ansible-role-tailscale

Added

• Added the ability to cleanly uninstall Tailscale and its artifacts from a host with state: absent

Changed

• Updated dependencies

Added

Idempotent state management

This release adds support for maintaining state between multiple invocations of this role.
If the arguments to tailscale up change (tailscale_up_args input parameter), the role will re-run the command.
Previously, the role ran up once and would not re-run unless the force input parameter was applied, and in that case up would just run every time.
Now there is true idempotency!

Clearer stdout/stderr from tailscale up

This release also massively improves upon the insecurely_log_authkey input parameter, which was previously the only way to get stdout/stderr results from tailscale up inside the role. Now, any stdout/stderr output from tailscale up will be reported to the user before failing the task (if an error had occurred). Since the --authkey value is printed in stderr upon an error, the role will automatically redact authkey values from stderr before printing. If the raw authkey value is desired, you can still set insecurely_log_authkey to true to view the un-redacted stderr.

Changed

• tailscale_auth_key is now tailscale_authkey
• insecurely_log_auth_key is now insecurely_log_authkey
• RHEL8 added to the CI test suite

Removed

• force variable is removed, as its use case is now handled by idempotent state management

Added

• Added support for Rocky Linux (#172 )
• Added support for AlmaLinux

Changed

• Moved all modules to Ansible Fully Qualified Collection Names (FQCNs). This syntax requires Ansible 2.11+. Compatibility during the refactor was tested with Ansible 2.12, so 2.12 is set as the minimum required version for this role moving forward.
• Updated dependencies.

Added

• Added dependency scanning with Snyk to the CI process. Hooked into GitHub Code Scanning with SARIF support.

Added

• Added RHEL support. While I had previously communicated that RHEL was supported, it was actually broken until this release. Thanks @relrod (#158 / #161)

Added

• Added an optional insecurely_log_authkey input parameter to conditionally allow end users to view error log output from the "Bring Tailscale Up" command
• Created a customized devcontainer for GitHub Codespaces

Removed

• Removed Ubuntu 20.10 from the list of tested distributions in the CI test suite. 20.10 is still supported and compatible with the role, however the ubuntu:20.10 docker container can no longer run apt update as The repository 'http://archive.ubuntu.com/ubuntu groovy Release' does not have a Release file. Ubuntu 20.10 entered EOL in July 2020.

Changed

• CI test suite now takes 3 minutes to complete (previously took 7 minutes)
• Updated dependencies
• Moved to Python 3.10 in the CI suite

Added

• Added a 60s timeout to the tailscale up command to improve the speed of authentication failures. Closes #142

Fixed

• Fixed Tailscale authkey existence check. With changes introduced by 1.13.2, the role did not properly validate an empty string. This is now fixed. (#133)

Fixed

• Fixed issue with variable preference by swapping vars with defaults. (#129 per @Ramblurr)

Fixed

• Fixed bug in Debian 11 (#124)

Added

• Added support for Oracle Linux (#114 per @pellegrino)
• Added Ubuntu 21.04 to the CI testing suite

Changed

• This role now updates Tailscale to the latest version by default (#116 per @aleohl)

Fixed

• The conditional check for whether Tailscale is already authenticated has improved robustness (#120 per @cmmarslender)

Changed

• Moved the auth key used during CI tests to an ephemeral auth key
• verify tasks during CI testing are updated to account for new behavior in Tailscale 1.8.5

Fixed

• tailscale status now returns an exit code and differing stdout message depending on the status. Fixed the conditional checks around status to support the new behavior. See #97 for details.

Added

• Added support for Debian Bullseye and sid.

Fixed

• Tailscale's hello.ipn.dev is now hello-ipn-dev, which broke the CI checks. That is now fixed.

Added

• Added a force variable for users that want to ensure tailscale up runs every time the role is invoked. This can be helpful if you change the arguments passed to up and want to re-run the role and apply the new settings.

Fixed

• Arch Linux install instructions changed on Tailscale's website - updated the role to match the new (simpler!) instructions

Added

• Added a tailscale_up_skip variable which can replace tailscale_auth_key. If tailscale_up_skip is present, the role will install Tailscale onto a system but will not run the tailscale up command to authenticate the node to your network. This is designed for build systems, such as AMI creation, where Tailscale should be packaged in but should not yet be added to the network.

Removed

• Removed yamllint from the CI process

Fixes

• Tailscale 1.2.x changed the tailscale status response, which broke this role. This release fixes that behavior and the role will correctly start up Tailscale again.

Added

• Added a verbose parameter to the role for verbose output in key areas without needing to run -vvv on the entire ansible playbook. Helpful for troubleshooting and for submitting an issue to this repository.

Added support for Ubuntu 20.10

Missing some ansible_distrubtion variables when adding PopOS support, so installation wouldn't work on 1.6.0. That is now fixed.

PopOS is now supported.