feat: add workload identity federation and dual-port tsnet serve (#161)

Author: rajsinghtech

README.md

@@ -94,12 +94,42 @@ TSFlow can embed a Tailscale node and serve itself directly on your tailnet, eli
 | `TSFLOW_FUNNEL` | Expose via Tailscale Funnel | `false` |
 | `TSFLOW_STATE_DIR` | tsnet state persistence directory | `./data/tsnet-state` |
 
+##### Workload Identity Federation
+
+tsnet mode supports [workload identity federation](https://tailscale.com/kb/1236/workload-identity) as an alternative to OAuth secrets. This lets tsflow authenticate using platform identity (AWS, GCP, GitHub Actions, Azure) without managing secrets.
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `TS_CLIENT_ID` | Federated client ID | - |
+| `TS_ID_TOKEN` | ID token from identity provider | - |
+| `TS_AUDIENCE` | Audience for requesting platform tokens | - |
+
+When `TS_CLIENT_ID` is set, tsflow uses WIF instead of OAuth `ClientSecret` for the tsnet node. The platform token is auto-detected from the runtime environment. Set either `TS_ID_TOKEN` or `TS_AUDIENCE`, not both. You must also set `TSFLOW_TAGS`.
+
+> **Note:** OAuth credentials (`TAILSCALE_OAUTH_CLIENT_ID` and `TAILSCALE_OAUTH_CLIENT_SECRET`) are still required for Tailscale API access (fetching devices, network logs). WIF only replaces the tsnet node authentication secret.
+
 **Requirements:**
-- OAuth credentials (API keys are not supported in tsnet mode)
-- ACL tags must be allowed for the OAuth client to register nodes
+- OAuth credentials or workload identity federation (API keys are not supported in tsnet mode)
+- ACL tags must be allowed for the OAuth client or federated identity to register nodes
 - For Funnel, the ACL must grant funnel access to the tag
 
-**Example:**
+**tsnet mode serves on both port 80 (HTTP) and port 443 (HTTPS).**
+
+**Example with OAuth:**
+
+```bash
+docker run -d \
+  --name tsflow \
+  -v tsflow_data:/app/data \
+  -e TAILSCALE_OAUTH_CLIENT_ID=your-client-id \
+  -e TAILSCALE_OAUTH_CLIENT_SECRET=your-client-secret \
+  -e TSFLOW_SERVE=true \
+  -e TSFLOW_HOSTNAME=tsflow \
+  -e TSFLOW_TAGS=tag:tsflow \
+  ghcr.io/rajsinghtech/tsflow:latest
+```
+
+**Example with Workload Identity (GCP):**
 
 ```bash
 docker run -d \
@@ -110,10 +140,12 @@ docker run -d \
   -e TSFLOW_SERVE=true \
   -e TSFLOW_HOSTNAME=tsflow \
   -e TSFLOW_TAGS=tag:tsflow \
+  -e TS_CLIENT_ID=your-federated-client-id \
+  -e TS_AUDIENCE=your-tailnet.org \
   ghcr.io/rajsinghtech/tsflow:latest
 ```
 
-TSFlow will be accessible at `https://tsflow.<your-tailnet>.ts.net` with automatic HTTPS certificates.
+TSFlow will be accessible at both `https://tsflow.<your-tailnet>.ts.net` and `http://tsflow.<your-tailnet>.ts.net`.
 
 #### Data Storage & Polling
 

backend/internal/config/config.go

@@ -25,6 +25,10 @@ type Config struct {
 	TsnetTags     []string
 	TsnetFunnel   bool
 	TsnetStateDir string
+	// tsnet workload identity federation
+	TsnetClientID string
+	TsnetIDToken  string
+	TsnetAudience string
 }
 
 // Load loads configuration from environment variables
@@ -45,13 +49,17 @@ func Load() *Config {
 		TsnetTags:                  parseTags(os.Getenv("TSFLOW_TAGS")),
 		TsnetFunnel:                os.Getenv("TSFLOW_FUNNEL") == "true",
 		TsnetStateDir:              getEnvWithDefault("TSFLOW_STATE_DIR", filepath.Join(".", "data", "tsnet-state")),
+		TsnetClientID:              os.Getenv("TS_CLIENT_ID"),
+		TsnetIDToken:               os.Getenv("TS_ID_TOKEN"),
+		TsnetAudience:              os.Getenv("TS_AUDIENCE"),
 	}
 }
 
 // Validate validates the configuration
 func (c *Config) Validate() error {
 	hasAPIKey := c.TailscaleAPIKey != ""
 	hasOAuth := c.TailscaleOAuthClientID != "" && c.TailscaleOAuthClientSecret != ""
+	hasWIF := c.TsnetClientID != ""
 
 	if !hasAPIKey && !hasOAuth {
 		return errors.New("either TAILSCALE_API_KEY or both TAILSCALE_OAUTH_CLIENT_ID and TAILSCALE_OAUTH_CLIENT_SECRET must be provided")
@@ -61,8 +69,21 @@ func (c *Config) Validate() error {
 		log.Println("Both API key and OAuth credentials provided. OAuth will take precedence.")
 	}
 
-	if c.TsnetServe && !hasOAuth {
-		return errors.New("TSFLOW_SERVE=true requires OAuth credentials (TAILSCALE_OAUTH_CLIENT_ID and TAILSCALE_OAUTH_CLIENT_SECRET)")
+	if c.TsnetServe {
+		if !hasOAuth && !hasWIF {
+			return errors.New("TSFLOW_SERVE=true requires either OAuth credentials or workload identity federation (TS_CLIENT_ID)")
+		}
+		if hasWIF {
+			if c.TsnetIDToken == "" && c.TsnetAudience == "" {
+				return errors.New("workload identity federation requires TS_ID_TOKEN or TS_AUDIENCE")
+			}
+			if c.TsnetIDToken != "" && c.TsnetAudience != "" {
+				return errors.New("only one of TS_ID_TOKEN or TS_AUDIENCE should be set for workload identity federation")
+			}
+			if len(c.TsnetTags) == 0 {
+				return errors.New("workload identity federation requires TSFLOW_TAGS to be set")
+			}
+		}
 	}
 
 	return nil

backend/internal/tsnetserve/tsnetserve.go

@@ -12,8 +12,9 @@ import (
 )
 
 type Server struct {
-	tsServer *tsnet.Server
-	listener net.Listener
+	tsServer     *tsnet.Server
+	tlsListener  net.Listener
+	httpListener net.Listener
 }
 
 func New(ctx context.Context, cfg *config.Config) (*Server, error) {
@@ -24,43 +25,62 @@ func New(ctx context.Context, cfg *config.Config) (*Server, error) {
 	srv := &tsnet.Server{
 		Dir:           cfg.TsnetStateDir,
 		Hostname:      cfg.TsnetHostname,
-		ClientSecret:  cfg.TailscaleOAuthClientSecret,
 		Ephemeral:     true,
 		AdvertiseTags: cfg.TsnetTags,
 	}
 
+	if cfg.TsnetClientID != "" {
+		srv.ClientID = cfg.TsnetClientID
+		srv.IDToken = cfg.TsnetIDToken
+		srv.Audience = cfg.TsnetAudience
+	} else {
+		srv.ClientSecret = cfg.TailscaleOAuthClientSecret
+	}
+
 	if _, err := srv.Up(ctx); err != nil {
 		return nil, fmt.Errorf("tsnet up: %w", err)
 	}
 
-	var ln net.Listener
+	var tlsLn, httpLn net.Listener
 	var err error
+
 	if cfg.TsnetFunnel {
-		ln, err = srv.ListenFunnel("tcp", ":443")
+		tlsLn, err = srv.ListenFunnel("tcp", ":443")
 	} else {
-		ln, err = srv.ListenTLS("tcp", ":443")
+		tlsLn, err = srv.ListenTLS("tcp", ":443")
 	}
 	if err != nil {
 		srv.Close()
-		return nil, fmt.Errorf("tsnet listen: %w", err)
+		return nil, fmt.Errorf("tsnet listen TLS: %w", err)
+	}
+
+	httpLn, err = srv.Listen("tcp", ":80")
+	if err != nil {
+		tlsLn.Close()
+		srv.Close()
+		return nil, fmt.Errorf("tsnet listen HTTP: %w", err)
 	}
 
 	mode := "tailnet"
 	if cfg.TsnetFunnel {
 		mode = "funnel"
 	}
 	if domains := srv.CertDomains(); len(domains) > 0 {
-		log.Printf("tsnet: serving via %s at https://%s", mode, domains[0])
+		log.Printf("tsnet: serving via %s at https://%s (443) and http://%s (80)", mode, domains[0], domains[0])
 	}
 
-	return &Server{tsServer: srv, listener: ln}, nil
+	return &Server{tsServer: srv, tlsListener: tlsLn, httpListener: httpLn}, nil
 }
 
-func (s *Server) Listener() net.Listener { return s.listener }
+func (s *Server) TLSListener() net.Listener  { return s.tlsListener }
+func (s *Server) HTTPListener() net.Listener { return s.httpListener }
 
 func (s *Server) Close() error {
-	if s.listener != nil {
-		s.listener.Close()
+	if s.httpListener != nil {
+		s.httpListener.Close()
+	}
+	if s.tlsListener != nil {
+		s.tlsListener.Close()
 	}
 	return s.tsServer.Close()
 }

backend/main.go

@@ -248,6 +248,11 @@ func main() {
 		if len(cfg.TsnetTags) > 0 {
 			log.Printf("Tags: %v", cfg.TsnetTags)
 		}
+		if cfg.TsnetClientID != "" {
+			log.Printf("tsnet auth: workload identity federation (TS_CLIENT_ID)")
+		} else {
+			log.Printf("tsnet auth: OAuth client secret")
+		}
 		log.Printf("Funnel: %v", cfg.TsnetFunnel)
 	} else {
 		log.Printf("Server ready at http://0.0.0.0:%s", port)
@@ -266,10 +271,16 @@ func main() {
 			log.Fatalf("Failed to start tsnet server: %v", err)
 		}
 
+		tlsSrv := &http.Server{Handler: router}
 		httpSrv := &http.Server{Handler: router}
 		go func() {
-			if err := httpSrv.Serve(tsnetSrv.Listener()); err != nil && err != http.ErrServerClosed {
-				log.Fatalf("FATAL tsnet serve failed: %v", err)
+			if err := tlsSrv.Serve(tsnetSrv.TLSListener()); err != nil && err != http.ErrServerClosed {
+				log.Fatalf("FATAL tsnet TLS serve failed: %v", err)
+			}
+		}()
+		go func() {
+			if err := httpSrv.Serve(tsnetSrv.HTTPListener()); err != nil && err != http.ErrServerClosed {
+				log.Fatalf("FATAL tsnet HTTP serve failed: %v", err)
 			}
 		}()
 
@@ -278,6 +289,7 @@ func main() {
 
 		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 10*time.Second)
 		defer shutdownCancel()
+		tlsSrv.Shutdown(shutdownCtx)
 		httpSrv.Shutdown(shutdownCtx)
 		tsnetSrv.Close()
 	} else {