mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-20 04:22:12 -04:00
a6ab7efa4f
The Tailscale daemon only refreshed TLS certs as a side effect of inbound TLS handshakes or "tailscale cert" CLI calls. A node that doesn't see inbound traffic during the renewal window silently rolls past expiry. Add a once-per-hour background loop on LocalBackend that enumerates Serve and Funnel HTTPS hostnames (filtered against the netmap's CertDomains so we don't poke ACME for other nodes' service hostnames) and calls the existing GetCertPEM path. The renewal decision (ARI window, then 2/3 expiry fallback) is unchanged; the loop just guarantees it runs. For visibility during initial issuance or restart with a long-expired cached cert, add a "tls-cert-pending" health Warnable that's set while ACME is in flight and no usable cached cert exists. Async renewal of a still-valid cert intentionally doesn't fire it. And then make the CLI "cert" subcommand print out a warning if it's blocking due to a cert fetch in flight, using that health info. Fixes #19911 Fixes #19912 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I144e46c40e957b2e879587decace32a523a6eade
44 lines
1.9 KiB
Go
44 lines
1.9 KiB
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package health
|
|
|
|
// Arg is a type for the key to be used in the Args of a Warnable.
|
|
type Arg string
|
|
|
|
const (
|
|
// ArgAvailableVersion provides an update notification Warnable with the available version of the Tailscale client.
|
|
ArgAvailableVersion Arg = "available-version"
|
|
|
|
// ArgCurrentVersion provides an update notification Warnable with the current version of the Tailscale client.
|
|
ArgCurrentVersion Arg = "current-version"
|
|
|
|
// ArgDuration provides a Warnable with how long the Warnable has been in an unhealthy state.
|
|
ArgDuration Arg = "duration"
|
|
|
|
// ArgError provides a Warnable with the underlying error behind an unhealthy state.
|
|
ArgError Arg = "error"
|
|
|
|
// ArgMagicsockFunctionName provides a Warnable with the name of the Magicsock function that caused the unhealthy state.
|
|
ArgMagicsockFunctionName Arg = "magicsock-function-name"
|
|
|
|
// ArgDERPRegionID provides a Warnable with the ID of a DERP server involved in the unhealthy state.
|
|
ArgDERPRegionID Arg = "derp-region-id"
|
|
|
|
// ArgDERPRegionName provides a Warnable with the name of a DERP server involved in the unhealthy state.
|
|
// It is used to show a more friendly message like "the Seattle relay server failed to connect" versus
|
|
// "relay server 10 failed to connect".
|
|
ArgDERPRegionName Arg = "derp-region-name"
|
|
|
|
// ArgServerName provides a Warnable with the hostname of a server involved in the unhealthy state.
|
|
ArgServerName Arg = "server-name"
|
|
|
|
// ArgServerName provides a Warnable with comma delimited list of the hostname of the servers involved in the unhealthy state.
|
|
// If no nameservers were available to query, this will be an empty string.
|
|
ArgDNSServers Arg = "dns-servers"
|
|
|
|
// ArgDomains provides a Warnable with a comma-delimited list of domain
|
|
// names involved in the unhealthy state.
|
|
ArgDomains Arg = "domains"
|
|
)
|