From 8c6c75e2ffc3158dbf9a1a564134fe05c98c7256 Mon Sep 17 00:00:00 2001 From: Ed Geraghty Date: Mon, 8 Jun 2026 10:53:30 +0100 Subject: [PATCH 1/3] Allow captive portal handling --- templates/Caddyfile-http.template | 5 +++++ templates/Caddyfile-https.template | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/templates/Caddyfile-http.template b/templates/Caddyfile-http.template index 06d7f42..f868fce 100644 --- a/templates/Caddyfile-http.template +++ b/templates/Caddyfile-http.template @@ -7,6 +7,11 @@ } :8008 { + # Tailscale captive portal detection + handle /generate_204 { + respond 204 + } + redir /admin /admin/ handle /admin/* { diff --git a/templates/Caddyfile-https.template b/templates/Caddyfile-https.template index bec0201..06888fe 100644 --- a/templates/Caddyfile-https.template +++ b/templates/Caddyfile-https.template @@ -10,6 +10,11 @@ } ${PUBLIC_SERVER_URL}:${PUBLIC_LISTEN_PORT} { + # Tailscale captive portal detection + handle /generate_204 { + respond 204 + } + redir /admin /admin/ handle /admin/* { From 2ec962ed8dfee72c96639757994543df1637d197 Mon Sep 17 00:00:00 2001 From: Ed Geraghty Date: Mon, 8 Jun 2026 10:54:07 +0100 Subject: [PATCH 2/3] Add headscale trusted proxy as localhost v4/v6 --- templates/headscale.template.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/templates/headscale.template.yaml b/templates/headscale.template.yaml index cab2b3b..39c186a 100644 --- a/templates/headscale.template.yaml +++ b/templates/headscale.template.yaml @@ -38,6 +38,15 @@ grpc_listen_addr: 127.0.0.1:50443 # are doing. grpc_allow_insecure: false +# CIDR(s) of reverse proxies (e.g. 127.0.0.1/32) whose +# True-Client-IP, X-Real-IP and X-Forwarded-For headers should +# be honoured. Empty (default) ignores those headers; setting +# this without a proxy in front lets clients spoof their logged +# source IP. +trusted_proxies: + - 127.0.0.1/32 + - ::1/128 + # The Noise section includes specific configuration for the # TS2021 Noise protocol noise: From 3787330b94fbd4aeb2c94957dde48ae968f462bf Mon Sep 17 00:00:00 2001 From: Ed Geraghty Date: Mon, 8 Jun 2026 12:33:42 +0100 Subject: [PATCH 3/3] Fix comment to match reality I took this comment wholesale from upstream, but hardcoded localhost at the same time... Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- templates/headscale.template.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/templates/headscale.template.yaml b/templates/headscale.template.yaml index 39c186a..0b360e8 100644 --- a/templates/headscale.template.yaml +++ b/templates/headscale.template.yaml @@ -40,9 +40,9 @@ grpc_allow_insecure: false # CIDR(s) of reverse proxies (e.g. 127.0.0.1/32) whose # True-Client-IP, X-Real-IP and X-Forwarded-For headers should -# be honoured. Empty (default) ignores those headers; setting -# this without a proxy in front lets clients spoof their logged -# source IP. +# be honoured. This template trusts loopback by default (for the bundled Caddy); +# set to [] to disable, or replace with your proxy CIDRs. Setting this +# without a proxy in front lets clients spoof their logged source IP. trusted_proxies: - 127.0.0.1/32 - ::1/128