simon511000/homelab
1
0
Fork 0
Code Issues 1 Pull requests 10 Projects Releases Packages Wiki Activity Actions

Update ghcr.io/tale/headplane Docker tag to v0.7.1 #3

Open
renovate-bot wants to merge 1 commit from renovate/ghcr.io-tale-headplane-0.x into main
pull from: renovate/ghcr.io-tale-headplane-0.x
merge into: simon511000:main
Conversation 0 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-06-15 12:33:56 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Update Change
ghcr.io/tale/headplane minor 0.6.1 → 0.7.1

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

tale/headplane (ghcr.io/tale/headplane)

v0.7.1

Compare Source

Changes

  • Rebuilt the Browser SSH module to use Tailscale's tsconnect, which should result in fewer bugs and better compatibility with future Tailscale releases.
  • Added integration.agent.tailscale_netns, an agent-only opt-out from Tailscale's routing-loop socket handling for deployments where its fallback pins the agent's Headscale connection to the wrong interface. Existing behavior remains enabled by default.
  • Added a Disable/Enable key expiry action to the machine menu (via #​554). Headscale does not keep the toggle state apart from the expiry date, so re-enabling expiry marks the node expired as of that moment.
  • Headplane now supports Docker API version 1.24+ (Engine 1.12+, including Podman's Docker-compatible socket).
  • Usernames are now validated before a user is created or renamed, so Headplane rejects names that Headscale accepts but ACL policy can never match (closes #​502).

Fixes

  • Fixed untagged Headscale builds being read as version 0.0.0. The per-commit main-* and development images report a Go pseudo-version from /version, which is now treated as an unknown version instead of an ancient one (via #​590).
  • Fixed the Browser SSH WASM module not building under Nix (via #​588).
  • Fixed server.data_path, headscale.config_path, headscale.dns_records_path and headscale.tls_cert_path being silently lowercased, which pointed Headplane at a different location for any path containing a capital letter (closes #​612).
  • Fixed the Headplane agent falling back to an interactive Tailscale login. The agent now starts with a pre-auth-key, preserves its existing state across restarts, and auto-approves itself when Headscale requires manual approval (closes #​582).
  • Fixed creating pre-auth keys with an expiry of 1000 days or more. The number input submitted its locale-formatted value (365,000, 365 000, 365.000), which either failed with a 500 or silently created a key with a truncated expiry. The raw value is now submitted and the server rejects malformed expiries with a 400 (closes #​596).

v0.7.0

Compare Source

  • Switched to structured JSON logging (closes #​279).
  • Added suggestions to pick existing tags to the machine tag dialog (closes #​560).
  • Headplane correctly handles dns.extra_records_path from the Headscale configuration (closes #​543).
  • Fixed Headscale PostgreSQL config validation so pass is not required when password_file is supplied (closes #​528).
  • Fixed Browser SSH's WASM DERP probe to account for custom DERP ports (closes #​552).
  • Fixed Browser SSH pre-auth key handling by increasing the temporary key expiry window and showing key creation errors in the UI (closes #​565).
  • Fixed machine rename submission by validating names before sending the rename request (closes #​564).
  • Fixed OIDC token exchange fallback when retrying with client_secret_basic (closes #​493).
  • Added support for proxy authentication via server.proxy_auth (closes #​353).
  • Added automatic role assignment for new OIDC users via oidc.default_role and IdP-provided role claims via oidc.role_claim (closes #​352).
  • Fixed the DNS page crashing when Headscale has no Split DNS nameservers configured (closes #​570).
  • User lists now show Headscale display names while preserving usernames as secondary text (closes #​571).
  • Fixed the Register Machine Key dialog so it accepts registration URLs and full hskey-authreq-... registration keys (closes #​579).
  • Fixed assigning ACL tags to tag-only (no-user) nodes from the UI. The "Add" and "Remove" tag buttons in the tag dialog lacked type="button", so clicking them submitted the form before the local state update was applied and Headscale received the unchanged tag list. Tag modifications now reach Headscale as intended (closes #​574).

v0.6.3

Compare Source

  • Fixed GHSA-vgj6-hcf2-fqf6, a path traversal / RBAC bypass in Headscale node and user rename API calls.

v0.6.2

Compare Source

  • Added support for Headscale 0.28.0 including all API and data model changes.
  • Added search and sortable columns to the machines list page (closes #​351).
  • Added support for Headscale 0.27.0 and 0.27.1
  • Bundle all node_modules aside from native ones to reduce bundle and container size (closes #​331).
  • Allow conditionally compiling the SSH WASM integration when building (closes #​337).
  • Implemented the ability to customize the build with a custom script (see ./build.sh --help for more information).
  • Attempt to warn against misconfigured cookie settings on the login page.
  • Made server.cookie_max_age and server.cookie_domain configurable (closes #​348).
  • Re-worked the configuration loading system with several enhancements:
    • It is now possible to skip a configuration file and only use environment variables (closes #​150).
    • Secret path loading has been reworked from the ground up to be more reliable (closes #​334).
    • Added better testing and validation for configuration loading
  • Re-worked the OIDC integration to adhere to the correct standards and surface more errors to the user.
    • Deprecated oidc.redirect_uri and automated callback URL detection in favor of setting server.base_url correctly.
    • Explicitly added oidc.use_pkce to correctly determine PKCE configuration.
    • oidc.token_endpoint_auth_method is now optional and will attempt to be auto-detected, defaulting to client_secret_basic if unavailable (closes #​410).
    • Added oidc.enabled config option to explicitly control OIDC availability (via #​463).
  • Removed several unnecessarily verbose or spammy log messages.
  • Updated the minimum Docker API used to support the latest Docker versions (via #​370).
  • Enhanced the node tag dialog to show a dropdown of assignable tags (via #​362).
  • Fixed an issue where the website favicon would not load correctly (closes #​323).
  • Correctly handle invalid ACL policy inserts on Headscale 0.27+ (closes #​383).
  • Prevent a machine from changing its owner to itself (closes #​373).
  • Added an /admin/api/info route that can expose sensitive information if server.info_secret is set in the configuration (closes #​324).
  • Correctly apply Gravatar profile pictures on the user page if applicable (closes #​405).
  • Machine key registration no longer works if the key isn't 24 characters long (closes #​415).
  • Fixed some mobile CSS issues across the application (closes #​401).
  • Added a Docker healthcheck to the container (closes #​411).
  • Strengthened the validation for the /proc integration to correctly discover the Headscale PID.
  • Added lazy retry logic for OIDC providers if they initially fail to respond (closes #​423).
  • Fixed API key login on Headscale 0.28.0-beta.1+ (closes #​429).
  • Fixed an issue that prevented the pre-auth-key UI from being usable on Headscale 0.28 and later.
  • Added support for creating tag-only pre-auth keys on Headscale 0.28+ (via #​465).
  • Pre-auth keys are now listed without a user filter on Headscale 0.28+, with a fallback to per-user fetching on older versions (via #​466).
  • Fixed handling of tag-only nodes that have no user on Headscale 0.28+ (via #​467).
  • Adapted to the removal of Node Ownership Change in Headscale 0.28 (via #​436).
  • Fixed pre-auth keys not showing for OIDC users without a username (via #​470).
  • Fixed truncated pre-auth key display with longer Headscale 0.28 bcrypt tokens (closes #​435).
  • Fixed Nix systemd service to use user-specified package (via #​454).
  • Version displayed in the UI is now derived from git tags and build args instead of package.json, fixing incorrect versions shown on beta and nightly builds.
  • Improved the no-access user page on the UI (via #​469).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/tale/headplane](https://github.com/tale/headplane) | minor | `0.6.1` → `0.7.1` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>tale/headplane (ghcr.io/tale/headplane)</summary> ### [`v0.7.1`](https://github.com/tale/headplane/blob/HEAD/CHANGELOG.md#071-August-27-2026) [Compare Source](https://github.com/tale/headplane/compare/v0.7.0...v0.7.1) #### Changes - **Rebuilt the Browser SSH module to use Tailscale's `tsconnect`**, which should result in fewer bugs and better compatibility with future Tailscale releases. - Added `integration.agent.tailscale_netns`, an agent-only opt-out from Tailscale's routing-loop socket handling for deployments where its fallback pins the agent's Headscale connection to the wrong interface. Existing behavior remains enabled by default. - Added a Disable/Enable key expiry action to the machine menu (via [#&#8203;554](https://github.com/tale/headplane/pull/554)). Headscale does not keep the toggle state apart from the expiry date, so re-enabling expiry marks the node expired as of that moment. - Headplane now supports Docker API version 1.24+ (Engine 1.12+, including Podman's Docker-compatible socket). - Usernames are now validated before a user is created or renamed, so Headplane rejects names that Headscale accepts but ACL policy can never match (closes [#&#8203;502](https://github.com/tale/headplane/issues/502)). #### Fixes - Fixed untagged Headscale builds being read as version 0.0.0. The per-commit `main-*` and `development` images report a Go pseudo-version from `/version`, which is now treated as an unknown version instead of an ancient one (via [#&#8203;590](https://github.com/tale/headplane/pull/590)). - Fixed the Browser SSH WASM module not building under Nix (via [#&#8203;588](https://github.com/tale/headplane/pull/588)). - Fixed `server.data_path`, `headscale.config_path`, `headscale.dns_records_path` and `headscale.tls_cert_path` being silently lowercased, which pointed Headplane at a different location for any path containing a capital letter (closes [#&#8203;612](https://github.com/tale/headplane/issues/612)). - Fixed the Headplane agent falling back to an interactive Tailscale login. The agent now starts with a pre-auth-key, preserves its existing state across restarts, and auto-approves itself when Headscale requires manual approval (closes [#&#8203;582](https://github.com/tale/headplane/issues/582)). - Fixed creating pre-auth keys with an expiry of 1000 days or more. The number input submitted its locale-formatted value (`365,000`, `365 000`, `365.000`), which either failed with a 500 or silently created a key with a truncated expiry. The raw value is now submitted and the server rejects malformed expiries with a 400 (closes [#&#8203;596](https://github.com/tale/headplane/issues/596)). *** ### [`v0.7.0`](https://github.com/tale/headplane/blob/HEAD/CHANGELOG.md#070) [Compare Source](https://github.com/tale/headplane/compare/v0.6.3...v0.7.0) - Switched to structured JSON logging (closes [#&#8203;279](https://github.com/tale/headplane/issues/279)). - Added suggestions to pick existing tags to the machine tag dialog (closes [#&#8203;560](https://github.com/tale/headplane/issues/560)). - Headplane correctly handles `dns.extra_records_path` from the Headscale configuration (closes [#&#8203;543](https://github.com/tale/headplane/issues/543)). - Fixed Headscale PostgreSQL config validation so `pass` is not required when `password_file` is supplied (closes [#&#8203;528](https://github.com/tale/headplane/issues/528)). - Fixed Browser SSH's WASM DERP probe to account for custom DERP ports (closes [#&#8203;552](https://github.com/tale/headplane/issues/552)). - Fixed Browser SSH pre-auth key handling by increasing the temporary key expiry window and showing key creation errors in the UI (closes [#&#8203;565](https://github.com/tale/headplane/issues/565)). - Fixed machine rename submission by validating names before sending the rename request (closes [#&#8203;564](https://github.com/tale/headplane/issues/564)). - Fixed OIDC token exchange fallback when retrying with `client_secret_basic` (closes [#&#8203;493](https://github.com/tale/headplane/issues/493)). - Added support for proxy authentication via `server.proxy_auth` (closes [#&#8203;353](https://github.com/tale/headplane/issues/353)). - Added automatic role assignment for new OIDC users via `oidc.default_role` and IdP-provided role claims via `oidc.role_claim` (closes [#&#8203;352](https://github.com/tale/headplane/issues/352)). - Fixed the DNS page crashing when Headscale has no Split DNS nameservers configured (closes [#&#8203;570](https://github.com/tale/headplane/issues/570)). - User lists now show Headscale display names while preserving usernames as secondary text (closes [#&#8203;571](https://github.com/tale/headplane/issues/571)). - Fixed the Register Machine Key dialog so it accepts registration URLs and full `hskey-authreq-...` registration keys (closes [#&#8203;579](https://github.com/tale/headplane/issues/579)). - Fixed assigning ACL tags to tag-only (no-user) nodes from the UI. The "Add" and "Remove" tag buttons in the tag dialog lacked `type="button"`, so clicking them submitted the form before the local state update was applied and Headscale received the unchanged tag list. Tag modifications now reach Headscale as intended (closes [#&#8203;574](https://github.com/tale/headplane/issues/574)). *** ### [`v0.6.3`](https://github.com/tale/headplane/blob/HEAD/CHANGELOG.md#063-May-14-2026) [Compare Source](https://github.com/tale/headplane/compare/v0.6.2...v0.6.3) - Fixed GHSA-vgj6-hcf2-fqf6, a path traversal / RBAC bypass in Headscale node and user rename API calls. *** ### [`v0.6.2`](https://github.com/tale/headplane/blob/HEAD/CHANGELOG.md#062-February-26-2026) [Compare Source](https://github.com/tale/headplane/compare/v0.6.1...v0.6.2) - **Added support for Headscale 0.28.0** including all API and data model changes. - Added search and sortable columns to the machines list page (closes [#&#8203;351](https://github.com/tale/headplane/issues/351)). - Added support for Headscale 0.27.0 and 0.27.1 - Bundle all `node_modules` aside from native ones to reduce bundle and container size (closes [#&#8203;331](https://github.com/tale/headplane/issues/331)). - Allow conditionally compiling the SSH WASM integration when building (closes [#&#8203;337](https://github.com/tale/headplane/issues/337)). - Implemented the ability to customize the build with a custom script (see `./build.sh --help` for more information). - Attempt to warn against misconfigured cookie settings on the login page. - Made `server.cookie_max_age` and `server.cookie_domain` configurable (closes [#&#8203;348](https://github.com/tale/headplane/issues/348)). - Re-worked the configuration loading system with several enhancements: - It is now possible to skip a configuration file and only use environment variables (closes [#&#8203;150](https://github.com/tale/headplane/issues/150)). - Secret path loading has been reworked from the ground up to be more reliable (closes [#&#8203;334](https://github.com/tale/headplane/issues/334)). - Added better testing and validation for configuration loading - Re-worked the OIDC integration to adhere to the correct standards and surface more errors to the user. - Deprecated `oidc.redirect_uri` and automated callback URL detection in favor of setting `server.base_url` correctly. - Explicitly added `oidc.use_pkce` to correctly determine PKCE configuration. - `oidc.token_endpoint_auth_method` is now optional and will attempt to be auto-detected, defaulting to `client_secret_basic` if unavailable (closes [#&#8203;410](https://github.com/tale/headplane/issues/410)). - Added `oidc.enabled` config option to explicitly control OIDC availability (via [#&#8203;463](https://github.com/tale/headplane/pull/463)). - Removed several unnecessarily verbose or spammy log messages. - Updated the minimum Docker API used to support the latest Docker versions (via [#&#8203;370](https://github.com/tale/headplane/pull/370)). - Enhanced the node tag dialog to show a dropdown of assignable tags (via [#&#8203;362](https://github.com/tale/headplane/pull/362)). - Fixed an issue where the website favicon would not load correctly (closes [#&#8203;323](https://github.com/tale/headplane/issues/323)). - Correctly handle invalid ACL policy inserts on Headscale 0.27+ (closes [#&#8203;383](https://github.com/tale/headplane/issues/383)). - Prevent a machine from changing its owner to itself (closes [#&#8203;373](https://github.com/tale/headplane/issues/373)). - Added an `/admin/api/info` route that can expose sensitive information if `server.info_secret` is set in the configuration (closes [#&#8203;324](https://github.com/tale/headplane/issues/324)). - Correctly apply Gravatar profile pictures on the user page if applicable (closes [#&#8203;405](https://github.com/tale/headplane/issues/405)). - Machine key registration no longer works if the key isn't 24 characters long (closes [#&#8203;415](https://github.com/tale/headplane/issues/415)). - Fixed some mobile CSS issues across the application (closes [#&#8203;401](https://github.com/tale/headplane/issues/401)). - Added a Docker healthcheck to the container (closes [#&#8203;411](https://github.com/tale/headplane/issues/411)). - Strengthened the validation for the `/proc` integration to correctly discover the Headscale PID. - Added lazy retry logic for OIDC providers if they initially fail to respond (closes [#&#8203;423](https://github.com/tale/headplane/issues/423)). - Fixed API key login on Headscale 0.28.0-beta.1+ (closes [#&#8203;429](https://github.com/tale/headplane/issues/429)). - Fixed an issue that prevented the pre-auth-key UI from being usable on Headscale 0.28 and later. - Added support for creating tag-only pre-auth keys on Headscale 0.28+ (via [#&#8203;465](https://github.com/tale/headplane/pull/465)). - Pre-auth keys are now listed without a user filter on Headscale 0.28+, with a fallback to per-user fetching on older versions (via [#&#8203;466](https://github.com/tale/headplane/pull/466)). - Fixed handling of tag-only nodes that have no user on Headscale 0.28+ (via [#&#8203;467](https://github.com/tale/headplane/pull/467)). - Adapted to the removal of Node Ownership Change in Headscale 0.28 (via [#&#8203;436](https://github.com/tale/headplane/pull/436)). - Fixed pre-auth keys not showing for OIDC users without a username (via [#&#8203;470](https://github.com/tale/headplane/pull/470)). - Fixed truncated pre-auth key display with longer Headscale 0.28 bcrypt tokens (closes [#&#8203;435](https://github.com/tale/headplane/issues/435)). - Fixed Nix systemd service to use user-specified package (via [#&#8203;454](https://github.com/tale/headplane/pull/454)). - Version displayed in the UI is now derived from git tags and build args instead of `package.json`, fixing incorrect versions shown on beta and nightly builds. - Improved the no-access user page on the UI (via [#&#8203;469](https://github.com/tale/headplane/pull/469)). *** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIyNC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->
renovate-bot force-pushed renovate/ghcr.io-tale-headplane-0.x from 977f69ad6f to 9e6739fac6 2026-06-15 14:18:39 +02:00 Compare
renovate-bot changed title from Update ghcr.io/tale/headplane Docker tag to v0.6.3 to Update ghcr.io/tale/headplane Docker tag to v0.7.0 2026-07-05 14:02:56 +02:00
renovate-bot force-pushed renovate/ghcr.io-tale-headplane-0.x from 9e6739fac6 to fe1e4c01a9 2026-07-05 14:02:56 +02:00 Compare
renovate-bot force-pushed renovate/ghcr.io-tale-headplane-0.x from fe1e4c01a9 to d975887d90 2026-08-28 14:01:55 +02:00 Compare
renovate-bot changed title from Update ghcr.io/tale/headplane Docker tag to v0.7.0 to Update ghcr.io/tale/headplane Docker tag to v0.7.1 2026-08-28 14:01:56 +02:00
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/ghcr.io-tale-headplane-0.x:renovate/ghcr.io-tale-headplane-0.x
git switch renovate/ghcr.io-tale-headplane-0.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/ghcr.io-tale-headplane-0.x
git switch renovate/ghcr.io-tale-headplane-0.x
git rebase main
git switch main
git merge --ff-only renovate/ghcr.io-tale-headplane-0.x
git switch renovate/ghcr.io-tale-headplane-0.x
git rebase main
git switch main
git merge --no-ff renovate/ghcr.io-tale-headplane-0.x
git switch main
git merge --squash renovate/ghcr.io-tale-headplane-0.x
git switch main
git merge --ff-only renovate/ghcr.io-tale-headplane-0.x
git switch main
git merge renovate/ghcr.io-tale-headplane-0.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
simon511000
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
simon511000/homelab!3
No description provided.