caddytailscaleauth

README

Tailscale authentication plugin for Caddy

This package provides a module for Caddy that implements authentication using the Tailscale network (Tailnet). When a connection comes in over a Tailnet information about the remote party is available such as the user account (for personal devices) and tags (for non-personal "tagged" devices). This information can then be used to limit access to routes.

Building

The xcaddy tool can be used to build Caddy to include this plugin:

xcaddy build --with github.com/sprucehealth/caddy-tailscale-auth

Documentation

Index

• Constants
• type PolicyMatches
• type TailscaleAuth
  • func (ta *TailscaleAuth) Authenticate(w http.ResponseWriter, r *http.Request) (caddyauth.User, bool, error)
  • func (*TailscaleAuth) CaddyModule() caddy.ModuleInfo
  • func (ta *TailscaleAuth) Cleanup() error
  • func (ta *TailscaleAuth) Provision(ctx caddy.Context) error
  • func (ta *TailscaleAuth) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

Constants

const (
	PolicyAllow = "allow"
	PolicyDeny  = "deny"
)

Types

type PolicyMatches

type PolicyMatches struct {
	Policy  string
	Matches []string
}

type TailscaleAuth

type TailscaleAuth struct {
	APITailnet                  string              `json:"api_tailnet,omitempty"`
	ExpectedTailnet             string              `json:"expected_tailnet,omitempty"`
	DefaultPolicy               string              `json:"default_policy,omitempty"`
	CapabilityName              string              `json:"capability_name,omitempty"`
	Policies                    []PolicyMatches     `json:"policies,omitempty"`
	Groups                      map[string][]string `json:"groups,omitempty"`
	TailscaleAPIRefreshInterval time.Duration       `json:"tailscale_api_refresh_interval,omitempty"`
	TailscaleOAuthClientID      string              `json:"tailscale_oauth_client_id,omitempty"`
	TailscaleOAuthClientSecret  string              `json:"tailscale_oauth_client_secret,omitempty"`
	// contains filtered or unexported fields
}

func (*TailscaleAuth) Authenticate

func (ta *TailscaleAuth) Authenticate(w http.ResponseWriter, r *http.Request) (caddyauth.User, bool, error)

func (*TailscaleAuth) CaddyModule

func (*TailscaleAuth) CaddyModule() caddy.ModuleInfo

CaddyModule returns the Caddy module information.

func (*TailscaleAuth) Cleanup

func (ta *TailscaleAuth) Cleanup() error

func (*TailscaleAuth) Provision

func (ta *TailscaleAuth) Provision(ctx caddy.Context) error

func (*TailscaleAuth) UnmarshalCaddyfile

func (ta *TailscaleAuth) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

UnmarshalCaddyfile implements caddyfile.Unmarshaler.