Support for SSH check mode in ACLs

[almereyda]

Why

Tailscale upstream supports SSH check mode.

We would like to use it with Headscale, too.

Description

When defining an Tailscale SSH ACL policy with the action set to check, an additional authentication against the OIDC endpoint is required, which grants access within an optional checkPeriod, defaulting to 12 hours and allowing to be set to always.

References

• Configure Tailscale SSH with check · Tailscale SSH · Tailscale Docs

This is related to, but not identical to:

• Unable to ssh with tailscale #1303, where a user tried to use check mode
• Add support for web client check mode #1623, where upstream reports about the availability of a web check mode in the Tailscale client, currently restricted to the upstream control plane.