v1.2.0

Changelog

• 841b98a build(nix): add basic flake
• 7ed9cd4 build(nix): add exec reload to module
• c787691 build(nix): add multi-node integration tests
• d92501f build(nix): add nixos module for client
• 48d235b build(nix): add nixos module tests
• 5f16919 build(nix): filter client sources to reduce rebuilds
• 7597356 build(nix): integrate systemd
• 2817615 build(nix): update built package metadata
• c2ba8b1 build(nix): use tscontrol binary for mock tailscale control plan
• 3f708e6 build(wiremock): add daemon config route
• 31b5bc1 build(wiremock): add version route
• 9c5ea72 build: fix mock recipe not binding stubs
• 8ed88da build: replace makefiles with just
• 369436d chore(main): release 1.2.0 (#4)
• 1a8277a chore: bump direct dependencies
• 24f088f chore: ignore built nix artifacts
• f9c2ade chore: switch to goreleaser-pro
• f5166c0 ci(release): add goreleaser partial jobs
• 1a97b32 ci(release): add unique names for artifacts
• 7e4762e ci(release): create nightly releases
• 024cb29 ci(release): debug attestation generation
• 4659b85 ci(release): ensure cross compiling occurs
• 9037bc6 ci(release): fix attestation generation
• e0e8d2d ci(release): fix uploading intermediary artifacts
• 10be0dd ci(release): make name for release-please more precise
• e4cf648 ci(release): make repository public
• 6f4a16b ci(release): merge split builds into single release
• a2801aa ci(release): migrate away from depcreated name_template
• 9cb7667 ci(release): only use release-please for generating PRs and tags
• 8b4118a ci(release): remove next version from nightly template
• dd817c7 ci(release): replace intermediary cache with artifact upload
• 9afd803 ci(release): set pretty names for release preparation jobs
• 1c9a3d8 docs(terraform): document loading from parameter store and secrets manager
• 6c137a8 feat(api): add method for retrieving daemon config
• eea04c3 feat(api): allow retrieving api version info
• 1a0fc60 feat(api): provide rich error details on api failure
• 6adf230 feat(cli): add command for force refreshing
• ec0f49f feat(cli): add command for generating configuration file
• a0a759c feat(cli): add systemd integration
• f47c0b2 feat(cli): add user agent header to http client
• 8806ad1 feat(cli): allow refreshing token via SIGHUP
• 50aa4c3 feat(cli): expose version flag
• f2f97e1 feat(cli): perform basic config url validation
• 5b8fe63 feat(cli): retrieve refresh frequency from remote daemon config
• 4aba2a4 feat(cli): verify remote api version on startup
• 2a51ae4 feat(cli): write the daemon's pid to a file
• 62edaf8 feat(configloader): allow loading values from parameter store and secrets manager
• 02c7196 feat(configloader): expose wrapper around raw config
• dd38cde feat(configloader): support loading secrets from files
• 9583859 feat(dev): add healthcheck endpoint
• 808e1e6 feat(dev): add support for headscale
• 399617c feat(dev): allow switching between local and step function launcher
• b4f898c feat(dev): expose daemon config document
• 697dcaf feat(dev): expose version document
• a26e92f feat(dev): expose version flag
• eff73ad feat(finalizer): add basic config validation
• 0e1a16a feat(finalizer): add support for custom domains
• 80c3581 feat(finalizer): allow loading config from secrets
• 283062c feat(finalizer): distinguish between unverified and failed challenges
• 5659d2d feat(finalizer): manually construct issuer url
• 7fc0c6e feat(generator): add basic config validation
• ab1e6ce feat(generator): add document for daemon config
• 22e05eb feat(generator): allow loading config from secrets
• 236e102 feat(http): add helper for internal server errors
• 71c0faf feat(initializer): add basic config validation
• 228e552 feat(initializer): add support for headscale
• 8f7ca7d feat(initializer): allow loading config from secrets
• b77ec9a feat(initializer): use step function-backed launcher
• 2810daa feat(launcher): add step function-backed implementation
• 73a9cc5 feat(launcher): improve logging
• 1de13e1 feat(metadata): improve logging
• a572fc9 feat(metadata): include extra claims in metadata document
• dc9aed7 feat(nix): write token to runtime dir
• e795e4f feat(oidc): conditionally populate non-tags in amr claim
• 45b6405 feat(oidc): re-structure claims for use within aws
• a417c41 feat(refresher): add signature debug logging
• 6fa1ff8 feat(refresher): automatically cleanup listeners regardless of finalization result
• c527423 feat(refresher): handle permanenty and transient errors
• 103c69c feat(refresher): make failed refresh initializations transient
• b94264c feat(refresher): make tailscale client status errors transient
• 2325948 feat(refresher): make token directory permissive if not exists
• 8b20652 feat(scheduler): allow immediately running job
• 97978d9 feat(scheduler): allow transient errors to be retried
• cbf8f5d feat(signing): extend claims in token
• 729c1f7 feat(signing): improve logging
• 2891b53 feat(storage): add extra api fields to flow metadata
• 8353736 feat(storage): improve logging
• 34910f2 feat(tailscale): add support for custom base url
• c0549cc feat(tailscale): add support for headscale control plane
• e4ad8b3 feat(tailscale): add support for plaintext headscale connections
• 9fb9c5b feat(tailscale): extend information returned for nodes
• 44b5df9 feat(tailscale): handle headscale node not found
• b4b6b05 feat(tailscale): improve logging
• 886df10 feat(terraform): add extra step to mark flows as failed
• fcce5df feat(terraform): add module for binding lambda to api gateway
• b1c0d71 feat(terraform): add other lambda functions
• 6229762 feat(terraform): add required iam permissions for generator
• 82f054b feat(terraform): add support for custom domains
• d102f89 feat(terraform): allow applying additional lambda execution role policies
• 77d1854 feat(terraform): allow generator to write version and config metadata
• 1dee7f7 feat(terraform): break apart tailscale inputs
• 09b8fbd feat(terraform): configure api gateway throttling
• 27ab6c0 feat(terraform): configure finalizer lambda
• 193be93 feat(terraform): configure function log level
• 61511fb feat(terraform): configure initializer lambda
• 5720b5c feat(terraform): configure verifier lambda
• 8fb78c0 feat(terraform): create openid connect provider for tailfed
• 2432082 feat(terraform): create step function workflow
• daf830b feat(terraform): enable cors for s3 proxied resources
• f028645...

v1.1.0

1.1.0 (2025-04-12)

Features

• terraform: add lambda function module (76216a7)
• terraform: create and integrate generator lambda function (f6bd9a1)

Bug Fixes

• finalizer: pass handler serve function (218cc83)
• generator: pull bucket name from environment (d3acad5)

v1.0.0

1.0.0 (2025-04-12)

Features

• api: allow multiple ports in start request (07590c8)
• api: create api client (d21ac29)
• api: create shared api types (c6ded37)
• api: permit only one listen port per address type (438caaa)
• api: redefine signature contents (5f448f0)
• api: use base url in request building (acff777)
• api: use bytes type for signing secret (463706c)
• cli: add basic structure with version command (d9f4625)
• cli: add run/start scaffolD (28eb63c)
• client: add executable entrypoint (6167437)
• cli: integrate refresher (4d2d992)
• cli: read configuration from environment variables and file (d5f8b8d)
• configloader: add support for .env (1c9691e)
• configloader: extract into separate package (ccbc57b)
• configloader: make .env file optional (2b8a31d)
• configloader: make flag loading optional (3a2f566)
• dev-gateway: add storage backend creation (9b93864)
• dev-gateway: implement local api gateway (9559eb6)
• dev-gateway: initialize tailscale api client (c72d86d)
• dev-gateway: register initializer lambda (6a594e4)
• dev: add mock local launcher (897007d)
• dev: allow switching between filesystem and dynamo storage (2fb5bc7)
• dev: allow switching between memory and kms signers (462b23e)
• dev: integrate generator into dev binary (0750ebc)
• dev: integrate signer for finalizer (53a1fec)
• dev: integrate verifier into mock local launcher (608e8ed)
• dev: register finalizer endpoint (955d183)
• finalizer: implement base structure without token signing (a109845)
• finalizer: integrate token signing (a85f9a5)
• finalizer: use dynamodb-backed storage (040c717)
• finalizer: use kms-based signer (bc993f8)
• generator: implement oidc metadata generator (0fd8d24)
• http: add api gateway response generators (52d81d9)
• http: add domain to gateway translation (2360b27)
• http: add gateway request/response translation (8bae5b0)
• http: add request id middleware (51b5fde)
• http: expose mock gateway id, domain, and url (9f354a0)
• initializer: add base implementation (027cc94)
• initializer: add component name to logger (1cad4b2)
• initializer: add lambda entrypoint (52c44cb)
• initializer: add launching verification handlers (46425b7)
• initializer: use dynamodb-backed storage (c86b799)
• launcher: add channel-backed implementation for development (0591b1d)
• logging: add basic logging facilities (8612dc8)
• logging: allow injecting logger into arbitrary context (0d9710a)
• logging: implement middleware (2e70127)
• logging: use global logger (4331de2)
• metadata: add filesystem and s3 metadata storage backends (ad0becf)
• metadata: add minimal oidc discovery document (a275775)
• refresher: add callback server logging (ad3daa2)
• refresher: add start issuance process (4a00ac7)
• refresher: immediately spawn finalizer job (5858ecc)
• refresher: implement callback server (5502b13)
• refresher: implement finalization flow (97d5377)
• scheduler: add scheduler wrapper around gocron (2332faf)
• scheduler: use manual implementation instead of gocron (b6b2be7)
• signing: add in-memory signing backend (da6ec58)
• signing: implement retrieving public keys from kms (5cb5fbc)
• signing: implement signing tokens via AWS KMS (7a1f827)
• signing: use fingerprint for key id (99c45df)
• storage: add dynamodb-backed storage (d9157d3)
• storage: add filesystem-backed implmentation (94206c8)
• tailscale: add control plane client wrapper (acc7935)
• tailscale: add local tailscale client wrapper (9f052e0)
• terraform: add api gateway with resources (0bb7afc)
• terraform: add bucket with openid configuration data (558dbca)
• terraform: add dynamodb storage (3dd09a0)
• terraform: add event bridge schedule for generator (d90c551)
• terraform: add kms key for signing ([20ac7a2](https:/...