Add feature flag for SSH, and warning
@@ -15,6 +15,7 @@ import (
"github.com/rs/zerolog/log"
"github.com/tailscale/hujson"
"gopkg.in/yaml.v3"
+ "tailscale.com/envknob"
"tailscale.com/tailcfg"
)
@@ -55,6 +56,8 @@ const (
ProtocolFC = 133 // Fibre Channel
)
+var featureEnableSSH = envknob.RegisterBool("HEADSCALE_FEATURE_SSH")
+
// LoadACLPolicy loads the ACL policy from the specify path, and generates the ACL rules.
func (h *Headscale) LoadACLPolicy(path string) error {
log.Debug().
@@ -121,6 +124,7 @@ func (h *Headscale) UpdateACLRules() error {
log.Trace().Interface("ACL", rules).Msg("ACL rules generated")
h.aclRules = rules
+ if featureEnableSSH() {
sshRules, err := h.generateSSHRules()
if err != nil {
return err
@@ -130,6 +134,9 @@ func (h *Headscale) UpdateACLRules() error {
h.sshPolicy = &tailcfg.SSHPolicy{}
}
h.sshPolicy.Rules = sshRules
+ } else if h.aclPolicy != nil && len(h.aclPolicy.SSHs) > 0 {
+ log.Info().Msg("SSH ACLs has been defined, but HEADSCALE_FEATURE_SSH is not enabled, this is a unstable feature, check docs before activating")
+ }
return nil
}
