From 25f20037e9b255d66286f8b34fe4e268e30b942f Mon Sep 17 00:00:00 2001 From: William Gill Date: Fri, 12 Jun 2026 15:55:06 -0500 Subject: [PATCH] feat(headscale): pin OIDC PKCE to S256 explicitly Make pkce.method: S256 explicit in config.yaml (alongside pkce.enabled: true) and note the pocket-id client must have PKCE enabled too. Rebuild embedded archive. --- deployments/headscale/config.yaml | 3 + deployments/headscale/deploy.sh | 109 +++++++++++++++--------------- 2 files changed, 58 insertions(+), 54 deletions(-) diff --git a/deployments/headscale/config.yaml b/deployments/headscale/config.yaml index c9e8849..7c30c12 100644 --- a/deployments/headscale/config.yaml +++ b/deployments/headscale/config.yaml @@ -72,8 +72,11 @@ oidc: - openid - profile - email + # PKCE protects the authorization-code exchange. Enabled with the S256 + # challenge method -- make sure the pocket-id OIDC client also has PKCE on. pkce: enabled: true + method: S256 # Restrict who can register a node. Uncomment one or more. # allowed_users: # - alice@example.com diff --git a/deployments/headscale/deploy.sh b/deployments/headscale/deploy.sh index f8736a3..beea08a 100644 --- a/deployments/headscale/deploy.sh +++ b/deployments/headscale/deploy.sh @@ -327,57 +327,58 @@ EOF # __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64). exit 0 __ARCHIVE_BELOW__ -H4sIAAAAAAAAA+1a7W7jNhad334KwhmgE3Qky4njpB5k0WxidIJmZrz5QLsoFiot0TYRWVQpKh53 -EGAfYp9wn2TPJSVZ8WQn+2M6bbG6CWKLH5fk5eW551KJVXQrtBepZaZy4a+XybPPLgFkOBg8C4ZB -//Cgbz+DoG/LIfuD4f6z/kH/cNgfDoOD/WdBfz8IDp6x4PNP5WMpcsM1Y88ODsMfVHInvsSYfyDZ -YQvB4zziiWCwRHTLPI9FPI7X7MX1xdUu+7rR4MU1l4n9ah2GGzlFaaSUjmXKjdK7nZ3ODrtWmUrU -fD3Cd8bqPixKpEhNzry/uBFGg8E+PdQDjI6Co8CqeKvYSVpMZY5KLUaPKMkzwW/Z6+vrSW8PU0iN -VgnLtDIqUslLliqDyjcXL6EsV4yzifqBRQueJCKdC7ZSRRKzqSYdZiGWPntdTeKrnJ1Mzlle6BmP -BMMUVgtuoKYaeSHNK2bQ1TBpWCJvBePpmino0a6r0HcyEr5dybvzs1MGa8iUVMUiEXNuRMyMYhmd -PePJmEHV88m70+/H1+dn4dm7Nyfnb312KeYyN9DJ68FprlqwmdQ55hCpbE0lZWUIRV9X33MRaYEJ -phjHF+md3+mkfAlL1sbudO5UUixFPuqwTakXc8OpxO7Q1hPMPJPzUadTrjCvq+gLY3LJ5xjClTz/ -cHpydvb38Prku5G35/Ekk6m4t+1ouziedOjmZDvYGi3oOJoRK9JE5LmXG5VlIrZ1mdImdwMx5rHu -UQB/6W6e4U3kUVXJTqOsV8RZ15ZZh9knJ49lzuG+MYYyMmGn1uf/dnN+CiNqcSd0LkL40/t1qe8x -2WFZAidZqCTGPk2LOe3xTL6H1hc/epeCJ975BMuFlbFRWhXzxSe1iWVm4EkpXHZJ5xFOtsx3yRU8 -kdJsWQLn0b5V0tg+ZwG/ZxcxkzhJPWGinrVro1Crum1je3v0d6ui3Ome+7SVcCKpVbqEd1VDvh6f -nF2dnlyMS58dse7zD9uF99WGnJy+GYdjFF3YdpvHskUsMpHGeajSSv8GGGqrYUKxNBJtqmMWolVi -Fm6b3PdoIaLbqo+BS43YT93TN2fdl6y7mgtDn94v7zz6XBiTjXq9/t6hH+CnP9oL+t+U6+51/1Eq -wTnCaDwZsf0grxTLpVAFdB9UJThxWmJH2H5ZYJ05zISWKh6xPrp2PlpVeWjq0t6mvmlMe4wCf+/I -Dx4/RJuD/dRBgj8ueRo7C1bNeQzDJ+sRkK1wZWaZzRre1bvjuqeLtPdwoEe80BnPX/Nl4vxws7Zm -VcMbt+DHDpXI6dZQT29u3b58QPPPv4W/d8j+rFKDw284xhP8rz/sH2z432EA/tfvgwa2/O8LyA6r -PYDNlN5mg47DnBRGeTLPC4Qxzi6EAUcap5FeZ4ZFQhvb8/k28IMVxVUk9SiS4lxBGQjJosG1KCCD -RIHoAMoo9FkS6D/C+LT4pZBgP2YhSY94zyPDFio3hH9MYRyr7ApU54OLWEvoYB+eNyJN5x6VH830 -npUd0kjFgv2am5jNf5VZp8TGBhnYIqtlxypYAYyLjG0i/weKLj5NHDiFz6Uywqcp39fddtiFSude -Iu9AGlIlc9FbYZXzguu45rUlE3gFQ80sCUSwnPEiMQ01MiZ6IJfgpCC8aLNmsUq/MgwBD0bXKR5X -qV/3mCVFvggrVGRev64xmqc5sS1G028ssY4UJW4y4OHyQe1KSyPq6matW/F9p0JyIkwbzVdA3ch4 -19XI3pWICuhas+6Sv/cQIY/3gQlDwMUrIHmUFLG4KqZnCluc5t1az4/eKUwGd/Gu15nw3mVEFXKq -6aYqT+Vstml7KWZCayS/E5XIaN1YRTd301Fagrd7q4VIvUgrhFFXstGBeSKE6ubawPUbC4MZMlgC -HoVvG9srvQTnx/bmqgxu5Jq/w/lvBOTfbIwn8H9wsD8A/u8h6x/uHRzuEf4P8NHi/xeQZv7f8AVK -kBzZtAFg0shyjLoVOFIvbiaT8WV49fbk+zGOPSd2iZMJkCkoTylStM0jBR66y7gWlIYX09xIU1D2 -C+cH3U/U2lIwNl2Xj36+YDOtlhbjAEsUcaDUZrDszMJZLigZp6Td3g0gj9MiMsm6ZLpsrYqvUAym -msp03lgeDmAuY1HCpx08j7TMjO8SWgJvDXpIoJcjJQjD7TgRhh0XqULETD1igU0ZAndtsSTmGOXh -oy2+Cb4JOpj2/HJyylwc8CpwP5mcY21VNmpNYbH9VR35itzNGq6axogLUPRzva6f2enFOYxUr61O -DKjQoJnPblLi/HSB8DXiJt30MTkjS0HTiqPYTYnxeCkRIjBPnUWPr+QgQD5dteBJolaIITmhNXKQ -GU9y0enYMEYUPdPyDglreCvWYcbNYsQ+pvY92zosm/po2ulkWlAWbbOKuwHR7sAfDmj8Xj+gsiHG -ig/5CEQxGvG+CEaj3uAINTSjiFcJIuIuknuekOnPxpeTkTVlTS1APzJ4q4xsJVvyzGfj5VTEMTbC -Fjm/IMOvc6ZmM4RWMpkoQ2sq3E2OQubKbs4mvf3B4VGpM1n7HZyBjNbg1IxKkmE3ujIWY3C6Mn3y -at8rfSNLeCp8U83Xxy72SCdm2tswALIsMpafKNPhoGrgIDFZvR6pTOnK4pnlI2mEXG9vsOh0KOWa -crdhBlEThvslQRinedsvbnL/df/iqV93qBgAp+oQobCRT654EtL0bAKXKTAPu7E4F9QOTRIQLZw/ -mc4oM3QxEv3Fe0P794bPaaPeXlm2SY5OdkmF8RnNPowtF2BTUV234LwUM7iRbZ+C2JEToDvRReCX -8Oc+S3iGxNgPkV6fX7wdX9cHfRebl9ptWdK4IT1US2kMN2Ifd0ULIqMa5zEkZ0xc52q77fDWH8pd -nydqirS0Tob7vv1pPNuLifp5bxgMR4PDIHB/cAb6n6hEoLWVeYYtGrEP99YduY4W5RIqz4GZNQ+B -pUrHrqy8vRzVt5bkXQs6Ue6EkeeTmTf3mA5WCWi2ri9TsXI3oeU9JjZq02slzQII5ICc3Vyeu4vj -T+FwT8mY7reSZIospUNPZEC6wQhdxi5nIZWGMg/5HRyFjkK9gzaX0U2o37p9tbtYX6vSLtPsQyDt -+O11iGaNenfVut3manx6CaegdgiDmahOOEGFjMsHpBSUeZVPNl+h83wbiS2sKOe9A6s6bspWC8Ui -nsJulZmtjzexXqUIepotEYR929nCtYhDgKBzvh07LgdaiW+RTy0zhzEPGs+1KrJG6xqNPBst8geN -K5eqW29rfa1WYMiIy266JbI2/IpCoMCJRQTHCCinK9Uy9UMku0byRyXcaosL7TyRJgQa94Ku/TkB -+a5PUB8i2Em9DolShJa41Eczp8t763kY2iqz/mkbIS4gVWKuMyP6bzfAt6eEygBcRwFt4qNjVGf9 -9+Z2/4tYZlVu0m81xlPv/4LB5v3fXnBI/P9gOGz5/5eQHXZq3yK5t0T2ygaIlACgfXAcejfMynfD -LJPRbe6aFZklGojPkjAYTAeI/e9//dP9sokjVdXdTL6p+iP/Ygl/RaayuVICmgBYkGiIXQIBqqqT -iRUZaUogxdEibtxXNd4UgsWlFNJs3+YF1XZAO17kfhMpoWNsL6+Iujy8b3N4X8Jer8Io4J6clWE5 -9zubG69jC9Lfbim3XMojMrRFkfJmIlHzq7HrPbJ4SS94HzCeY2rXnP5LQDAZkZFvAM+7jmV1ndGQ -EdI5g8tBU8m/tjX47M3N1TXZN5azGayHaGbTwm3D+Z0n5vLQMS3Ev6iZx+6fxjFfP+aTyqZw+lH+ -9ZJCE/JsR4Rp3dDiaA+MC9BDkDSRDX5lMYjXRfOVdAx/NcjMEGsp4e75K5Ek3m2KyNhzJKZ8S1jG -YL+zxaGOKXpv78Vlg658ghPC4a3jspvzp+jhI28ct9ghHJZCeMYxsMuQoc0lhu7/C/zOQ3Z33PmY -yR0/9KRzemuHEzL/k4DbI1714N3icXnbU7+zP65e2f8paEwrrbTSSiuttNJKK6200korrbTSSiut -tNJKK6200korrbTSSiuttNJKK6200korrbTSSiut/F/IfwAcHflnAFAAAA== +H4sIAAAAAAAAA+1a627bRhbObz7FwA7QGA0pyhc5ZeBFvbbQGHUSre2gXRQLdkSOpIEpDjscWlGD +APsQ+4T7JPudGZKiFW/yJ01agCeBJc7lzMy5fmeoVCW3QvuJWhaqFMF6mT367BSCRoeHj8JRODw+ +GtrPMBzadtDB4ejg0fBoeDwajkbh0cGjcHgQhkePWPj5t/IhVaXhmrFHR8fxTyq7E19izT8R7bKF +4GmZ8EwwSCK5Zb7PEp6ma/bk5vJ6j33bGfDkhsvMfrUGw42cojVRSqcy50bpPW/X22U3qlCZmq8j +fGesncOSTIrclMz/m1shOjw8oId2gehZ+Cy0LF4pdppXU1miU4voASZlIfgte3FzMxnsYwu50Spj +hVZGJSp7ynJl0Pny8imYlYpxNlE/sWTBs0zkc8FWqspSNtXEwyzEMmAvmk18U7LTyQUrKz3jiWDY +wmrBDdg0Ky+kec4MphomDcvkrWA8XzMFPtpNFfpOJiKwJ3l9cX7GIA2ZE6tUZGLOjUiZUawg3zO+ +TBlYPZ68PvtxfHNxHp+/fnl68SpgV2IuSwOevF2c9qoFm0ldYg+JKtbUUnfGYPRt870UiRbYYI51 +ApHfBZ6X8yUk2Qrb8+5UVi1FGXls0+qn3HBqsRraeoKYZ3IeeV59wrLtoi+MySWfYwnX8vjd2en5 ++T/jm9MfIn/f51khc/HejiN1cTzp2O3JTrA9WpA7mohVeSbK0i+NKgqR2r5CaVO6hRjz2c6zEPay +s3mGNZFFNS27nbZBlRY7ts0azAEZeSpLDvNNsZSRGTuzNv+PNxdnEKIWd0KXIoY9vV3X/B6iXVZk +MJKFylLoaVrNSccz+RZcn/zsXwme+RcTHBdShqK0quaLj3ITy8LAknKY7JL8EUa2LPfIFHyR025Z +BuPRgWXSUZ+TQDCwh5hJeNJAmGRg5dpp1Kod21HvgP5uddSaHrhP2wkjklrlS1hXs+SL8en59dnp +5bi22YjtPH633fi+Ucjp2ctxPEbTpR23eaxHpKIQeVrGKm/4bwJDKzVsKJVGYkzjZjFGZWbh1OS+ +JwuR3DZzDEwqYr/snL0833nKdlZzYejT/+21T58LY4poMBjuHwch/g2j/XD4XX3uwc6/aibwI6zG +s4gdhGXDWC6FqsD7qGmBx2kJjbCDusEac1wILVUasSGmeh+cqnaatnWw6e8K07pRGOw/C8KHnWjj +2J9yJNjjkuepk2AznKcQfLaOENkq12aWxaxjXYM7rge6ygf3F3rACp3wgjVfZs4ON2frdnWscSv8 +2KUyOd1a6tPKbcfXDxj++VX4tVP2Z6U2OPyBa3wC/w1Hw6MN/jsOgf+GQ8DAHv99AdplrQWwmdLb +aNBhmNPKKF+WZYU0xtmlMMBI4zzR68KwRGhjZz7eDvxARWmTSX3KpPArMAMgWXSwFiVkgCgAHYQy +Sn0WBAYPID4tfqsk0I9ZSOIj3vLEsIUqDcU/prCOZXYNqPPOZawleLB3jzuZxnuPzg92+p7VE/JE +pYL9XpqUzX+XhVfHxg4Y2AKr9cQmWSEYVwXbZP53lF0C2jjiFD6XyoiAtvy+nbbLLlU+9zN5B9CQ +K1mKwQqnnFdcpy2urZHAcwhqZkEgkuWMV5npsJEpwQO5BCYF4MWYNUtV/o1hSHgQus7xuMqDdsYs +q8pF3ERF5g/bHqN5XhLaYrT9zhHbTFHHTYZ4uLzXu9LSiLa72+tO/N5rIjkBpg3na0TdxPg3zcr+ +tUgq8FqznSV/6yNDnhwgJowQLp4jkidZlYrranquoOK83Gn5/OyfQWQwF/9mXQj/dUFQoaSenVyV +uZzNNmOvxExojeJ3ojKZrDun2CnddpSWwO3+aiFyP9EKadS1bHhgn0ihuns2YP3OwSCGApKAReHb +RvZKL4H5od5S1cmNTPMr+H8nIf9ha3wi/h+F4SHi/z6q/uPweLhP8f/waNTH/y9B3fq/YwtUIDmw +aRPApFPlGHUr4FJP3kwm46v4+tXpj2O4PSd0Cc9EkKmoTqlyjC0TBRy6x7gWVIZX09JIU1H1C+MH +3M/U2kIwNl3Xj0G5YDOtljbGISxRxgFTW8GycxvOSkHFOBXt9m4AdZwWicnWNdJla1V9g2Yg1Vzm +887x4IClTEUdPu3iZaJlYQJX0FLw1oCHFPRKlARxvJ0n4thzmSpGztQRC23JELpriyUhx6SMHxzx +Xfhd6GHb86vJGXN5wG+C++nkAmdrqlErChvbn7eZryrdrmGqeYq8AEa/tuf6lZ1dXkBI7dnawoAa +DYYF7E1OmJ8uEL5F3qSbPiZnJClwWnE0uy0xni4lUgT2qYvk4ZMchainmxE8y9QKOaSkaI0aZMaz +UnieTWME0Qst71CwxrdiHRfcLCL2IbQf2NFxPTTAUM8rtKAq2lYVd4cEu8NgdEjrD4YhtY2wVnrM +IwDFJOJDEUbR4PAZemhHCW8KRORdFPc8I9Gfj68mkRVlCy0APwpYq0xsJ1vyImDj5VSkKRRhm5xd +kODXJVOzGVIriUzUqTUX7iZHoXJlb84ng4PD42c1z2wdePCBgs7g2EQ1yLCKboTFGIyuLp/81vZq +2ygynovANPsNoMUB8cROBxsEQJJFxfILVTocUA0YJCWptyvVJV3dPLN4JE9Q6+0fLjyPSq4pdwoz +yJoQ3G8Z0jjt235xm/u/+kunQTuhQQCcumOkwk49ueJZTNuzBVyhgDysYuEXNA5DMgAt+J/MZ1QZ +uhyJ+eKtIf295HNS1KtrizbJ0EkuuTABo93HqcUCbCqa6xb4SzWDGdnxOYAdGQGmE1xE/BLBPGAZ +L1AYBzHK64vLV+Ob1tH3oLzcqmVJ68b00Byls1zEPpyKEQRGNfwxJmPM3ORG3XZ5aw+11ueZmqIs +bYvhYWD/dZ7txUT7vD8KR9HhcRi6P/CB4Uc6kWhtZ1lARRF7996aI9fJoj5CYzkQs+YxYqnSqWur +by+j9taSrGtBHuU8jCyfxLy5x3RhlQLN1vVlLlbuJrS+x4SiNrNW0iwQgVwgZ2+uLtzF8cfi8EDJ +lO63smyKKsWjJxIg3WDErmKXs5haY1nG/A6GQq7QatDWMrob6rduX60W22tV0jLtPkakHb+6iTGs +0++uWrfHXI/PrmAUNA5psBCNh1OokGn9gJKCKq/6ydYrHmH5yY9nY3uZDYE4UybJA3z+bgXv2zJF +vE0WPJ8LxCzn6E6QNPp6/2hkGW1uvJGeFiqlvL7kt+QaWmwpr6sf2CrKNF66nShbNhS3idgKYa1v +O+7RZuEr4TA0Wy0US3gO/TbmYH2xm5NUjuSs2RJgIbCTbVoRaYxg7Zxk18qHI6qK71H3LQsXC+8N +nmtVFZ3RbdT0bVYr7w1uTL8dvc31hVoByQM/uO3WGaBj/5SqBSILkAZWQDtd/dYlKjLuDYpUauGW +W1pp5zG0IcDNJ/R6glPC2QsoJcVIylKvY4I+sQVYbQgp6SVDo1jLzOrJDkL+QknH3GRGZYrVSGC9 +mdoQYJ+FZGwPrtHEpK+NQXv6emSRdW38f9Qan3r/Gx5u3v/uh8dU/x2N+vrvi9AuO7NvEd1bQntl +h4yUIUEHwLj02wBW/zaAFTK5Ld2wqrBAE/hMUg4G0kXG/u9//u3+s4kD1c3dXLnp+jP/xxH+jkp1 +c6WIKI2AjUJT7FFwpa62mFyRkKYU/DlGpJ37ys6bYqD4nCCNndu9oNwGNCeLMuhmIPAY28tLgq73 +71tdHq3TyaCJ/cgnclbDsjLwNjeeJzb5fb/F3GJpn8DwFkQuu4Vki6/HbnZk8xC94L+HeE9oXHf7 +T5HaSIiMbAN5cseh7B0nNC1K8jOYHDjV+HubQ8Bevrm+IfmmcjaD9IAS7LXAtuAC7xN7uW+YNnU+ +aSHP3l/GMF88ZJPKlvD6Qfz9lFJ+yrhDj3RucHGwF8JF0AP4MIlDi64ZwPuy+5OEFPZqUJkDw9CF +yyBYiSzzb3MgjoEDsfVb4hrbBN4Whj4hVLSti6sODPxITQCDt4bL3lx8qjx44I3zVnUAgyVoVHAs +7G5IwM1dDLjflwTefXR/4n2I5E/uW9IFvbWFh8z/IsHtAau69275pL7ta3+zcdL8ZKOHhz311FNP +PfXUU0899dRTTz311FNPPfXUU0899dRTTz311FNPPfXUU0899dRTTz311FNPfyb6HzQ8btgAUAAA