juanfont/headscale v0.27.2-rc.1

on GitHub

Changes

• Fix ACL policy not applied to new OIDC nodes until client restart
  #2890
• Fix autogroup:self preventing visibility of nodes matched by other ACL rules
  #2882
• Fix nodes being rejected after pre-authentication key expiration
  #2917

Upgrade

Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.

It's best to update from one stable version to the next (e.g., 0.24.0 → 0.25.1 → 0.26.1) in case you are multiple releases behind. You should always pick the latest available patch release.

Be sure to check the changelog above for version-specific upgrade instructions and breaking changes.

Backup Your Database

Always backup your database before upgrading. Here's how to backup a SQLite database:

# Stop headscale
systemctl stop headscale

# Backup sqlite database
cp /var/lib/headscale/db.sqlite /var/lib/headscale/db.sqlite.backup

# Backup sqlite WAL/SHM files (if they exist)
cp /var/lib/headscale/db.sqlite-wal /var/lib/headscale/db.sqlite-wal.backup
cp /var/lib/headscale/db.sqlite-shm /var/lib/headscale/db.sqlite-shm.backup

# Start headscale (migration will run automatically)
systemctl start headscale

Changelog

• 7f1631c auth: ensure machines are allowed in when pak change (#2917)
• c6d399a changelog: prep for 0.27.2 rc
• 7e8cee6 chore: fix filterHash to work with autogroup:self in the acls (#2882)
• 4fe5cbe hscontrol/oidc: fix ACL policy not applied to new OIDC nodes (#2890)