Allow AdvertiseTags to be passed to tsnet.Server

Signed-off-by: Chris Hoage <iam@chrishoage.com>

Author: chrishoage

README.md

@@ -47,6 +47,8 @@ go build ./cmd/caddy
 
 Multiple example configurations are provided in the [examples directory].
 These examples expect an [auth key] to be set in the `TS_AUTHKEY` environment variable.
+The [auth key] can optionally be an [oauth client secret] which will generate an [auth key] on demand.
+In order for an [oauth client secret] to generate an [auth key] the tag that was registered with the [oauth client secret] must be provided in the caddy config. The ephemeral config option will not have an effect for oauth generated tokens. The linked documentation for [oauth client secret] indicates query parameters that can be appended to the client secret to control these settings.
 All nodes registered while running these examples will be ephemeral and removed after disconnect.
 See the comments in the individual files for details.
 
@@ -114,6 +116,10 @@ Supported options are:
     # Default: false
     webui true|false
 
+    # If set these tags will be included when registering the node
+    tags tag:test
+
+
     # Any number of named node configs can be specified to override global options.
     <node_name> {
       # Tailscale auth key used to register this node.
@@ -134,6 +140,14 @@ Supported options are:
 
       # If true, run the Tailscale web UI for remotely managing this node.
       webui true|false
+
+      # If set these tags will be included when registering the node
+      # Overrides global configuration tags
+      tags tag:test
+
+      # If set this port will be used for tsnet.
+      # When unset tsnet will pick a random available port
+      port 4145
     }
   }
 }
@@ -164,6 +178,7 @@ For Caddy [JSON config], add the `tailscale` app with fields from [tscaddy.App]:
 [global option]: https://caddyserver.com/docs/caddyfile/options
 [placeholders]: https://caddyserver.com/docs/conventions#placeholders
 [auth key]: https://tailscale.com/kb/1085/auth-keys/
+[oauth client secret]: https://tailscale.com/kb/1215/oauth-clients#register-new-nodes-using-oauth-credentials
 [JSON config]: https://caddyserver.com/docs/json/
 [tscaddy.App]: https://pkg.go.dev/github.com/tailscale/caddy-tailscale#App
 

app.go

@@ -41,6 +41,9 @@ type App struct {
 	// WebUI specifies whether Tailscale nodes should run the Web UI for remote management.
 	WebUI bool `json:"webui,omitempty" caddy:"namespace=tailscale.webui"`
 
+	// Tags to apply to all nodes when registered.
+	Tags []string `json:"tags,omitempty" caddy:"namespace=tailscale.tags"`
+
 	// Nodes is a map of per-node configuration which overrides global options.
 	Nodes map[string]Node `json:"nodes,omitempty" caddy:"namespace=tailscale"`
 
@@ -63,6 +66,9 @@ type Node struct {
 	// WebUI specifies whether the node should run the Web UI for remote management.
 	WebUI opt.Bool `json:"webui,omitempty" caddy:"namespace=tailscale.webui"`
 
+	// Tags to apply to the node when registered. Overrides global tags.
+	Tags []string `json:"tags,omitempty" caddy:"namespace=tailscale.tags"`
+
 	// Hostname is the hostname to use when registering the node.
 	Hostname string `json:"hostname,omitempty" caddy:"namespace=tailscale.hostname"`
 
@@ -142,6 +148,8 @@ func parseAppConfig(d *caddyfile.Dispenser, _ any) (any, error) {
 			} else {
 				app.WebUI = true
 			}
+		case "tags":
+			app.Tags = d.RemainingArgs()
 		default:
 			node, err := parseNodeConfig(d)
 			if app.Nodes == nil {
@@ -223,6 +231,8 @@ func parseNodeConfig(d *caddyfile.Dispenser) (Node, error) {
 			} else {
 				node.WebUI = opt.NewBool(true)
 			}
+		case "tags":
+			node.Tags = segment.RemainingArgs()
 		default:
 			return node, segment.Errf("unrecognized subdirective: %s", segment.Val())
 		}

module.go

@@ -272,9 +272,10 @@ func getNode(ctx caddy.Context, name string) (*tailscaleNode, error) {
 			UserLogf: func(format string, args ...any) {
 				app.logger.Sugar().Infof(format, args...)
 			},
-			Ephemeral:    getEphemeral(name, app),
-			RunWebClient: getWebUI(name, app),
-			Port:         getPort(name, app),
+			Ephemeral:     getEphemeral(name, app),
+			RunWebClient:  getWebUI(name, app),
+			Port:          getPort(name, app),
+			AdvertiseTags: getTags(name, app),
 		}
 
 		if s.AuthKey, err = getAuthKey(name, app); err != nil {
@@ -401,6 +402,15 @@ func getWebUI(name string, app *App) bool {
 	return app.WebUI
 }
 
+func getTags(name string, app *App) []string {
+	if node, ok := app.Nodes[name]; ok {
+		if node.Tags != nil {
+			return node.Tags
+		}
+	}
+	return app.Tags
+}
+
 // tailscaleNode is a wrapper around a tsnet.Server that provides a fully self-contained Tailscale node.
 // This node can listen on the tailscale network interface, or be used to connect to other nodes in the tailnet.
 type tailscaleNode struct {

module_test.go

@@ -333,6 +333,98 @@ func Test_GetWebUI(t *testing.T) {
 	}
 }
 
+func Test_GetTags(t *testing.T) {
+	tests := map[string]struct {
+		appTags  []string
+		nodeTags []string
+		want     []string
+	}{
+		"no tags": {
+			appTags:  nil,
+			nodeTags: nil,
+			want:     nil,
+		},
+		"app-level tags only": {
+			appTags:  []string{"tag:test1", "tag:test2"},
+			nodeTags: nil,
+			want:     []string{"tag:test1", "tag:test2"},
+		},
+		"node-level tags override app tags": {
+			appTags:  []string{"tag:app1", "tag:app2"},
+			nodeTags: []string{"tag:node1", "tag:node2"},
+			want:     []string{"tag:node1", "tag:node2"},
+		},
+		"empty node tags override app tags": {
+			appTags:  []string{"tag:app1", "tag:app2"},
+			nodeTags: []string{},
+			want:     []string{},
+		},
+		"single tag": {
+			appTags:  []string{"tag:production"},
+			nodeTags: nil,
+			want:     []string{"tag:production"},
+		},
+		"multiple node tags": {
+			appTags:  nil,
+			nodeTags: []string{"tag:web", "tag:frontend", "tag:production"},
+			want:     []string{"tag:web", "tag:frontend", "tag:production"},
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			app := &App{
+				Tags:  tt.appTags,
+				Nodes: make(map[string]Node),
+			}
+			if tt.nodeTags != nil {
+				app.Nodes["testnode"] = Node{
+					Tags: tt.nodeTags,
+				}
+			}
+			if err := app.Provision(caddy.Context{}); err != nil {
+				t.Fatal(err)
+			}
+
+			got := getTags("testnode", app)
+			if len(got) != len(tt.want) {
+				t.Errorf("getTags() = %v, want %v", got, tt.want)
+				return
+			}
+			for i := range got {
+				if got[i] != tt.want[i] {
+					t.Errorf("getTags() = %v, want %v", got, tt.want)
+					return
+				}
+			}
+		})
+	}
+
+	// Test node without config gets app-level tags
+	t.Run("node without config uses app tags", func(t *testing.T) {
+		app := &App{
+			Tags:  []string{"tag:default1", "tag:default2"},
+			Nodes: make(map[string]Node),
+		}
+		if err := app.Provision(caddy.Context{}); err != nil {
+			t.Fatal(err)
+		}
+
+		got := getTags("unconfigured-node", app)
+		want := []string{"tag:default1", "tag:default2"}
+		if len(got) != len(want) {
+			t.Errorf("getTags() = %v, want %v", got, want)
+			return
+		}
+		for i := range got {
+			if got[i] != want[i] {
+				t.Errorf("getTags() = %v, want %v", got, want)
+				return
+			}
+		}
+	})
+}
+
 func Test_Listen(t *testing.T) {
 	must.Do(caddy.Run(new(caddy.Config)))
 	ctx := caddy.ActiveContext()