summaryrefslogtreecommitdiffhomepage
path: root/envknob
AgeCommit message (Collapse)AuthorFilesLines
2026-01-23all: remove AUTHORS file and references to itWill Norris6-6/+6
This file was never truly necessary and has never actually been used in the history of Tailscale's open source releases. A Brief History of AUTHORS files --- The AUTHORS file was a pattern developed at Google, originally for Chromium, then adopted by Go and a bunch of other projects. The problem was that Chromium originally had a copyright line only recognizing Google as the copyright holder. Because Google (and most open source projects) do not require copyright assignemnt for contributions, each contributor maintains their copyright. Some large corporate contributors then tried to add their own name to the copyright line in the LICENSE file or in file headers. This quickly becomes unwieldy, and puts a tremendous burden on anyone building on top of Chromium, since the license requires that they keep all copyright lines intact. The compromise was to create an AUTHORS file that would list all of the copyright holders. The LICENSE file and source file headers would then include that list by reference, listing the copyright holder as "The Chromium Authors". This also become cumbersome to simply keep the file up to date with a high rate of new contributors. Plus it's not always obvious who the copyright holder is. Sometimes it is the individual making the contribution, but many times it may be their employer. There is no way for the proejct maintainer to know. Eventually, Google changed their policy to no longer recommend trying to keep the AUTHORS file up to date proactively, and instead to only add to it when requested: https://opensource.google/docs/releasing/authors. They are also clear that: > Adding contributors to the AUTHORS file is entirely within the > project's discretion and has no implications for copyright ownership. It was primarily added to appease a small number of large contributors that insisted that they be recognized as copyright holders (which was entirely their right to do). But it's not truly necessary, and not even the most accurate way of identifying contributors and/or copyright holders. In practice, we've never added anyone to our AUTHORS file. It only lists Tailscale, so it's not really serving any purpose. It also causes confusion because Tailscalars put the "Tailscale Inc & AUTHORS" header in other open source repos which don't actually have an AUTHORS file, so it's ambiguous what that means. Instead, we just acknowledge that the contributors to Tailscale (whoever they are) are copyright holders for their individual contributions. We also have the benefit of using the DCO (developercertificate.org) which provides some additional certification of their right to make the contribution. The source file changes were purely mechanical with: git ls-files | xargs sed -i -e 's/\(Tailscale Inc &\) AUTHORS/\1 contributors/g' Updates #cleanup Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d Signed-off-by: Will Norris <will@tailscale.com>
2025-11-16syncs: add Mutex/RWMutex alias/wrappers for future mutex debuggingBrad Fitzpatrick1-2/+2
Updates #17852 Change-Id: I477340fb8e40686870e981ade11cd61597c34a20 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-10-03all: use buildfeature constants in a few more placesBrad Fitzpatrick1-2/+16
Saves 21 KB. Updates #12614 Change-Id: I0cd3e735937b0f5c0fcc9f09a24476b1c4ac9a15 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-25envknob/featureknob: restore SSH and exit-node capability for Home Assistant ↵Laszlo Magyar1-14/+0
(#16263) SSH was disabled in #10538 Exit node was disabled in #13726 This enables ssh and exit-node options in case of Home Assistant. Fixes #15552 Signed-off-by: Laszlo Magyar <lmagyar1973@gmail.com>
2025-04-02ssh/tailssh: add Plan 9 support for Tailscale SSHBrad Fitzpatrick1-1/+1
Updates #5794 Change-Id: I7b05cd29ec02085cb503bbcd0beb61bf455002ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-18ipn/store/kubestore,kube,envknob,cmd/tailscaled/depaware.txt: allow ↵Irbe Krumina1-2/+8
kubestore read/write custom TLS secrets (#15307) This PR adds some custom logic for reading and writing kube store values that are TLS certs and keys: 1) when store is initialized, lookup additional TLS Secrets for this node and if found, load TLS certs from there 2) if the node runs in certs 'read only' mode and TLS cert and key are not found in the in-memory store, look those up in a Secret 3) if the node runs in certs 'read only' mode, run a daily TLS certs reload to memory to get any renewed certs Updates tailscale/corp#24795 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-03-13ipn/ipnlocal, envknob: make it possible to configure the cert client to act ↵Irbe Krumina1-0/+17
in read-only mode (#15250) * ipn/ipnlocal,envknob: add some primitives for HA replica cert share. Add an envknob for configuring an instance's cert store as read-only, so that it does not attempt to issue or renew TLS credentials, only reads them from its cert store. This will be used by the Kubernetes Operator's HA Ingress to enable multiple replicas serving the same HTTPS endpoint to be able to share the same cert. Also some minor refactor to allow adding more tests for cert retrieval logic. Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-01-26envknob/featureknob: allow use of exit node on unraid (#14754)Derek Kaser1-2/+1
Fixes #14372 Signed-off-by: Derek Kaser <11674153+dkaser@users.noreply.github.com>
2025-01-04all: use iterators in more places instead of Range funcsBrad Fitzpatrick2-9/+4
And misc cleanup along the way. Updates #12912 Change-Id: I0cab148b49efc668c6f5cdf09c740b84a713e388 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07envknob,kube/kubetypes,cmd/k8s-operator: add app type for ProxyGroup (#14029)Irbe Krumina1-1/+1
Sets a custom hostinfo app type for ProxyGroup replicas, similarly to how we do it for all other Kubernetes Operator managed components. Updates tailscale/tailscale#13406,tailscale/corp#22920 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-16ipn/ipnlocal: error when trying to use exit node on unsupported platform ↵Mario Minardi2-39/+68
(#13726) Adds logic to `checkExitNodePrefsLocked` to return an error when attempting to use exit nodes on a platform where this is not supported. This mirrors logic that was added to error out when trying to use `ssh` on an unsupported platform, and has very similar semantics. Fixes https://github.com/tailscale/tailscale/issues/13724 Signed-off-by: Mario Minardi <mario@tailscale.com>
2024-10-04envknob: support disk-based envknobs on the macsys buildAndrew Dunham1-23/+53
Per my investigation just now, the $HOME environment variable is unset on the macsys (standalone macOS GUI) variant, but the current working directory is valid. Look for the environment variable file in that location in addition to inside the home directory. Updates #3707 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I481ae2e0d19b316244373e06865e3b5c3a9f3b88
2024-09-08kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware ↵Irbe Krumina1-1/+1
.txt: rename packages (#13418) Rename kube/{types,client,api} -> kube/{kubetypes,kubeclient,kubeapi} so that we don't need to rename the package on each import to convey that it's kubernetes specific. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-09-08kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware ↵Irbe Krumina1-2/+2
.txt: split out kube types (#13417) Further split kube package into kube/{client,api,types}. This is so that consumers who only need constants/static types don't have to import the client and api bits. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-09-08cmd/k8s-operator,kube: set app name for Kubernetes Operator proxies (#13410)Irbe Krumina1-0/+14
Updates tailscale/corp#22920 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-09-04all: use new Go 1.23 slices.Sorted moreBrad Fitzpatrick1-7/+3
Updates #12912 Change-Id: If1294e5bc7b5d3cf0067535ae10db75e8b988d8b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-26ci: enable checklocks workflow for specific packagesAndrew Dunham1-6/+17
This turns the checklocks workflow into a real check, and adds annotations to a few basic packages as a starting point. Updates #12625 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I2b0185bae05a843b5257980fc6bde732b1bdd93f
2024-03-15envknob: ensure f is not nil before using itMarwan Sulaiman1-1/+5
This PR fixes a panic that I saw in the mac app where parsing the env file fails but we don't get to see the error due to the panic of using f.Name() Fixes #11425 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>
2023-12-01client/web: show features based on platform supportSonia Appasamy1-0/+39
Hiding/disabling UI features when not available on the running client. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-09-17tailcfg: define a type for NodeCapabilityMaisem Ali2-4/+5
Instead of untyped string, add a type to identify these. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-09-11wgengine/magicsock: make peerMap also keyed by NodeIDBrad Fitzpatrick1-2/+14
In prep for incremental netmap update plumbing (#1909), make peerMap also keyed by NodeID, as all the netmap node mutations passed around later will be keyed by NodeID. In the process, also: * add envknob.InDevMode, as a signal that we can panic more aggressively in unexpected cases. * pull two moderately large blocks of code in Conn.SetNetworkMap out into their own methods * convert a few more sets from maps to set.Set Updates #1909 Change-Id: I7acdd64452ba58e9d554140ee7a8760f9043f961 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-21types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeViewBrad Fitzpatrick2-5/+5
Updates #1909 Change-Id: I8c470cbc147129a652c1d58eac9b790691b87606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-17all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}Brad Fitzpatrick1-1/+1
Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-04envknob: support tailscaled-env.txt on macOS tooBrad Fitzpatrick1-8/+25
Updates #3707 Co-authored-by: Marwan Sulaiman <marwan@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-03-30envknob,net/tstun,wgengine: use TS_DEBUG_MTU consistentlyJames Tucker1-0/+40
Noted on #5915 TS_DEBUG_MTU was not used consistently everywhere. Extract the default into a function that can apply this centrally and use it everywhere. Added envknob.Lookup{Int,Uint}Sized to make it easier to keep CodeQL happy when using converted values. Updates #5915 Signed-off-by: James Tucker <james@tailscale.com>
2023-03-30envknob/logknob: add package for configurable loggingAndrew Dunham2-0/+186
A LogKnob allows enabling logs with an envknob, netmap capability, and manually, and calling a logging function when logs are enabled. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id66c608d4e488bfd4eaa5e867a8d9289686748be
2023-03-07wgengine/magicsock: track per-endpoint changes in ringbufferAndrew Dunham1-0/+33
This change adds a ringbuffer to each magicsock endpoint that keeps a fixed set of "changes"–debug information about what updates have been made to that endpoint. Additionally, this adds a LocalAPI endpoint and associated "debug peer-status" CLI subcommand to fetch the set of changes for a given IP or hostname. Updates tailscale/corp#9364 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I34f726a71bddd0dfa36ec05ebafffb24f6e0516a
2023-02-11version: unexport all vars, turn Short/Long into funcsDavid Anderson1-1/+1
The other formerly exported values aren't used outside the package, so just unexport them. Signed-off-by: David Anderson <danderson@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris3-9/+6
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2023-01-23envknob, hostinfo, ipn/ipnlocal: add start of opt-in remote update supportBrad Fitzpatrick1-0/+7
Updates #6907 Change-Id: I85db4f6f831dd5ff7a9ef4bfa25902607e0c1558 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-21envknob: add time.Duration knob supportBrad Fitzpatrick1-5/+42
Updates #6818 Change-Id: I9c8147c02fb514f9f6f1f272bdb0f974c8b3ccbb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-28safesocket: remove the IPN protocol supportBrad Fitzpatrick1-0/+12
Updates #6417 Change-Id: I78908633de842d83b2cc8b10a864a0f88ab1b113 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-24envknob: add CanTaildrop (TS_DISABLE_TAILDROP) to disable taildrop on deviceBrad Fitzpatrick1-4/+9
This matches CanSSHD (TS_DISABLE_SSH_SERVER) for administratively disabling the code on a node, regardless of local or server configs. This can be configured in /etc/default/tailscaled on Linux, %ProgramData%\Tailscale\tailscaled-env.txt on Windows, or /etc/tailscale/tailscaled-env.txt on Synology. (see getPlatformEnvFile) Also delete some dead code and tidy up some docs. Change-Id: I79a87c03e33209619466ea8aeb0f6651afcb8789 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-23envknob: add GOOS funcBrad Fitzpatrick3-2/+41
Centralize the fake GOOS stuff, start to use it more. To be used more in the future. Change-Id: Iabacfbeaf5fca0b53bf4d5dbcdc0367f05a205f9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-05ipn/ipnlocal: filter peers with bad signatures when tka is enabledTom DNetto1-0/+5
Signed-off-by: Tom DNetto <tom@tailscale.com>
2022-09-17envknob, health: support Synology, show parse errors in statusBrad Fitzpatrick2-32/+58
Updates #5114 Change-Id: I8ac7a22a511f5a7d0dcb8cac470d4a403aa8c817 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-16envknob: generalize Windows tailscaled-env.txt supportBrad Fitzpatrick2-0/+77
ipnserver previously had support for a Windows-only environment variable mechanism that further only worked when Windows was running as a service, not from a console. But we want it to work from tailscaed too, and we want it to work on macOS and Synology. So move it to envknob, now that envknob can change values at runtime post-init. A future change will wire this up for more platforms, and do something more for CLI flags like --port, which the bug was originally about. Updates #5114 Change-Id: I9fd69a9a91bb0f308fc264d4a6c33e0cbe352d71 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-15envknob: support changing envknobs post-initBrad Fitzpatrick1-10/+165
Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-13cmd/tailscaled, tailcfg, hostinfo: add flag to disable logging + supportBrad Fitzpatrick1-0/+11
As noted in #5617, our documented method of blocking log.tailscale.io DNS no longer works due to bootstrap DNS. Instead, provide an explicit flag (--no-logs-no-support) and/or env variable (TS_NO_LOGS_NO_SUPPORT=true) to explicitly disable logcatcher uploads. It also sets a bit on Hostinfo to say that the node is in that mode so we can end any support tickets from such nodes more quickly. This does not yet provide an easy mechanism for users on some platforms (such as Windows, macOS, Synology) to set flags/env. On Linux you'd used /etc/default/tailscaled typically. Making it easier to set flags for other platforms is tracked in #5114. Fixes #5617 Fixes tailscale/corp#1475 Change-Id: I72404e1789f9e56ec47f9b7021b44c025f7a373a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ipn/ipnlocal: reject tailscale up --ssh if disabled on tailnetBrad Fitzpatrick1-0/+6
Updates #3802 Change-Id: I3f1e839391fe9b28270f506f4bb8d8e3d36716f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-29envknob: use the correct key when logging (#4319)Maisem Ali1-1/+1
2022-03-23envknob, ipn/ipnlocal: add SSH admin kill switchBrad Fitzpatrick1-0/+7
Updates #3802 Change-Id: I6127907446d1a6be1b097d9ba3b534f2b8eb707f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-17all: use any instead of interface{}Josh Bleecher Snyder1-1/+1
My favorite part of generics. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-02-12envknob: track, log env knobs in useBrad Fitzpatrick1-2/+40
Fixes #3921 Change-Id: I8186053b5c09c43f0358b4e7fdd131361a6d8f2e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-12envknob: remove some stutter from error messagesBrad Fitzpatrick1-3/+3
The strconv errors already stringified with the same. Change-Id: I6938c5653e9aafa6d9028d45fc26e39eb9ccbaea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24wgengine/netstack: add an SSH server experimentBrad Fitzpatrick1-0/+4
Disabled by default. To use, run tailscaled with: TS_SSH_ALLOW_LOGIN=you@bar.com And enable with: $ TAILSCALE_USE_WIP_CODE=true tailscale up --ssh=true Then ssh [any-user]@[your-tailscale-ip] for a root bash shell. (both the "root" and "bash" part are temporary) Updates #3802 Change-Id: I268f8c3c95c8eed5f3231d712a5dc89615a406f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-24envknob: add new package for all the strconv.ParseBool(os.Getenv(..))Brad Fitzpatrick1-0/+102
A new package can also later record/report which knobs are checked and set. It also makes the code cleaner & easier to grep for env knobs. Change-Id: Id8a123ab7539f1fadbd27e0cbeac79c2e4f09751 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.