Add an embedded DERP server to Headscale #388
Conversation
This series of commit will be adding an embedded DERP server (and STUN) to Headscale, thus making it completely self-contained and not dependant in other infrastructure.
kradalby
left a comment
There was a problem hiding this comment.
Having embedded in the names everywhere is quite a cognitive load, we only have one DERP implementation, and it is the embedded one, so might as well just call it DERP everywhere?
h.DERPHandler
h.DERPProbeHandler
h.DERPBootstrapDNSHandler
Websockets, in which DERP is based, requires a TLS certificate. At the same time, if we use a certificate it must be valid... otherwise Tailscale wont connect (does not have an Insecure option). So there is no option to expose insecure here
| ServerEnabled bool | ||
| ServerRegionID int | ||
| ServerRegionCode string | ||
| ServerRegionName string | ||
| STUNEnabled bool | ||
| STUNAddr string |
There was a problem hiding this comment.
Can we split this into DERPServerConfig and DERPSTUNConfig ?
At some point I want to have a go at getting rid of all the manual reading of options from viper, I think it can do that...
There was a problem hiding this comment.
maybe look into using HCL struct based parsing?
|
|
||
| # If enabled, also listens in the configured address for STUN connections to help on NAT traversal | ||
| # For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/ | ||
| stun: |
There was a problem hiding this comment.
We could possible call out that this is UDP, so people know what to open in firewall.
| @@ -0,0 +1,18 @@ | |||
| -----BEGIN CERTIFICATE----- | |||
There was a problem hiding this comment.
I feel like we need to know the expiry of this
integration_embedded_derp_test.go
Outdated
| ) | ||
| assert.Nil(t, err) | ||
| log.Printf("Result for %s: %s\n", hostname, result) | ||
| assert.Contains(t, result, "via DERP") |
There was a problem hiding this comment.
Can we verify the correct derp?
Co-authored-by: Kristoffer Dalby <[email protected]>
Co-authored-by: Kristoffer Dalby <[email protected]>
|
This seems finished, but needs some linting and a changelog entry. |
This series of commits will be adding an embedded DERP server (and STUN) to Headscale,
thus making it completely self-contained and not dependent in other infrastructure.