Add worker reading extra_records_path from file (#2271)
* consolidate scheduled tasks into one goroutine Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename Tailcfg dns struct Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add dns.extra_records_path option Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * prettier lint Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * go-fmt Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
parent
89a648c7dd
commit
380fcdba17
22 changed files with 388 additions and 81 deletions
15
CHANGELOG.md
15
CHANGELOG.md
|
@ -33,19 +33,19 @@ When automatic migration is enabled (`map_legacy_users: true`), Headscale will f
|
|||
- If `strip_email_domain: true` (the default): the Headscale username matches the "username" part of their email address.
|
||||
- If `strip_email_domain: false`: the Headscale username matches the _whole_ email address.
|
||||
|
||||
On migration, Headscale will change the account's username to their `preferred_username`. **This could break any ACLs or policies which are configured to match by username.**
|
||||
On migration, Headscale will change the account's username to their `preferred_username`. **This could break any ACLs or policies which are configured to match by username.**
|
||||
|
||||
Like with Headscale v0.23.0 and earlier, this migration only works for users who haven't changed their email address since their last Headscale login.
|
||||
Like with Headscale v0.23.0 and earlier, this migration only works for users who haven't changed their email address since their last Headscale login.
|
||||
|
||||
A _successful_ automated migration should otherwise be transparent to users.
|
||||
A _successful_ automated migration should otherwise be transparent to users.
|
||||
|
||||
Once a Headscale account has been migrated, it will be _unavailable_ to be matched by the legacy process. An OIDC login with a matching username, but _non-matching_ `iss` and `sub` will instead get a _new_ Headscale account.
|
||||
Once a Headscale account has been migrated, it will be _unavailable_ to be matched by the legacy process. An OIDC login with a matching username, but _non-matching_ `iss` and `sub` will instead get a _new_ Headscale account.
|
||||
|
||||
Because of the way OIDC works, Headscale's automated migration process can _only_ work when a user tries to log in after the update. Mass updates would require Headscale implement a protocol like SCIM, which is **extremely** complicated and not available in all identity providers.
|
||||
Because of the way OIDC works, Headscale's automated migration process can _only_ work when a user tries to log in after the update. Mass updates would require Headscale implement a protocol like SCIM, which is **extremely** complicated and not available in all identity providers.
|
||||
|
||||
Administrators could also attempt to migrate users manually by editing the database, using their own mapping rules with known-good data sources.
|
||||
Administrators could also attempt to migrate users manually by editing the database, using their own mapping rules with known-good data sources.
|
||||
|
||||
Legacy account migration should have no effect on new installations where all users have a recorded `sub` and `iss`.
|
||||
Legacy account migration should have no effect on new installations where all users have a recorded `sub` and `iss`.
|
||||
|
||||
##### What happens when automatic migration is disabled?
|
||||
|
||||
|
@ -95,6 +95,7 @@ This will also affect the way you [reference users in policies](https://github.c
|
|||
- Fixed missing `stable-debug` container tag [#2232](https://github.com/juanfont/headscale/pr/2232)
|
||||
- Loosened up `server_url` and `base_domain` check. It was overly strict in some cases. [#2248](https://github.com/juanfont/headscale/pull/2248)
|
||||
- CLI for managing users now accepts `--identifier` in addition to `--name`, usage of `--identifier` is recommended [#2261](https://github.com/juanfont/headscale/pull/2261)
|
||||
- Add `dns.extra_records_path` configuration option [#2262](https://github.com/juanfont/headscale/issues/2262)
|
||||
|
||||
## 0.23.0 (2024-09-18)
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue