opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: wire DERPTLSConfig through CLI, SDK, tailnet, VPN, agent, and health checks (#24435)

Browse Source 
Wire DERPTLSConfig through the CLI, SDK, tailnet, VPN client, agent, and
health checks to allow custom TLS configuration for DERP connections.
The main use case is to be able to set a custom CA and also present
client certs (mTLS). See https://github.com/coder/tailscale/pull/105 for
related changes.

Adds three new global CLI flags:
- `--client-tls-ca-file` / `CODER_CLIENT_TLS_CA_FILE`
- `--client-tls-cert-file` / `CODER_CLIENT_TLS_CERT_FILE`
- `--client-tls-key-file` / `CODER_CLIENT_TLS_KEY_FILE`

Based on community PR #22695 by @ibdafna, with autogeneration issues
fixed (protobuf version mismatches in .pb.go files, golden file
regeneration, lint fixes).

> [!NOTE]
> This PR was authored by Coder Agents on behalf of a Coder team member.

<details>
<summary>Relationship to #22695</summary>

This is a clean reimplementation of the changes from #22695 on top of
current `main`, with the following differences:
- **Removed**: Accidental protobuf version changes in `.pb.go` files
(contributor had `protoc v6.33.4` vs project's `protoc v4.23.4`)
- **Added**: Properly regenerated golden files and docs via `make gen`
- **Fixed**: Lint issue (`var-declaration` revive warning on explicit
type in `createHTTPClient`)
- All meaningful code changes are identical to the original PR
</details>
This commit is contained in:
Spike Curtis
2026-04-16 12:46:52 -04:00
committed by GitHub
parent 7270e01390
commit 4c1a32cd7c
12 changed files with 296 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/healthcheck/derphealth/derp.go
+16 -3
View File
@@ -2,6 +2,7 @@ package derphealth
import (
"context"
"crypto/tls"
"fmt"
"net"
"net/netip"
@@ -40,19 +41,24 @@ type ReportOptions struct {
Dismissed bool
DERPMap *tailcfg.DERPMap
// DERPTLSConfig is an optional TLS config for DERP connections.
DERPTLSConfig *tls.Config
}
type Report healthsdk.DERPHealthReport
type RegionReport struct {
healthsdk.DERPRegionReport
mu sync.Mutex
mu sync.Mutex
derpTLSConfig *tls.Config
}
type NodeReport struct {
healthsdk.DERPNodeReport
mu sync.Mutex
clientCounter int
derpTLSConfig *tls.Config
}
func (r *Report) Run(ctx context.Context, opts *ReportOptions) {
@@ -74,6 +80,7 @@ func (r *Report) Run(ctx context.Context, opts *ReportOptions) {
DERPRegionReport: healthsdk.DERPRegionReport{
Region: region,
},
derpTLSConfig: opts.DERPTLSConfig,
}
)
go func() {
@@ -103,8 +110,9 @@ func (r *Report) Run(ctx context.Context, opts *ReportOptions) {
mu.Unlock()
}
nc := &netcheck.Client{
PortMapper: portmapper.NewClient(tslogger.WithPrefix(ncLogf, "portmap: "), nil, nil, nil),
Logf: tslogger.WithPrefix(ncLogf, "netcheck: "),
PortMapper: portmapper.NewClient(tslogger.WithPrefix(ncLogf, "portmap: "), nil, nil, nil),
Logf: tslogger.WithPrefix(ncLogf, "netcheck: "),
DERPTLSConfig: opts.DERPTLSConfig,
}
ncReport, netcheckErr := nc.GetReport(ctx, opts.DERPMap)
r.Netcheck = ncReport
@@ -159,6 +167,7 @@ func (r *RegionReport) Run(ctx context.Context) {
Healthy: true,
Node: node,
},
derpTLSConfig: r.derpTLSConfig,
}
)
@@ -476,6 +485,10 @@ func (r *NodeReport) derpClient(ctx context.Context, derpURL *url.URL) (*derphtt
return nil, id, err
}
if r.derpTLSConfig != nil {
client.TLSConfig = r.derpTLSConfig
}
go func() {
<-ctx.Done()
_ = client.Close()