|
|
<!doctypehtml><html lang=zh-CN><meta charset=UTF-8><meta content=width=device-width name=viewport><meta media="(prefers-color-scheme: light)" content=#222 name=theme-color><meta media="(prefers-color-scheme: dark)" content=#222 name=theme-color><meta content="Hexo 7.3.0" name=generator><link href=https://cdnjs.cloudflare.com rel=preconnect><link href=/images/apple-touch-icon-next.png rel=apple-touch-icon sizes=180x180><link href=/images/favicon-32x32-next.png rel=icon sizes=32x32 type=image/png><link href=/images/favicon-16x16-next.png rel=icon sizes=16x16 type=image/png><link color=#222 href=/images/logo.svg rel=mask-icon><meta content=2X6S9P7CAjXjVvw8YyQR8pCu-B0oEu7O9quLgxXuWyA name=google-site-verification><meta content=dV8JGNzi0c name=baidu-site-verification><script>!function(){var t=!1;function e(){var e;t||(t=!0,(e=document.createElement("script")).setAttribute("data-ad-client","ca-pub-7480618470784058"),e.async=!0,e.src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js",document.head.appendChild(e))}function a(){"requestIdleCallback"in window?window.requestIdleCallback(e,{timeout:5e3}):window.setTimeout(e,5e3)}"complete"===document.readyState?a():window.addEventListener("load",a,{once:!0})}()</script><link href=/css/main.css rel=stylesheet><link crossorigin=anonymous href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.0.0/css/all.min.css integrity=sha256-VHqXKFhhMxcpubYf9xiWdCiojEbY9NexQ4jh8AxbvcM= rel=stylesheet><link crossorigin=anonymous href=https://cdnjs.cloudflare.com/ajax/libs/fancyapps-ui/6.1.14/fancybox/fancybox.css integrity=sha256-mdaMxrItEW6hMIVJJNPKuX0B7KCSJQVEv3mVY4N2we4= rel=stylesheet><script class=next-config data-name=main type=application/json>{"hostname":"nicksxs.me","root":"/","images":"/images","scheme":"Pisces","darkmode":true,"version":"8.29.0","exturl":false,"sidebar":{"position":"left","width_expanded":320,"width_dual_column":240,"display":"post","padding":18,"offset":12},"hljswrap":true,"codeblock":{"theme":{"light":"default","dark":"stackoverflow-dark"},"prism":{"light":"prism","dark":"prism-dark"},"copy_button":{"enable":true,"style":"default"},"fold":{"enable":false,"height":500},"language":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"mediumzoom":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":true,"nav":null},"stickytabs":false,"motion":{"enable":false,"async":false,"duration":200,"transition":{"menu_item":"fadeInDown","post_block":"fadeIn","post_header":"fadeInDown","post_body":"fadeInDown","coll_header":"fadeInLeft","sidebar":"fadeInUp"}},"prism":false,"i18n":{"placeholder":"搜索...","empty":"没有找到任何搜索结果:${query}","hits_time":"找到 ${hits} 个搜索结果(用时 ${time} 毫秒)","hits":"找到 ${hits} 个搜索结果"},"algolia":{"appID":"663Q99OQQD","apiKey":"e461a1371d12cec1491c1153b288a9ed","indexName":"nicksxs","hits":{"per_page":10}}}</script><script defer src=/js/config.js></script><meta content="本文记录 Headscale 服务端的部署和首次组网过程,重点排查配置文件路径、只读文件系统、私钥写入与节点连接问题,并说明使用 Tailscale 客户端接入自建控制服务器的关键步骤。" name=description><meta content=article property=og:type><meta content="Headscale 部署入门与踩坑:配置文件、权限和节点连接" property=og:title><meta content=https://nicksxs.me/2023/01/22/Headscale%E5%88%9D%E4%BD%93%E9%AA%8C%E4%BB%A5%E5%8F%8A%E8%B8%A9%E5%9D%91%E8%AE%B0/index.html property=og:url><meta content="Nicksxs's Blog" property=og:site_name><meta content="本文记录 Headscale 服务端的部署和首次组网过程,重点排查配置文件路径、只读文件系统、私钥写入与节点连接问题,并说明使用 Tailscale 客户端接入自建控制服务器的关键步骤。" property=og:description><meta content=zh_CN property=og:locale><meta content=2023-01-22T13:14:21.000Z property=article:published_time><meta content=2023-01-22T13:14:21.000Z property=article:modified_time><meta content=Nicksxs property=article:author><meta content=headscale property=article:tag><meta content=summary name=twitter:card><link href=https://nicksxs.me/2023/01/22/Headscale%E5%88%9D%E4%BD%93%E9%AA%8C%E4%BB%A5%E5%8F%8A%E8%B8%A9%E5%9D%91%E8%AE%B0/ rel=canonical><script class=next-config data-name=page type=application/json>{"sidebar":"","isHome":false,"isPost":true,"lang":"zh-CN","comments":true,"permalink":"https://nicksxs.me/2023/01/22/Headscale%E5%88%9D%E4%BD%93%E9%AA%8C%E4%BB%A5%E5%8F%8A%E8%B8%A9%E5%9D%91%E8%AE%B0/","path":"2023/01/22/Headscale初体验以及踩坑记/","title":"Headscale 部署入门与踩坑:配置文件、权限和节点连接"}</script><script class=next-config data-name=calendar type=application/json>""</script><title>Headscale 部署入门与踩坑:配置文件、权限和节点连接 | Nicksxs's Blog</title><script async src=https://www.googletagmanager.com/gtag/js?id=UA-61358619-1></script><script class=next-config data-name=google_analytics type=application/json>{"tracking_id":"UA-61358619-1","only_pageview":false,"measure_protocol_api_secret":null}</script><script defer src=/js/third-party/analytics/google-analytics.js></script><script defer src=/js/third-party/analytics/baidu-analytics.js></script><script async src=https://hm.baidu.com/hm.js?20f33b3c0c0eff9b1522999c0015646d></script><script crossorigin=anonymous defer integrity=sha256-QnJV4HT5r8i89ovZGRD86iynZqHerEbT2xt69vDM36I= src=https://cdnjs.cloudflare.com/ajax/libs/fancyapps-ui/6.1.14/fancybox/fancybox.umd.js></script><script defer src=/js/utils.js></script><script defer src=/js/sidebar.js></script><script defer src=/js/next-boot.js></script><script data-algolia-integrity=sha256-o49zoHLDPBm9WLg6AiliAVi3axCRTqe3ltTxLvhzAVg= data-algolia-src=https://cdnjs.cloudflare.com/ajax/libs/algoliasearch/5.36.0/lite/builds/browser.umd.js data-search-src=/js/third-party/search/algolia-search.js src=/js/third-party/search/algolia-search-loader.js></script><script defer src=/js/third-party/fancybox.js></script><noscript><link href=/css/noscript.css rel=stylesheet></noscript><link title="Nicksxs's Blog" href=/atom.xml rel=alternate type=application/atom+xml><body itemscope itemtype=http://schema.org/WebPage><div class=headband></div><main class=main><div class=column><header class=header itemscope itemtype=http://schema.org/WPHeader><div class=site-brand-container><div class=site-nav-toggle><div aria-label=切换导航栏 class=toggle role=button><span class=toggle-line></span><span class=toggle-line></span><span class=toggle-line></span></div></div><div class=site-meta><a class=brand href=/ rel=start><i class=logo-line></i><p class=site-title>Nicksxs's Blog</p><i class=logo-line></i></a><p class=site-subtitle itemprop=description>Java 运行时、生产诊断与 AI 工程实践</div><div class=site-nav-right><div class="toggle popup-trigger" aria-label=搜索 role=button><i class="fa fa-search fa-fw fa-lg"></i></div></div></div><nav class=site-nav><ul class="main-menu menu"><li class="menu-item menu-item-home"><a href=/ rel=section><i class="fa fa-home fa-fw"></i>首页</a><li class="menu-item menu-item-专题"><a href=/topics/ rel=section><i class="fa fa-layer-group fa-fw"></i>专题</a><li class="menu-item menu-item-工具"><a href=/tools/ rel=section><i class="fa fa-toolbox fa-fw"></i>工具</a><li class="menu-item menu-item-about"><a href=/about/ rel=section><i class="fa fa-user fa-fw"></i>关于我</a><li class="menu-item menu-item-tags"><a href=/tags/ rel=section><i class="fa fa-tags fa-fw"></i>标签</a><li class="menu-item menu-item-categories"><a href=/categories/ rel=section><i class="fa fa-th fa-fw"></i>分类</a><li class="menu-item menu-item-archives"><a href=/archives/ rel=section><i class="fa fa-archive fa-fw"></i>归档</a><li class="menu-item menu-item-search"><a class=popup-trigger role=button><i class="fa fa-search fa-fw"></i>搜索</a></ul></nav><div class=search-pop-overlay><div class="popup search-popup"><div class=search-header><span class=search-icon><i class="fa fa-search"></i></span><div class=search-input-container><input autocapitalize=off autocomplete=off class=search-input maxlength=80 placeholder=搜索... spellcheck=false type=search></div><span class=popup-btn-close role=button><i class="fa fa-times-circle"></i></span></div><div class=search-result-container><div class=search-result-icon><i class="fab fa-algolia fa-5x"></i></div></div></div></div></header><aside class=sidebar><div class="sidebar-inner sidebar-nav-active sidebar-toc-active"><ul class=sidebar-nav><li class=sidebar-nav-toc>文章目录<li class=sidebar-nav-overview>站点概览</ul><div class=sidebar-panel-container><div class="post-toc-wrap sidebar-panel"><div class="post-toc animated"><ol class=nav><li class="nav-item nav-level-3"><a class=nav-link href=#%E7%AC%AC%E4%B8%80%E4%B8%AA%E9%97%AE%E9%A2%98><span class=nav-number>1.</span> <span class=nav-text>第一个问题</span></a><li class="nav-item nav-level-3"><a class=nav-link href=#%E7%AC%AC%E4%BA%8C%E4%B8%AA%E9%97%AE%E9%A2%98><span class=nav-number>2.</span> <span class=nav-text>第二个问题</span></a></ol></div></div><div class="site-overview-wrap sidebar-panel"><div class="site-author animated" itemprop=author itemscope itemtype=http://schema.org/Person><img alt=Nicksxs class=site-author-image itemprop=image src=/uploads/avatar.jpg><p class=site-author-name itemprop=name>Nicksxs<div class=site-description itemprop=description>Nicksxs 的技术博客,深入 Java 运行时与生产诊断、低成本大模型推理和 Agent 工程实践。</div></div><div class="site-state-wrap animated"><nav class=site-state><div class="site-state-item site-state-posts"><a href=/archives/><span class=site-state-item-count>394</span> <span class=site-state-item-name>日志</span></a></div><div class="site-state-item site-state-categories"><a href=/categories/><span class=site-state-item-count>181</span> <span class=site-state-item-name>分类</span></a></div><div class="site-state-item site-state-tags"><a href=/tags/><span class=site-state-item-count>347</span> <span class=site-state-item-name>标签</span></a></div></nav></div><div class="links-of-author animated"><span class=links-of-author-item><a rel="noopener me" title="GitHub → https://github.com/nicksxs" href=https://github.com/nicksxs target=_blank><i class="fab fa-github fa-fw"></i>GitHub</a> </span><span class=links-of-author-item><a rel="noopener me" title="E-Mail → mailto:nicksxs1202@gmail.com" href=mailto:nicksxs1202@gmail.com target=_blank><i class="fa fa-envelope fa-fw"></i>E-Mail</a></span></div><div class="cc-license animated" itemprop=license><a class=cc-opacity href=https://creativecommons.org/licenses/by-nc-sa/4.0/ rel=noopener target=_blank><img alt="Creative Commons" src=https://cdnjs.cloudflare.com/ajax/libs/creativecommons-vocabulary/2020.11.3/assets/license_badges/small/by_nc_sa.svg></a></div><div class="widget-wrap sidebar-tag-cloud"><div class=tag-cloud-tags><a class=tag-cloud-10 href=/tags/Java/ style=font-size:16px>Java</a><a class=tag-cloud-9 href=/tags/leetcode/ style=font-size:15.62px>leetcode</a><a class=tag-cloud-8 href=/tags/LLM/ style=font-size:15.23px>LLM</a><a class=tag-cloud-8 href=/tags/%E7%94%9F%E6%B4%BB/ style=font-size:14.85px>生活</a><a class=tag-cloud-7 href=/tags/%E9%A2%98%E8%A7%A3/ style=font-size:14.46px>题解</a><a class=tag-cloud-6 href=/tags/SpringBoot/ style=font-size:14.08px>SpringBoot</a><a class=tag-cloud-6 href=/tags/MySQL/ style=font-size:14.08px>MySQL</a><a class=tag-cloud-5 href=/tags/C/ style=font-size:13.69px>C++</a><a class=tag-cloud-5 href=/tags/Redis/ style=font-size:13.31px>Redis</a><a class=tag-cloud-4 href=/tags/Tomcat/ style=font-size:12.92px>Tomcat</a><a class=tag-cloud-4 href=/tags/Mybatis/ style=font-size:12.92px>Mybatis</a><a class=tag-cloud-3 href=/tags/%E5%B0%8F%E6%8A%80%E5%B7%A7/ style=font-size:12.54px>小技巧</a><a class=tag-cloud-2 href=/tags/%E6%95%B0%E6%8D%AE%E7%BB%93%E6%9E%84/ style=font-size:12.15px>数据结构</a><a class=tag-cloud-2 href=/tags/%E6%BA%90%E7%A0%81/ style=font-size:12.15px>源码</a><a class=tag-cloud-2 href=/tags/MQ/ style=font-size:11.77px>MQ</a><a class=tag-cloud-2 href=/tags/%E6%B6%88%E6%81%AF%E9%98%9F%E5%88%97/ style=font-size:11.77px>消息队列</a><a class=tag-cloud-2 href=/tags/RocketMQ/ style=font-size:11.77px>RocketMQ</a><a class=tag-cloud-2 href=/tags/%E8%BF%90%E5%8A%A8/ style=font-size:11.77px>运动</a><a class=tag-cloud-1 href=/tags/php/ style=font-size:11.38px>php</a><a class=tag-cloud-0 href=/tags/Spring/ style=font-size:11px>Spring</a><a class=tag-cloud-0 href=/tags/linux/ style=font-size:11px>linux</a><a class=tag-cloud-0 href=/tags/Docker/ style=font-size:11px>Docker</a><a class=tag-cloud-0 href=/tags/%E5%87%8F%E8%82%A5/ style=font-size:11px>减肥</a><a class=tag-cloud-0 href=/tags/%E8%B7%91%E6%AD%A5/ style=font-size:11px>跑步</a></div></div><div class="affiliate-creative affiliate-creative--sidebar" data-affiliate-id=tencent-cloud-server><a rel="sponsored noopener" aria-label=腾讯云服务器优惠 href=https://cloud.tencent.com/act/cps/redirect?redirect=6544&cps_key=2e33a1eedb380997d03618b4a5ba6ca7&from=console target=_blank><img alt="腾讯云 AI 焕新云服务器优惠" decoding=async height=241 loading=lazy src=/uploads/affiliate/tencent-cloud-server.webp width=690> </a><span class=affiliate-disclosure>推广</span></div></div></div></div><div class="sidebar-inner sidebar-blogroll"><div class="links-of-blogroll animated"><div class=links-of-blogroll-title><i class="fa fa-globe fa-fw"></i> 链接</div><ul class=links-of-blogroll-list><li class=links-of-blogroll-item><a href=https://covermusic.cn/ rel=noopener target=_blank title=https://covermusic.cn>69伙伴</a></ul></div></div></aside></div><div class="main-inner post posts-expand"><div class=post-block><article class=post-content itemscope itemtype=http://schema.org/Article lang=zh-CN><link href=https://nicksxs.me/2023/01/22/Headscale%E5%88%9D%E4%BD%93%E9%AA%8C%E4%BB%A5%E5%8F%8A%E8%B8%A9%E5%9D%91%E8%AE%B0/ itemprop=mainEntityOfPage><span hidden itemprop=author itemscope itemtype=http://schema.org/Person><meta content=/uploads/avatar.jpg itemprop=image><meta content=Nicksxs itemprop=name></span><span hidden itemprop=publisher itemscope itemtype=http://schema.org/Organization><meta content="Nicksxs's Blog" itemprop=name><meta content="Nicksxs 的技术博客,深入 Java 运行时与生产诊断、低成本大模型推理和 Agent 工程实践。" itemprop=description></span><span hidden itemprop=post itemscope itemtype=http://schema.org/CreativeWork><meta content="Headscale 部署入门与踩坑:配置文件、权限和节点连接 | Nicksxs's Blog" itemprop=name><meta content="本文记录 Headscale 服务端的部署和首次组网过程,重点排查配置文件路径、只读文件系统、私钥写入与节点连接问题,并说明使用 Tailscale 客户端接入自建控制服务器的关键步骤。" itemprop=description></span><header class=post-header><h1 itemprop="name headline" class=post-title>Headscale 部署入门与踩坑:配置文件、权限和节点连接</h1><div class=post-meta-container><div class=post-meta><span class=post-meta-item><span class=post-meta-item-icon><i class="far fa-calendar"></i> </span><span class=post-meta-item-text>发表于</span> <time itemprop="dateCreated datePublished" title="创建时间:2023-01-22 21:14:21" datetime=2023-01-22T21:14:21+08:00>2023-01-22</time> </span><span class=post-meta-item><span class=post-meta-item-icon><i class="far fa-folder"></i> </span><span class=post-meta-item-text>分类于</span> <span itemprop=about itemscope itemtype=http://schema.org/Thing><a href=/categories/headscale/ itemprop=url rel=index><span itemprop=name>headscale</span></a> </span></span><span class="post-meta-item cloudflare-page-counter" data-title="Headscale 部署入门与踩坑:配置文件、权限和节点连接" data-increment=true data-path=/2023/01/22/Headscale%E5%88%9D%E4%BD%93%E9%AA%8C%E4%BB%A5%E5%8F%8A%E8%B8%A9%E5%9D%91%E8%AE%B0/ title=阅读次数><span class=post-meta-item-icon><i class="far fa-eye"></i> </span><span class=post-meta-item-text>阅读次数:</span> <span class=cloudflare-page-counter-count></span></span></div><div class=post-description>本文记录 Headscale 服务端的部署和首次组网过程,重点排查配置文件路径、只读文件系统、私钥写入与节点连接问题,并说明使用 Tailscale 客户端接入自建控制服务器的关键步骤。</div></div></header><div class=post-body itemprop=articleBody><p>最近或者说很久以前就想着能够把几个散装服务器以及家里的网络连起来,譬如一些remote desktop的访问,之前搞了下frp,因为家里电脑没怎么注意安全性就被搞了一下,所以还是想用相对更安全的方式,比如限定ip和端口进行访问,但是感觉ip也不固定就比较难搞,后来看到了 <code>Tailscale</code> 和 <code>Headscale</code> 的方式,就想着试试看,没想到一开始就踩了几个比较莫名其妙的坑。<br>可以按<a href=https://github.com/juanfont/headscale/blob/main/docs/running-headscale-linux.md rel=noopener target=_blank>官方文档</a>去搭建,也可以在网上找一些其他人搭建的教程。我碰到的主要是关于配置文件的问题<h3 id=第一个问题><a class=headerlink href=#第一个问题 title=第一个问题></a>第一个问题</h3><figure class="highlight shell"><table><tr><td class=gutter><pre><span class=line>1</span><br></pre><td class=code><pre><span class=line>Error initializing error="failed to read or create private key: failed to save private key to disk: open /etc/headscale/private.key: read-only file system"</span><br></pre></table></figure><p>其实一开始看到这个我都有点懵了,咋回事呢,<code>read-only file system</code>一般有可能是文件系统出问题了,不可写入,需要重启或者修改挂载方式,被这个错误的错误日志给误导了,后面才知道是配置文件,在另一个教程中也有个类似的回复,一开始没注意,其实就是同一个问题。<br>默认的配置文件是这样的<figure class="highlight yaml"><table><tr><td class=gutter><pre><span class=line>1</span><br><span class=line>2</span><br><span class=line>3</span><br><span class=line>4</span><br><span class=line>5</span><br><span class=line>6</span><br><span class=line>7</span><br><span class=line>8</span><br><span class=line>9</span><br><span class=line>10</span><br><span class=line>11</span><br><span class=line>12</span><br><span class=line>13</span><br><span class=line>14</span><br><span class=line>15</span><br><span class=line>16</span><br><span class=line>17</span><br><span class=line>18</span><br><span class=line>19</span><br><span class=line>20</span><br><span class=line>21</span><br><span class=line>22</span><br><span class=line>23</span><br><span class=line>24</span><br><span class=line>25</span><br><span class=line>26</span><br><span class=line>27</span><br><span class=line>28</span><br><span class=line>29</span><br><span class=line>30</span><br><span class=line>31</span><br><span class=line>32</span><br><span class=line>33</span><br><span class=line>34</span><br><span class=line>35</span><br><span class=line>36</span><br><span class=line>37</span><br><span class=line>38</span><br><span class=line>39</span><br><span class=line>40</span><br><span class=line>41</span><br><span class=line>42</span><br><span class=line>43</span><br><span class=line>44</span><br><span class=line>45</span><br><span class=line>46</span><br><span class=line>47</span><br><span class=line>48</span><br><span class=line>49</span><br><span class=line>50</span><br><span class=line>51</span><br><span class=line>52</span><br><span class=line>53</span><br><span class=line>54</span><br><span class=line>55</span><br><span class=line>56</span><br><span class=line>57</span><br><span class=line>58</span><br><span class=line>59</span><br><span class=line>60</span><br><span class=line>61</span><br><span class=line>62</span><br><span class=line>63</span><br><span class=line>64</span><br><span class=line>65</span><br><span class=line>66</span><br><span class=line>67</span><br><span class=line>68</span><br><span class=line>69</span><br><span class=line>70</span><br><span class=line>71</span><br><span class=line>72</span><br><span class=line>73</span><br><span class=line>74</span><br><span class=line>75</span><br><span class=line>76</span><br><span class=line>77</span><br><span class=line>78</span><br><span class=line>79</span><br><span class=line>80</span><br><span class=line>81</span><br><span class=line>82</span><br><span class=line>83</span><br><span class=line>84</span><br><span class=line>85</span><br><span class=line>86</span><br><span class=line>87</span><br><span class=line>88</span><br><span class=line>89</span><br><span class=line>90</span><br><span class=line>91</span><br><span class=line>92</span><br><span class=line>93</span><br><span class=line>94</span><br><span class=line>95</span><br><span class=line>96</span><br><span class=line>97</span><br><span class=line>98</span><br><span class=line>99</span><br><span class=line>100</span><br><span class=line>101</span><br><span class=line>102</span><br><span class=line>103</span><br><span class=line>104</span><br><span class=line>105</span><br><span class=line>106</span><br><span class=line>107</span><br><span class=line>108</span><br><span class=line>109</span><br><span class=line>110</span><br><span class=line>111</span><br><span class=line>112</span><br><span class=line>113</span><br><span class=line>114</span><br><span class=line>115</span><br><span class=line>116</span><br><span class=line>117</span><br><span class=line>118</span><br><span class=line>119</span><br><span class=line>120</span><br><span class=line>121</span><br><span class=line>122</span><br><span class=line>123</span><br><span class=line>124</span><br><span class=line>125</span><br><span class=line>126</span><br><span class=line>127</span><br><span class=line>128</span><br><span class=line>129</span><br><span class=line>130</span><br><span class=line>131</span><br><span class=line>132</span><br><span class=line>133</span><br><span class=line>134</span><br><span class=line>135</span><br><span class=line>136</span><br><span class=line>137</span><br><span class=line>138</span><br><span class=line>139</span><br><span class=line>140</span><br><span class=line>141</span><br><span class=line>142</span><br><span class=line>143</span><br><span class=line>144</span><br><span class=line>145</span><br><span class=line>146</span><br><span class=line>147</span><br><span class=line>148</span><br><span class=line>149</span><br><span class=line>150</span><br><span class=line>151</span><br><span class=line>152</span><br><span class=line>153</span><br><span class=line>154</span><br><span class=line>155</span><br><span class=line>156</span><br><span class=line>157</span><br><span class=line>158</span><br><span class=line>159</span><br><span class=line>160</span><br><span class=line>161</span><br><span class=line>162</span><br><span class=line>163</span><br><span class=line>164</span><br><span class=line>165</span><br><span class=line>166</span><br><span class=line>167</span><br><span class=line>168</span><br><span class=line>169</span><br><span class=line>170</span><br><span class=line>171</span><br><span class=line>172</span><br><span class=line>173</span><br><span class=line>174</span><br><span class=line>175</span><br><span class=line>176</span><br><span class=line>177</span><br><span class=line>178</span><br><span class=line>179</span><br><span class=line>180</span><br><span class=line>181</span><br><span class=line>182</span><br><span class=line>183</span><br><span class=line>184</span><br><span class=line>185</span><br><span class=line>186</span><br><span class=line>187</span><br><span class=line>188</span><br><span class=line>189</span><br><span class=line>190</span><br><span class=line>191</span><br><span class=line>192</span><br><span class=line>193</span><br><span class=line>194</span><br><span class=line>195</span><br><span class=line>196</span><br><span class=line>197</span><br><span class=line>198</span><br><span class=line>199</span><br><span class=line>200</span><br><span class=line>201</span><br><span class=line>202</span><br><span class=line>203</span><br><span class=line>204</span><br><span class=line>205</span><br><span class=line>206</span><br><span class=line>207</span><br><span class=line>208</span><br><span class=line>209</span><br><span class=line>210</span><br><span class=line>211</span><br><span class=line>212</span><br><span class=line>213</span><br><span class=line>214</span><br><span class=line>215</span><br><span class=line>216</span><br><span class=line>217</span><br><span class=line>218</span><br><span class=line>219</span><br><span class=line>220</span><br><span class=line>221</span><br><span class=line>222</span><br><span class=line>223</span><br><span class=line>224</span><br><span class=line>225</span><br><span class=line>226</span><br><span class=line>227</span><br><span class=line>228</span><br><span class=line>229</span><br><span class=line>230</span><br><span class=line>231</span><br><span class=line>232</span><br><span class=line>233</span><br><span class=line>234</span><br><span class=line>235</span><br><span class=line>236</span><br><span class=line>237</span><br><span class=line>238</span><br><span class=line>239</span><br><span class=line>240</span><br><span class=line>241</span><br><span class=line>242</span><br><span class=line>243</span><br><span class=line>244</span><br><span class=line>245</span><br><span class=line>246</span><br><span class=line>247</span><br><span class=line>248</span><br><span class=line>249</span><br><span class=line>250</span><br><span class=line>251</span><br><span class=line>252</span><br><span class=line>253</span><br><span class=line>254</span><br><span class=line>255</span><br><span class=line>256</span><br><span class=line>257</span><br><span class=line>258</span><br><span class=line>259</span><br><span class=line>260</span><br><span class=line>261</span><br><span class=line>262</span><br><span class=line>263</span><br><span class=line>264</span><br><span class=line>265</span><br><span class=line>266</span><br><span class=line>267</span><br><span class=line>268</span><br><span class=line>269</span><br><span class=line>270</span><br><span class=line>271</span><br><span class=line>272</span><br><span class=line>273</span><br><span class=line>274</span><br><span class=line>275</span><br><span class=line>276</span><br><span class=line>277</span><br><span class=line>278</span><br><span class=line>279</span><br><span class=line>280</span><br><span class=line>281</span><br><span class=line>282</span><br><span class=line>283</span><br><span class=line>284</span><br><span class=line>285</span><br><span class=line>286</span><br><span class=line>287</span><br><span class=line>288</span><br><span class=line>289</span><br><span class=line>290</span><br><span class=line>291</span><br><span class=line>292</span><br><span class=line>293</span><br><span class=line>294</span><br><span class=line>295</span><br><span class=line>296</span><br><span class=line>297</span><br><span class=line>298</span><br><span class=line>299</span><br><span class=line>300</span><br><span class=line>301</span><br><span class=line>302</span><br><span class=line>303</span><br><span class=line>304</span><br><span class=line>305</span><br><span class=line>306</span><br><span class=line>307</span><br><span class=line>308</span><br><span class=line>309</span><br><span class=line>310</span><br><span class=line>311</span><br><span class=line>312</span><br><span class=line>313</span><br><span class=line>314</span><br><span class=line>315</span><br><span class=line>316</span><br><span class=line>317</span><br><span class=line>318</span><br><span class=line>319</span><br><span class=line>320</span><br><span class=line>321</span><br><span class=line>322</span><br></pre><td class=code><pre><span class=line><span class=meta>---</span></span><br><span class=line><span class=comment># headscale will look for a configuration file named `config.yaml` (or `config.json`) in the following order:</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># - `/etc/headscale`</span></span><br><span class=line><span class=comment># - `~/.headscale`</span></span><br><span class=line><span class=comment># - current working directory</span></span><br><span class=line></span><br><span class=line><span class=comment># The url clients will connect to.</span></span><br><span class=line><span class=comment># Typically this will be a domain like:</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># https://myheadscale.example.com:443</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=attr>server_url:</span> <span class=string>http://127.0.0.1:8080</span></span><br><span class=line></span><br><span class=line><span class=comment># Address to listen to / bind to on the server</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># For production:</span></span><br><span class=line><span class=comment># listen_addr: 0.0.0.0:8080</span></span><br><span class=line><span class=attr>listen_addr:</span> <span class=number>127.0</span><span class=number>.0</span><span class=number>.1</span><span class=string>:8080</span></span><br><span class=line></span><br><span class=line><span class=comment># Address to listen to /metrics, you may want</span></span><br><span class=line><span class=comment># to keep this endpoint private to your internal</span></span><br><span class=line><span class=comment># network</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=attr>metrics_listen_addr:</span> <span class=number>127.0</span><span class=number>.0</span><span class=number>.1</span><span class=string>:9090</span></span><br><span class=line></span><br><span class=line><span class=comment># Address to listen for gRPC.</span></span><br><span class=line><span class=comment># gRPC is used for controlling a headscale server</span></span><br><span class=line><span class=comment># remotely with the CLI</span></span><br><span class=line><span class=comment># <span class=doctag>Note:</span> Remote access _only_ works if you have</span></span><br><span class=line><span class=comment># valid certificates.</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># For production:</span></span><br><span class=line><span class=comment># grpc_listen_addr: 0.0.0.0:50443</span></span><br><span class=line><span class=attr>grpc_listen_addr:</span> <span class=number>127.0</span><span class=number>.0</span><span class=number>.1</span><span class=string>:50443</span></span><br><span class=line></span><br><span class=line><span class=comment># Allow the gRPC admin interface to run in INSECURE</span></span><br><span class=line><span class=comment># mode. This is not recommended as the traffic will</span></span><br><span class=line><span class=comment># be unencrypted. Only enable if you know what you</span></span><br><span class=line><span class=comment># are doing.</span></span><br><span class=line><span class=attr>grpc_allow_insecure:</span> <span class=literal>false</span></span><br><span class=line></span><br><span class=line><span class=comment># Private key used to encrypt the traffic between headscale</span></span><br><span class=line><span class=comment># and Tailscale clients.</span></span><br><span class=line><span class=comment># The private key file will be autogenerated if it's missing.</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># For production:</span></span><br><span class=line><span class=comment># /var/lib/headscale/private.key</span></span><br><span class=line><span class=attr>private_key_path:</span> <span class=string>./private.key</span></span><br><span class=line></span><br><span class=line><span class=comment># The Noise section includes specific configuration for the</span></span><br><span class=line><span class=comment># TS2021 Noise protocol</span></span><br><span class=line><span class=attr>noise:</span></span><br><span class=line> <span class=comment># The Noise private key is used to encrypt the</span></span><br><span class=line> <span class=comment># traffic between headscale and Tailscale clients when</span></span><br><span class=line> <span class=comment># using the new Noise-based protocol. It must be different</span></span><br><span class=line> <span class=comment># from the legacy private key.</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># For production:</span></span><br><span class=line> <span class=comment># private_key_path: /var/lib/headscale/noise_private.key</span></span><br><span class=line> <span class=attr>private_key_path:</span> <span class=string>./noise_private.key</span></span><br><span class=line></span><br><span class=line><span class=comment># List of IP prefixes to allocate tailaddresses from.</span></span><br><span class=line><span class=comment># Each prefix consists of either an IPv4 or IPv6 address,</span></span><br><span class=line><span class=comment># and the associated prefix length, delimited by a slash.</span></span><br><span class=line><span class=comment># While this looks like it can take arbitrary values, it</span></span><br><span class=line><span class=comment># needs to be within IP ranges supported by the Tailscale</span></span><br><span class=line><span class=comment># client.</span></span><br><span class=line><span class=comment># IPv6: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#LL81C52-L81C71</span></span><br><span class=line><span class=comment># IPv4: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#L33</span></span><br><span class=line><span class=attr>ip_prefixes:</span></span><br><span class=line> <span class=bullet>-</span> <span class=string>fd7a:115c:a1e0::/48</span></span><br><span class=line> <span class=bullet>-</span> <span class=number>100.64</span><span class=number>.0</span><span class=number>.0</span><span class=string>/10</span></span><br><span class=line></span><br><span class=line><span class=comment># DERP is a relay system that Tailscale uses when a direct</span></span><br><span class=line><span class=comment># connection cannot be established.</span></span><br><span class=line><span class=comment># https://tailscale.com/blog/how-tailscale-works/#encrypted-tcp-relays-derp</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># headscale needs a list of DERP servers that can be presented</span></span><br><span class=line><span class=comment># to the clients.</span></span><br><span class=line><span class=attr>derp:</span></span><br><span class=line> <span class=attr>server:</span></span><br><span class=line> <span class=comment># If enabled, runs the embedded DERP server and merges it into the rest of the DERP config</span></span><br><span class=line> <span class=comment># The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place</span></span><br><span class=line> <span class=attr>enabled:</span> <span class=literal>false</span></span><br><span class=line></span><br><span class=line> <span class=comment># Region ID to use for the embedded DERP server.</span></span><br><span class=line> <span class=comment># The local DERP prevails if the region ID collides with other region ID coming from</span></span><br><span class=line> <span class=comment># the regular DERP config.</span></span><br><span class=line> <span class=attr>region_id:</span> <span class=number>999</span></span><br><span class=line></span><br><span class=line> <span class=comment># Region code and name are displayed in the Tailscale UI to identify a DERP region</span></span><br><span class=line> <span class=attr>region_code:</span> <span class=string>"headscale"</span></span><br><span class=line> <span class=attr>region_name:</span> <span class=string>"Headscale Embedded DERP"</span></span><br><span class=line></span><br><span class=line> <span class=comment># Listens over UDP at the configured address for STUN connections - to help with NAT traversal.</span></span><br><span class=line> <span class=comment># When the embedded DERP server is enabled stun_listen_addr MUST be defined.</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/</span></span><br><span class=line> <span class=attr>stun_listen_addr:</span> <span class=string>"0.0.0.0:3478"</span></span><br><span class=line></span><br><span class=line> <span class=comment># List of externally available DERP maps encoded in JSON</span></span><br><span class=line> <span class=attr>urls:</span></span><br><span class=line> <span class=bullet>-</span> <span class=string>https://controlplane.tailscale.com/derpmap/default</span></span><br><span class=line></span><br><span class=line> <span class=comment># Locally available DERP map files encoded in YAML</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># This option is mostly interesting for people hosting</span></span><br><span class=line> <span class=comment># their own DERP servers:</span></span><br><span class=line> <span class=comment># https://tailscale.com/kb/1118/custom-derp-servers/</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># paths:</span></span><br><span class=line> <span class=comment># - /etc/headscale/derp-example.yaml</span></span><br><span class=line> <span class=attr>paths:</span> []</span><br><span class=line></span><br><span class=line> <span class=comment># If enabled, a worker will be set up to periodically</span></span><br><span class=line> <span class=comment># refresh the given sources and update the derpmap</span></span><br><span class=line> <span class=comment># will be set up.</span></span><br><span class=line> <span class=attr>auto_update_enabled:</span> <span class=literal>true</span></span><br><span class=line></span><br><span class=line> <span class=comment># How often should we check for DERP updates?</span></span><br><span class=line> <span class=attr>update_frequency:</span> <span class=string>24h</span></span><br><span class=line></span><br><span class=line><span class=comment># Disables the automatic check for headscale updates on startup</span></span><br><span class=line><span class=attr>disable_check_updates:</span> <span class=literal>false</span></span><br><span class=line></span><br><span class=line><span class=comment># Time before an inactive ephemeral node is deleted?</span></span><br><span class=line><span class=attr>ephemeral_node_inactivity_timeout:</span> <span class=string>30m</span></span><br><span class=line></span><br><span class=line><span class=comment># Period to check for node updates within the tailnet. A value too low will severely affect</span></span><br><span class=line><span class=comment># CPU consumption of Headscale. A value too high (over 60s) will cause problems</span></span><br><span class=line><span class=comment># for the nodes, as they won't get updates or keep alive messages frequently enough.</span></span><br><span class=line><span class=comment># In case of doubts, do not touch the default 10s.</span></span><br><span class=line><span class=attr>node_update_check_interval:</span> <span class=string>10s</span></span><br><span class=line></span><br><span class=line><span class=comment># SQLite config</span></span><br><span class=line><span class=attr>db_type:</span> <span class=string>sqlite3</span></span><br><span class=line></span><br><span class=line><span class=comment># For production:</span></span><br><span class=line><span class=comment># db_path: /var/lib/headscale/db.sqlite</span></span><br><span class=line><span class=attr>db_path:</span> <span class=string>./db.sqlite</span></span><br><span class=line></span><br><span class=line><span class=comment># # Postgres config</span></span><br><span class=line><span class=comment># If using a Unix socket to connect to Postgres, set the socket path in the 'host' field and leave 'port' blank.</span></span><br><span class=line><span class=comment># db_type: postgres</span></span><br><span class=line><span class=comment># db_host: localhost</span></span><br><span class=line><span class=comment># db_port: 5432</span></span><br><span class=line><span class=comment># db_name: headscale</span></span><br><span class=line><span class=comment># db_user: foo</span></span><br><span class=line><span class=comment># db_pass: bar</span></span><br><span class=line></span><br><span class=line><span class=comment># If other 'sslmode' is required instead of 'require(true)' and 'disabled(false)', set the 'sslmode' you need</span></span><br><span class=line><span class=comment># in the 'db_ssl' field. Refers to https://www.postgresql.org/docs/current/libpq-ssl.html Table 34.1.</span></span><br><span class=line><span class=comment># db_ssl: false</span></span><br><span class=line></span><br><span class=line><span class=comment>### TLS configuration</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment>## Let's encrypt / ACME</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># headscale supports automatically requesting and setting up</span></span><br><span class=line><span class=comment># TLS for a domain with Let's Encrypt.</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># URL to ACME directory</span></span><br><span class=line><span class=attr>acme_url:</span> <span class=string>https://acme-v02.api.letsencrypt.org/directory</span></span><br><span class=line></span><br><span class=line><span class=comment># Email to register with ACME provider</span></span><br><span class=line><span class=attr>acme_email:</span> <span class=string>""</span></span><br><span class=line></span><br><span class=line><span class=comment># Domain name to request a TLS certificate for:</span></span><br><span class=line><span class=attr>tls_letsencrypt_hostname:</span> <span class=string>""</span></span><br><span class=line></span><br><span class=line><span class=comment># Path to store certificates and metadata needed by</span></span><br><span class=line><span class=comment># letsencrypt</span></span><br><span class=line><span class=comment># For production:</span></span><br><span class=line><span class=comment># tls_letsencrypt_cache_dir: /var/lib/headscale/cache</span></span><br><span class=line><span class=attr>tls_letsencrypt_cache_dir:</span> <span class=string>./cache</span></span><br><span class=line></span><br><span class=line><span class=comment># Type of ACME challenge to use, currently supported types:</span></span><br><span class=line><span class=comment># HTTP-01 or TLS-ALPN-01</span></span><br><span class=line><span class=comment># See [docs/tls.md](docs/tls.md) for more information</span></span><br><span class=line><span class=attr>tls_letsencrypt_challenge_type:</span> <span class=string>HTTP-01</span></span><br><span class=line><span class=comment># When HTTP-01 challenge is chosen, letsencrypt must set up a</span></span><br><span class=line><span class=comment># verification endpoint, and it will be listening on:</span></span><br><span class=line><span class=comment># :http = port 80</span></span><br><span class=line><span class=attr>tls_letsencrypt_listen:</span> <span class=string>":http"</span></span><br><span class=line></span><br><span class=line><span class=comment>## Use already defined certificates:</span></span><br><span class=line><span class=attr>tls_cert_path:</span> <span class=string>""</span></span><br><span class=line><span class=attr>tls_key_path:</span> <span class=string>""</span></span><br><span class=line></span><br><span class=line><span class=attr>log:</span></span><br><span class=line> <span class=comment># Output formatting for logs: text or json</span></span><br><span class=line> <span class=attr>format:</span> <span class=string>text</span></span><br><span class=line> <span class=attr>level:</span> <span class=string>info</span></span><br><span class=line></span><br><span class=line><span class=comment># Path to a file containg ACL policies.</span></span><br><span class=line><span class=comment># ACLs can be defined as YAML or HUJSON.</span></span><br><span class=line><span class=comment># https://tailscale.com/kb/1018/acls/</span></span><br><span class=line><span class=attr>acl_policy_path:</span> <span class=string>""</span></span><br><span class=line></span><br><span class=line><span class=comment>## DNS</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># headscale supports Tailscale's DNS configuration and MagicDNS.</span></span><br><span class=line><span class=comment># Please have a look to their KB to better understand the concepts:</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># - https://tailscale.com/kb/1054/dns/</span></span><br><span class=line><span class=comment># - https://tailscale.com/kb/1081/magicdns/</span></span><br><span class=line><span class=comment># - https://tailscale.com/blog/2021-09-private-dns-with-magicdns/</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=attr>dns_config:</span></span><br><span class=line> <span class=comment># Whether to prefer using Headscale provided DNS or use local.</span></span><br><span class=line> <span class=attr>override_local_dns:</span> <span class=literal>true</span></span><br><span class=line></span><br><span class=line> <span class=comment># List of DNS servers to expose to clients.</span></span><br><span class=line> <span class=attr>nameservers:</span></span><br><span class=line> <span class=bullet>-</span> <span class=number>1.1</span><span class=number>.1</span><span class=number>.1</span></span><br><span class=line></span><br><span class=line> <span class=comment># NextDNS (see https://tailscale.com/kb/1218/nextdns/).</span></span><br><span class=line> <span class=comment># "abc123" is example NextDNS ID, replace with yours.</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># With metadata sharing:</span></span><br><span class=line> <span class=comment># nameservers:</span></span><br><span class=line> <span class=comment># - https://dns.nextdns.io/abc123</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># Without metadata sharing:</span></span><br><span class=line> <span class=comment># nameservers:</span></span><br><span class=line> <span class=comment># - 2a07:a8c0::ab:c123</span></span><br><span class=line> <span class=comment># - 2a07:a8c1::ab:c123</span></span><br><span class=line></span><br><span class=line> <span class=comment># Split DNS (see https://tailscale.com/kb/1054/dns/),</span></span><br><span class=line> <span class=comment># list of search domains and the DNS to query for each one.</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># restricted_nameservers:</span></span><br><span class=line> <span class=comment># foo.bar.com:</span></span><br><span class=line> <span class=comment># - 1.1.1.1</span></span><br><span class=line> <span class=comment># darp.headscale.net:</span></span><br><span class=line> <span class=comment># - 1.1.1.1</span></span><br><span class=line> <span class=comment># - 8.8.8.8</span></span><br><span class=line></span><br><span class=line> <span class=comment># Search domains to inject.</span></span><br><span class=line> <span class=attr>domains:</span> []</span><br><span class=line></span><br><span class=line> <span class=comment># Extra DNS records</span></span><br><span class=line> <span class=comment># so far only A-records are supported (on the tailscale side)</span></span><br><span class=line> <span class=comment># See https://github.com/juanfont/headscale/blob/main/docs/dns-records.md#Limitations</span></span><br><span class=line> <span class=comment># extra_records:</span></span><br><span class=line> <span class=comment># - name: "grafana.myvpn.example.com"</span></span><br><span class=line> <span class=comment># type: "A"</span></span><br><span class=line> <span class=comment># value: "100.64.0.3"</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># # you can also put it in one line</span></span><br><span class=line> <span class=comment># - { name: "prometheus.myvpn.example.com", type: "A", value: "100.64.0.3" }</span></span><br><span class=line></span><br><span class=line> <span class=comment># Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).</span></span><br><span class=line> <span class=comment># Only works if there is at least a nameserver defined.</span></span><br><span class=line> <span class=attr>magic_dns:</span> <span class=literal>true</span></span><br><span class=line></span><br><span class=line> <span class=comment># Defines the base domain to create the hostnames for MagicDNS.</span></span><br><span class=line> <span class=comment># `base_domain` must be a FQDNs, without the trailing dot.</span></span><br><span class=line> <span class=comment># The FQDN of the hosts will be</span></span><br><span class=line> <span class=comment># `hostname.user.base_domain` (e.g., _myhost.myuser.example.com_).</span></span><br><span class=line> <span class=attr>base_domain:</span> <span class=string>example.com</span></span><br><span class=line></span><br><span class=line><span class=comment># Unix socket used for the CLI to connect without authentication</span></span><br><span class=line><span class=comment># <span class=doctag>Note:</span> for production you will want to set this to something like:</span></span><br><span class=line><span class=comment># unix_socket: /var/run/headscale.sock</span></span><br><span class=line><span class=attr>unix_socket:</span> <span class=string>./headscale.sock</span></span><br><span class=line><span class=attr>unix_socket_permission:</span> <span class=string>"0770"</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># headscale supports experimental OpenID connect support,</span></span><br><span class=line><span class=comment># it is still being tested and might have some bugs, please</span></span><br><span class=line><span class=comment># help us test it.</span></span><br><span class=line><span class=comment># OpenID Connect</span></span><br><span class=line><span class=comment># oidc:</span></span><br><span class=line><span class=comment># only_start_if_oidc_is_available: true</span></span><br><span class=line><span class=comment># issuer: "https://your-oidc.issuer.com/path"</span></span><br><span class=line><span class=comment># client_id: "your-oidc-client-id"</span></span><br><span class=line><span class=comment># client_secret: "your-oidc-client-secret"</span></span><br><span class=line><span class=comment># # Alternatively, set `client_secret_path` to read the secret from the file.</span></span><br><span class=line><span class=comment># # It resolves environment variables, making integration to systemd's</span></span><br><span class=line><span class=comment># # `LoadCredential` straightforward:</span></span><br><span class=line><span class=comment># client_secret_path: "${CREDENTIALS_DIRECTORY}/oidc_client_secret"</span></span><br><span class=line><span class=comment># # client_secret and client_secret_path are mutually exclusive.</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># Customize the scopes used in the OIDC flow, defaults to "openid", "profile" and "email" and add custom query</span></span><br><span class=line><span class=comment># parameters to the Authorize Endpoint request. Scopes default to "openid", "profile" and "email".</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># scope: ["openid", "profile", "email", "custom"]</span></span><br><span class=line><span class=comment># extra_params:</span></span><br><span class=line><span class=comment># domain_hint: example.com</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># List allowed principal domains and/or users. If an authenticated user's domain is not in this list, the</span></span><br><span class=line><span class=comment># authentication request will be rejected.</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># allowed_domains:</span></span><br><span class=line><span class=comment># - example.com</span></span><br><span class=line><span class=comment># Groups from keycloak have a leading '/'</span></span><br><span class=line><span class=comment># allowed_groups:</span></span><br><span class=line><span class=comment># - /headscale</span></span><br><span class=line><span class=comment># allowed_users:</span></span><br><span class=line><span class=comment># - alice@example.com</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># If `strip_email_domain` is set to `true`, the domain part of the username email address will be removed.</span></span><br><span class=line><span class=comment># This will transform `first-name.last-name@example.com` to the user `first-name.last-name`</span></span><br><span class=line><span class=comment># If `strip_email_domain` is set to `false` the domain part will NOT be removed resulting to the following</span></span><br><span class=line><span class=comment># user: `first-name.last-name.example.com`</span></span><br><span class=line><span class=comment>#</span></span><br><span class=line><span class=comment># strip_email_domain: true</span></span><br><span class=line></span><br><span class=line><span class=comment># Logtail configuration</span></span><br><span class=line><span class=comment># Logtail is Tailscales logging and auditing infrastructure, it allows the control panel</span></span><br><span class=line><span class=comment># to instruct tailscale nodes to log their activity to a remote server.</span></span><br><span class=line><span class=attr>logtail:</span></span><br><span class=line> <span class=comment># Enable logtail for this headscales clients.</span></span><br><span class=line> <span class=comment># As there is currently no support for overriding the log server in headscale, this is</span></span><br><span class=line> <span class=comment># disabled by default. Enabling this will make your clients send logs to Tailscale Inc.</span></span><br><span class=line> <span class=attr>enabled:</span> <span class=literal>false</span></span><br><span class=line></span><br><span class=line><span class=comment># Enabling this option makes devices prefer a random port for WireGuard traffic over the</span></span><br><span class=line><span class=comment># default static port 41641. This option is intended as a workaround for some buggy</span></span><br><span class=line><span class=comment># firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.</span></span><br><span class=line><span class=attr>randomize_client_port:</span> <span class=literal>false</span></span><br></pre></table></figure><p>问题就是出在几个文件路径的配置,默认都是当前目录,也就是headscale的可执行文件所在目录,需要按它配置说明中的生产配置进行修改<figure class="highlight yaml"><table><tr><td class=gutter><pre><span class=line>1</span><br><span class=line>2</span><br><span class=line>3</span><br></pre><td class=code><pre><span class=line><span class=comment># For production:</span></span><br><span class=line><span class=comment># /var/lib/headscale/private.key</span></span><br><span class=line><span class=attr>private_key_path:</span> <span class=string>/var/lib/headscale/private.key</span></span><br></pre></table></figure><p>直接改成绝对路径就好了,还有两个文件路径<br>另一个也是个秘钥的路径问题<figure class="highlight yaml"><table><tr><td class=gutter><pre><span class=line>1</span><br><span class=line>2</span><br><span class=line>3</span><br><span class=line>4</span><br><span class=line>5</span><br><span class=line>6</span><br><span class=line>7</span><br><span class=line>8</span><br><span class=line>9</span><br></pre><td class=code><pre><span class=line><span class=attr>noise:</span></span><br><span class=line> <span class=comment># The Noise private key is used to encrypt the</span></span><br><span class=line> <span class=comment># traffic between headscale and Tailscale clients when</span></span><br><span class=line> <span class=comment># using the new Noise-based protocol. It must be different</span></span><br><span class=line> <span class=comment># from the legacy private key.</span></span><br><span class=line> <span class=comment>#</span></span><br><span class=line> <span class=comment># For production:</span></span><br><span class=line> <span class=comment># private_key_path: /var/lib/headscale/noise_private.key</span></span><br><span class=line> <span class=attr>private_key_path:</span> <span class=string>/var/lib/headscale/noise_private.key</span></span><br></pre></table></figure><h3 id=第二个问题><a class=headerlink href=#第二个问题 title=第二个问题></a>第二个问题</h3><p>这个问题也是一种误导,<br>错误信息是<figure class="highlight shell"><table><tr><td class=gutter><pre><span class=line>1</span><br></pre><td class=code><pre><span class=line>Error initializing error="unable to open database file: out of memory (14)"</span><br></pre></table></figure><p>这就是个文件,内存也完全没有被占满的迹象,原来也是文件路径的问题<figure class="highlight yaml"><table><tr><td class=gutter><pre><span class=line>1</span><br><span class=line>2</span><br><span class=line>3</span><br></pre><td class=code><pre><span class=line><span class=comment># For production:</span></span><br><span class=line><span class=comment># db_path: /var/lib/headscale/db.sqlite</span></span><br><span class=line><span class=attr>db_path:</span> <span class=string>/var/lib/headscale/db.sqlite</span></span><br></pre></table></figure><p>都改成绝对路径就可以了,然后这里还有个就是要对<code>/var/lib/headscale/</code>和<code>/etc/headscale/</code>等路径赋予headscale用户权限,有时候对这类问题的排查真的蛮头疼,日志报错都不是真实的错误信息,开源项目对这些错误的提示真的也需要优化,后续的譬如mac也加入节点等后面再开篇讲</div><footer class=post-footer><div class="affiliate-creative affiliate-creative--post-end" data-affiliate-id=tencent-cloud-server><a rel="sponsored noopener" aria-label=腾讯云服务器优惠 href=https://cloud.tencent.com/act/cps/redirect?redirect=6544&cps_key=2e33a1eedb380997d03618b4a5ba6ca7&from=console target=_blank><img alt="腾讯云 AI 焕新云服务器优惠" decoding=async height=241 loading=lazy src=/uploads/affiliate/tencent-cloud-server.webp width=690> </a><span class=affiliate-disclosure>推广</span></div><div class=reward-container><div>请我一杯咖啡吧!</div><button>赞赏</button><div class=post-reward><div><img alt="Nicksxs 微信" src=https://i.loli.net/2020/01/12/NUlWanT31E8LQGx.png><span>微信</span></div><div><img alt="Nicksxs 支付宝" src=https://ooo.0o0.ooo/2016/08/17/57b421e773057.jpg><span>支付宝</span></div></div></div><div class=post-copyright><ul><li class=post-copyright-author><strong>本文作者: </strong>Nicksxs<li class=post-copyright-link><strong>本文链接:</strong> <a title="Headscale 部署入门与踩坑:配置文件、权限和节点连接" href=https://nicksxs.me/2023/01/22/Headscale%E5%88%9D%E4%BD%93%E9%AA%8C%E4%BB%A5%E5%8F%8A%E8%B8%A9%E5%9D%91%E8%AE%B0/>https://nicksxs.me/2023/01/22/Headscale初体验以及踩坑记/</a><li class=post-copyright-license><strong>版权声明: </strong>本博客所有文章除特别声明外,均采用 <a href=https://creativecommons.org/licenses/by-nc-sa/4.0/ rel=noopener target=_blank><i class="fab fa-fw fa-creative-commons"></i>BY-NC-SA</a> 许可协议。转载请注明出处!</ul></div><div class=post-tags><a href=/tags/headscale/ rel=tag># headscale</a></div><div class=post-nav><div class=post-nav-item><a title="2022 年终总结" href=/2023/01/15/2022-%E5%B9%B4%E7%BB%88%E6%80%BB%E7%BB%93/ rel=prev><i class="fa fa-angle-left"></i> 2022 年终总结</a></div><div class=post-nav-item><a title="分享一次比较诡异的 Windows 下 U盘无法退出的经历" href=/2023/01/29/%E5%88%86%E4%BA%AB%E4%B8%80%E6%AC%A1%E6%AF%94%E8%BE%83%E8%AF%A1%E5%BC%82%E7%9A%84-Windows-%E4%B8%8B-U%E7%9B%98%E6%97%A0%E6%B3%95%E9%80%80%E5%87%BA%E7%9A%84%E7%BB%8F%E5%8E%86/ rel=next>分享一次比较诡异的 Windows 下 U盘无法退出的经历 <i class="fa fa-angle-right"></i></a></div></div></footer></article></div><div class=comments id=disqus_thread><noscript>Please enable JavaScript to view the comments powered by Disqus.</noscript></div></div></main><footer class=footer><div class=footer-inner><div class=beian><a href=https://beian.miit.gov.cn/ rel=noopener target=_blank>浙ICP备16002580号-2 </a><img alt src=/uploads/beian.png><a href=https://beian.mps.gov.cn/#/query/webSearch?code=33010602011094 rel=noopener target=_blank>浙公网安备 33010602011094号</a></div><div class=copyright>© <span itemprop=copyrightYear>2026</span><span class=with-love><i class="fa fa-heart"></i> </span><span class=author itemprop=copyrightHolder>Nicksxs</span></div></div></footer><div class="toggle sidebar-toggle" role=button><span class=toggle-line></span><span class=toggle-line></span><span class=toggle-line></span></div><div class=sidebar-dimmer></div><div aria-label=返回顶部 class=back-to-top role=button><i class="fa fa-arrow-up fa-lg"></i><span>0%</span></div><a aria-label="在 GitHub 上关注我" title="在 GitHub 上关注我" class=github-corner href=https://github.com/nicksxs rel=noopener target=_blank><svg viewbox="0 0 250 250" aria-hidden=true height=80 width=80><path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path><path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2" style="transform-origin:130px 106px" class=octo-arm fill=currentColor></path><path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z" class=octo-body fill=currentColor></path></svg></a><noscript><div class=noscript-warning>Theme NexT works best with JavaScript enabled</div></noscript><script data-cloudflare-page-counter-config type=application/json>{"enable":true,"endpoint":"https://counter.nicksxs.me","site":"nicksxs","local_cache":true,"timeout":5000,"icon":"far fa-eye","item_text":true}</script><script src=/js/cloudflare-page-counter.js></script><script class=next-config data-name=disqus type=application/json>{"enable":true,"shortname":"nicksxs","count":false,"i18n":{"disqus":"disqus"}}</script><script defer src=/js/third-party/comments/disqus.js></script>
|