Brad FitzpatrickandBrad Fitzpatrick
4660a961eb
Processing a peer add/remove delta still materialized the full netmap (an O(n) slicesx.MapValues plus sort over all peers, at 10k+ peers in a large tailnet) twice per delta: once in UpdateNetmapDelta purely to hand the self node to Engine.SetSelfNode, and once in authReconfigLocked. Neither needs peers anymore. SetSelfNode gets the self node from the existing nodeBackend.Self accessor. authReconfigLocked only reads self-node fields (SelfNode, NodeKey, GetAddresses, HasCap) now that WireGuard peers ride the incremental route manager and per-peer config source, so it can use the peers-free NetMap accessor. That also makes nmcfg.WGCfg vestigial: since wgcfg.Config lost its Peers field, its peer walk existed only to emit the [v1] skip logs (expired peers, unselected exit nodes, unaccepted subnet routes), duplicating filtering the route manager already does. Delete the package and construct the two-field wgcfg.Config inline. The skip logs go away; if they're missed, the route manager can log them incrementally at upsert time instead of rescanning every peer on every reconfig. With this, the runtime.DidRange analysis (see the ts_rangehook test) shows a delta netmap update performing no O(n) range loops except updateRouteManagerExtras, and the delta phase of that test drops from 1.09s to 0.14s for 400 deltas at n=10000 (from 4.79s at the start of this effort, before the incremental route manager work). Updates #12542 Signed-off-by: Brad Fitzpatrick <[email protected]> Change-Id: Ia0e03ef9db0c988790b2c29de1f0505305e93f58
Caution
Development of tsidp has been moved to https://github.com/tailscale/tsidp and it is no longer maintained here. Please visit the new repository to see the latest updates, file an issue, or contribute.
tsidp - Tailscale OpenID Connect (OIDC) Identity Provider
tsidp is an OIDC Identity Provider (IdP) server that integrates with your Tailscale network. It allows you to use Tailscale identities for authentication in applications that support OpenID Connect, enabling single sign-on (SSO) capabilities within your tailnet.
Prerequisites
- A Tailscale network (tailnet) with magicDNS and HTTPS enabled
- A Tailscale authentication key from your tailnet
- Docker installed on your system
Installation using Docker
Pre-built image
A pre-built tsidp image exists at tailscale/tsidp:unstable.
Building from Source
# Clone the Tailscale repository
git clone https://github.com/tailscale/tailscale.git
cd tailscale
# Build and publish to your own registry
make publishdevtsidp REPO=ghcr.io/yourusername/tsidp TAGS=v0.0.1 PUSH=true
Running the Container
Replace YOUR_TAILSCALE_AUTHKEY with your Tailscale authentication key:
docker run -d \
--name tsidp \
-p 443:443 \
-e TS_AUTHKEY=YOUR_TAILSCALE_AUTHKEY \
-e TAILSCALE_USE_WIP_CODE=1 \
-v tsidp-data:/var/lib/tsidp \
ghcr.io/yourusername/tsidp:v0.0.1 \
tsidp --hostname=idp --dir=/var/lib/tsidp
Verify Installation
docker logs tsidp
Visit https://idp.tailnet.ts.net to confirm the service is running.
Usage Example: Proxmox Integration
Here's how to configure Proxmox to use tsidp for authentication:
-
In Proxmox, navigate to Datacenter > Realms > Add OpenID Connect Server
-
Configure the following settings:
- Issuer URL:
https://idp.velociraptor.ts.net - Realm:
tailscale(or your preferred name) - Client ID:
unused - Client Key:
unused - Default:
true - Autocreate users:
true - Username claim:
email
- Issuer URL:
-
Set up user permissions:
- Go to Datacenter > Permissions > Groups
- Create a new group (e.g., "tsadmins")
- Click Permissions in the sidebar
- Add Group Permission
- Set Path to
/for full admin access or scope as needed - Set the group and role
- Add Tailscale-authenticated users to the group
Configuration Options
The tsidp server supports several command-line flags:
--verbose: Enable verbose logging--port: Port to listen on (default: 443)--local-port: Allow requests from localhost--use-local-tailscaled: Use local tailscaled instead of tsnet--hostname: tsnet hostname--dir: tsnet state directory
Environment Variables
TS_AUTHKEY: Your Tailscale authentication key (required)TS_HOSTNAME: Hostname for thetsidpserver (default: "idp", Docker only)TS_STATE_DIR: State directory (default: "/var/lib/tsidp", Docker only)TAILSCALE_USE_WIP_CODE: Enable work-in-progress code (default: "1")
Support
This is an experimental, work in progress, community project. For issues or questions, file issues on the GitHub repository.
License
BSD-3-Clause License. See LICENSE for details.