v1.2.0

Changelog

• 841b98a build(nix): add basic flake
• 7ed9cd4 build(nix): add exec reload to module
• c787691 build(nix): add multi-node integration tests
• d92501f build(nix): add nixos module for client
• 48d235b build(nix): add nixos module tests
• 5f16919 build(nix): filter client sources to reduce rebuilds
• 7597356 build(nix): integrate systemd
• 2817615 build(nix): update built package metadata
• c2ba8b1 build(nix): use tscontrol binary for mock tailscale control plan
• 3f708e6 build(wiremock): add daemon config route
• 31b5bc1 build(wiremock): add version route
• 9c5ea72 build: fix mock recipe not binding stubs
• 8ed88da build: replace makefiles with just
• 369436d chore(main): release 1.2.0 (#4)
• 1a8277a chore: bump direct dependencies
• 24f088f chore: ignore built nix artifacts
• f9c2ade chore: switch to goreleaser-pro
• f5166c0 ci(release): add goreleaser partial jobs
• 1a97b32 ci(release): add unique names for artifacts
• 7e4762e ci(release): create nightly releases
• 024cb29 ci(release): debug attestation generation
• 4659b85 ci(release): ensure cross compiling occurs
• 9037bc6 ci(release): fix attestation generation
• e0e8d2d ci(release): fix uploading intermediary artifacts
• 10be0dd ci(release): make name for release-please more precise
• e4cf648 ci(release): make repository public
• 6f4a16b ci(release): merge split builds into single release
• a2801aa ci(release): migrate away from depcreated name_template
• 9cb7667 ci(release): only use release-please for generating PRs and tags
• 8b4118a ci(release): remove next version from nightly template
• dd817c7 ci(release): replace intermediary cache with artifact upload
• 9afd803 ci(release): set pretty names for release preparation jobs
• 1c9a3d8 docs(terraform): document loading from parameter store and secrets manager
• 6c137a8 feat(api): add method for retrieving daemon config
• eea04c3 feat(api): allow retrieving api version info
• 1a0fc60 feat(api): provide rich error details on api failure
• 6adf230 feat(cli): add command for force refreshing
• ec0f49f feat(cli): add command for generating configuration file
• a0a759c feat(cli): add systemd integration
• f47c0b2 feat(cli): add user agent header to http client
• 8806ad1 feat(cli): allow refreshing token via SIGHUP
• 50aa4c3 feat(cli): expose version flag
• f2f97e1 feat(cli): perform basic config url validation
• 5b8fe63 feat(cli): retrieve refresh frequency from remote daemon config
• 4aba2a4 feat(cli): verify remote api version on startup
• 2a51ae4 feat(cli): write the daemon's pid to a file
• 62edaf8 feat(configloader): allow loading values from parameter store and secrets manager
• 02c7196 feat(configloader): expose wrapper around raw config
• dd38cde feat(configloader): support loading secrets from files
• 9583859 feat(dev): add healthcheck endpoint
• 808e1e6 feat(dev): add support for headscale
• 399617c feat(dev): allow switching between local and step function launcher
• b4f898c feat(dev): expose daemon config document
• 697dcaf feat(dev): expose version document
• a26e92f feat(dev): expose version flag
• eff73ad feat(finalizer): add basic config validation
• 0e1a16a feat(finalizer): add support for custom domains
• 80c3581 feat(finalizer): allow loading config from secrets
• 283062c feat(finalizer): distinguish between unverified and failed challenges
• 5659d2d feat(finalizer): manually construct issuer url
• 7fc0c6e feat(generator): add basic config validation
• ab1e6ce feat(generator): add document for daemon config
• 22e05eb feat(generator): allow loading config from secrets
• 236e102 feat(http): add helper for internal server errors
• 71c0faf feat(initializer): add basic config validation
• 228e552 feat(initializer): add support for headscale
• 8f7ca7d feat(initializer): allow loading config from secrets
• b77ec9a feat(initializer): use step function-backed launcher
• 2810daa feat(launcher): add step function-backed implementation
• 73a9cc5 feat(launcher): improve logging
• 1de13e1 feat(metadata): improve logging
• a572fc9 feat(metadata): include extra claims in metadata document
• dc9aed7 feat(nix): write token to runtime dir
• e795e4f feat(oidc): conditionally populate non-tags in amr claim
• 45b6405 feat(oidc): re-structure claims for use within aws
• a417c41 feat(refresher): add signature debug logging
• 6fa1ff8 feat(refresher): automatically cleanup listeners regardless of finalization result
• c527423 feat(refresher): handle permanenty and transient errors
• 103c69c feat(refresher): make failed refresh initializations transient
• b94264c feat(refresher): make tailscale client status errors transient
• 2325948 feat(refresher): make token directory permissive if not exists
• 8b20652 feat(scheduler): allow immediately running job
• 97978d9 feat(scheduler): allow transient errors to be retried
• cbf8f5d feat(signing): extend claims in token
• 729c1f7 feat(signing): improve logging
• 2891b53 feat(storage): add extra api fields to flow metadata
• 8353736 feat(storage): improve logging
• 34910f2 feat(tailscale): add support for custom base url
• c0549cc feat(tailscale): add support for headscale control plane
• e4ad8b3 feat(tailscale): add support for plaintext headscale connections
• 9fb9c5b feat(tailscale): extend information returned for nodes
• 44b5df9 feat(tailscale): handle headscale node not found
• b4b6b05 feat(tailscale): improve logging
• 886df10 feat(terraform): add extra step to mark flows as failed
• fcce5df feat(terraform): add module for binding lambda to api gateway
• b1c0d71 feat(terraform): add other lambda functions
• 6229762 feat(terraform): add required iam permissions for generator
• 82f054b feat(terraform): add support for custom domains
• d102f89 feat(terraform): allow applying additional lambda execution role policies
• 77d1854 feat(terraform): allow generator to write version and config metadata
• 1dee7f7 feat(terraform): break apart tailscale inputs
• 09b8fbd feat(terraform): configure api gateway throttling
• 27ab6c0 feat(terraform): configure finalizer lambda
• 193be93 feat(terraform): configure function log level
• 61511fb feat(terraform): configure initializer lambda
• 5720b5c feat(terraform): configure verifier lambda
• 8fb78c0 feat(terraform): create openid connect provider for tailfed
• 2432082 feat(terraform): create step function workflow
• daf830b feat(terraform): enable cors for s3 proxied resources
• f028645 feat(terraform): expose lambda function timeout
• c557c9b feat(terraform): expose new metadata documents
• 22768f3 feat(terraform): extend verifier function timeout
• f3c5d74 feat(terraform): generate required outputs
• b6cc409 feat(terraform): link finalizer lambda to gateway route
• 9e0fc0e feat(terraform): link initializer lambda to gateway route
• 98b3596 feat(terraform): parallelize address verification
• 49902c6 feat(terraform): pass full resource arns
• eb55185 feat(terraform): re-trigger api gateway deployment on resource change
• d9546b8 feat(terraform): turn configuration into a module
• 075a739 feat(terraform): update lambda functions on artifact modification
• 5e03d3f feat(tscontrol): add mock tailscale control plane
• c7b0e43 feat(tscontrol): remove unused binary
• 582d1d3 feat(verifier): add basic config validation
• 0c555c3 feat(verifier): add signature debug logging
• dcebd93 feat(verifier): allow loading config from secrets
• 7c76523 fix(cli): only implement refresh for unix-like systems
• 79d646f fix(configloader): ignore a non-existent config file
• dc61264 fix(dev): add timeout to verifier client
• 4b1fb34 fix(dev): propagate headscale base url correctly
• e622e0a fix(finalizer): flip challenge expiry check
• c5510c8 fix(finalizer): prevent issuing for expired flows
• 761a57c fix(initializer): propagate headscale base url correctly
• 9520eed fix(metadata): fix subject types marshalled name
• 265e8a5 fix(metadata): store with json content type for s3 backend
• 3591d0d fix(oidc): prevent erroneous empty strings in amr claim
• cb6dcb5 fix(refresher,verifier): remove os from hmac message
• b2461e4 fix(tailscale): differentiate between insecure and https transports
• a0ff087 fix(tailscale): prevent accidental doubling of addresses array
• c6efbe2 fix(tailscale): prevent erroneous empty strings in tags
• db27082 fix(tailscale): prevent tags from being nil
• 42d4db0 fix(tailscale): prevent tailscale tags from being nil
• 75ac01a fix(terraform): add explicit dependency for generator invocation
• 4ed2960 fix(terraform): add missing generator config options
• 604b76a fix(terraform): add permissions for step functions to initializer
• d532599 fix(terraform): configure launcher state machine
• d2b67ac fix(terraform): correct cloudwatch logs permissions
• 406abc7 fix(terraform): ensure api gateway deployed after resources created
• 514d43d fix(terraform): ensure auto-update of lambda handlers
• 6f73d6e fix(terraform): ensure generator is invoked when lambda config is changed
• 008aa4a fix(terraform): ensure lambda function can write to log group
• aee1e01 fix(terraform): ensure s3 api gateway methods always create successfully
• 407870a fix(terraform): ensure state machine has correct invoke permissions
• 3e070d3 fix(terraform): prevent edge cases in state machine
• 1e35ec8 fix(terraform): remove auto-creation of iam oidc provider
• f61c1ee fix(terraform): use correct issuer url for generator
• 145dadc fix(types): support un/marshalling duration as nanos or string
• de41b98 fix(verifier): add http request timeout
• d44246e fix(verifier): correct tailscale hostname
• 3dec890 fix(verifier): wait for tailscale connection to be successful
• 1983ead refactor(api): allow customizing http client
• 801b76e refactor(api): remove unnecessary response wrapping
• ce8b76a refactor(cli): make config loading more robust for child commands
• 55160d0 refactor(cli): use custom version info
• 789dcc3 refactor(finalizer): use internal server error helper
• 0a99604 refactor(initializer): use internal server error helper
• e252103 refactor(oidc): dynamically determine claims for discovery document
• e53077b refactor(oidc): move oidc-related types into dedicated package
• 84a2029 refactor(signing): add custom claims wrapper
• 0bff4e1 refactor(tailscale): add interface for control plane api
• ce71d98 refactor(tailscale): centralize control plane client creation
• 0776187 refactor(tailscale): extract uninitialized error into variable
• 1932db1 refactor(tailscale): migrate to tailscale.com/client/local package
• f5cb4ca refactor(tailscale): standardize authentication method usage
• 8f72ce6 refactor(terraform): add name to role policy
• 42cd086 refactor(terraform): disambiguate openid configuration and openid metadata
• df2be10 refactor(terraform): handle execution role assignment within lambda module
• ba409ac refactor(terraform): move iam policy documents alongside usage
• a9d6b50 refactor(terraform): move lambda definitions to separate files
• 96db5fc refactor(verifier): attach tailnet connection to tailscale struct
• 7d28029 refactor(version): allow populating info from ldflags