How to turn off debug mode in headscale serve about headscale

[gtsatsis]

You can use systemd (or any other init system) to serve as a background process (service), here's an example systemd unit file:

[Unit]
Description=headscale
After=network.target

[Service]
User=headscale
Group=headscale
WorkingDirectory=/etc/headscale
ExecStart=/usr/bin/headscale serve
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
SecureBits=keep-caps
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target

This unitfile assumes that you have a user and group named headscale, that your configs are in /etc/headscale (and that the user has permission to access them), and allows you to run it on privileged ports via the CAP_NET_BIND_SERVICE (80, 443 as prime examples) [note that you might have to run sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/headscale to actually let the binary also have that capability).

---

As for the debug mode, it actually says in the message- You can set the environment variable GIN_MODE to release, which you can also do in the systemd unitfile by adding Environment=GIN_MODE=release under [Service]. ^-^

[bharathmsd7]

You can use systemd (or any other init system) to serve as a background process (service), here's an example systemd unit file:

[Unit]
Description=headscale
After=network.target

[Service]
User=headscale
Group=headscale
WorkingDirectory=/etc/headscale
ExecStart=/usr/bin/headscale serve
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
SecureBits=keep-caps
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target

This unitfile assumes that you have a user and group named headscale, that your configs are in /etc/headscale (and that the user has permission to access them), and allows you to run it on privileged ports via the CAP_NET_BIND_SERVICE (80, 443 as prime examples) [note that you might have to run sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/headscale to actually let the binary also have that capability).

As for the debug mode, it actually says in the message- You can set the environment variable GIN_MODE to release, which you can also do in the systemd unitfile by adding Environment=GIN_MODE=release under [Service]. ^-^

Can you share how to run this systemd unit file.
And I am not sure whether i need to create user and group named headscale, if yes how should I do it.
I am new to linux. Testing this in my Ubuntu 18.04 machine.

[gtsatsis]

Sure, but please do take some time to give the documentation a read for yourself, there's a lot more than what I can cover here, haha!

First, copy/move the headscale binary to somewhere like /usr/bin/, so it's in the default path. That'll make it much easier to control headscale, as you can run it from anywhere.

Proceed to creating a [system] user, setting its home directory to /etc/headscale, and denying it access to a shell with sudo useradd --system --home /etc/headscale --shell /bin/false headscale. We'll run headscale as this [low-privileged] user.

Now, ensure that the headscale binary is executable (sudo chmod +x /usr/bin/headscale), and that the headscale user & group can access /etc/headscale (sudo chown -R headscale:headscale /etc/headscale).

To set up the Systemd unit, go ahead and make a file in/called /etc/systemd/system/headscale.service, with the contents mentioned above. Run sudo systemctl daemon-reload to reload systemd's services, and let it know about headscale.service.

If your configs are not already in /etc/headscale, go ahead and move them there along with your WireGuard private key file and the derp.yaml file [if you're using SQLite, also move the database over]. Once done, all that's left to do is sudo systemctl enable --now headscale, which will enable the service to start on boot, as well as start it immediately (--now).

[bharathmsd7]

Thanks for spending time in this @gtsatsis
It worked 🥳🥳🥳.

[bharathmsd7]

Hi @gtsatsis

Trying to logging in my peer using
sudo tailscale up -login-server YOUR_HEADSCALE_URL --authkey YOURAUTHKEY

It seems it doesn't responding
In peer checking status of tailscale it shows Logged out
But in Headscale it shows the peer name by executing
headscale -n namespace nodes list

[juanfont]

@bharathmsd7 are you running headscale behind a proxy?

[bharathmsd7]

Yep behind an Nginx proxy

[juanfont]

Then I am going to close this issue. We are tracking the issues with nginx here #56