
| scenario: | ||
| name: oauth | ||
| test_sequence: | ||
| - dependency | ||
| - destroy | ||
| - syntax | ||
| - create | ||
| - prepare | ||
| - converge | ||
| - idempotence | ||
| - verify | ||
| - cleanup | ||
| - destroy |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| - name: Prepare | ||
| hosts: localhost | ||
| gather_facts: false | ||
| tasks: | ||
| - name: Create Headscale user | ||
| community.docker.docker_container_exec: | ||
| container: headscale | ||
| command: headscale users create test | ||
|
|
||
| - name: Create preauth key | ||
| community.docker.docker_container_exec: | ||
| container: headscale | ||
| command: headscale preauthkeys create -u test --reusable | ||
|
|
||
| - name: Fetch Headscale container info | ||
| community.docker.docker_container_info: | ||
| name: headscale | ||
| register: headscale_info | ||
|
|
||
| - name: Set hosts override for Headscale | ||
| delegate_to: instance | ||
| ansible.builtin.lineinfile: | ||
| path: /etc/hosts | ||
| line: "{{ headscale_info.container.NetworkSettings.Networks.headscale.IPAddress }} headscale" | ||
| unsafe_writes: true # Hosts file in the docker container can't be written to atomically |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| --- | ||
| - name: Verify | ||
| hosts: instance | ||
| tasks: | ||
| - name: Get Tailscale status | ||
| become: true | ||
| ansible.builtin.command: tailscale status | ||
| changed_when: false | ||
| register: tailscale_status | ||
|
|
||
| - name: Assertions | ||
| ansible.builtin.assert: | ||
| that: | ||
| - "'Logged out.' not in tailscale_status.stdout" | ||
| - "'not logged in' not in tailscale_status.stdout" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters