jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

feat(ci): mint staging pre-auth keys through Headscale's API #63

Merged
jfraeys merged 1 commit from jfraeys/feat/headscale-api-preauthkey into main 2026-10-11 14:18:54 -04:00
Conversation 0 Commits 1 Files changed 7 +152 -37
jfraeys commented 2026-10-11 14:10:55 -04:00
Owner
Copy link

Run 448 passed hardening validation, then failed at step 6: ssh: Could not resolve hostname services (the runner has no SSH route to the Headscale host). manage vpn preauthkey now uses Headscale's REST API when HEADSCALE_API_KEY is set (key to curl via stdin, not argv). Tested against a local mock: right Bearer header, aclTags/ephemeral/expiry body, wrong key -> 401 -> failure.

Needs before staging can pass: run scripts/provision-headscale-api-key.sh (creates the key on services, vaults it, syncs the Forgejo secret, expires old keys). API is reachable at https://vpn.jfraeys.com:8443 (the :443 hostname 404s at Traefik; not changed here). 🤖 Generated with Claude Code

Run 448 passed hardening validation, then failed at step 6: `ssh: Could not resolve hostname services` (the runner has no SSH route to the Headscale host). `manage vpn preauthkey` now uses Headscale's REST API when `HEADSCALE_API_KEY` is set (key to curl via stdin, not argv). Tested against a local mock: right Bearer header, aclTags/ephemeral/expiry body, wrong key -> 401 -> failure. Needs before staging can pass: run `scripts/provision-headscale-api-key.sh` (creates the key on services, vaults it, syncs the Forgejo secret, expires old keys). API is reachable at https://vpn.jfraeys.com:8443 (the :443 hostname 404s at Traefik; not changed here). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat(ci): mint staging tailnet pre-auth keys through Headscale's API
All checks were successful
Lint / lint (pull_request) Successful in 2m0s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
d462f0ac7d
 
The ephemeral runner has no SSH route to the services host, so `manage vpn preauthkey` failed
at "Could not resolve hostname services" in staging step 6. With HEADSCALE_API_KEY set it now
uses the REST API (key passed to curl on stdin). HEADSCALE_API_KEY is vault-authoritative,
replicated to Forgejo by ci-secrets.yml and provisioned/rotated by provision-headscale-api-key.sh.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!63
No description provided.