Allow providing accounts via Tailscale

[hkrutzer]

Hi,

I would like to deploy Livebook inside a Tailscale network and use the accounts that Tailscale provides.
Tailscale provides an API that allows you to link the remote IP to the account that belongs to it, see https://tailscale.com/blog/tailscale-auth-nginx/.
I see there is a way to use e.g. Cloudflare for authentication so maybe this could work in a similar way? Tailscale would work a bit differently though. Another way could be to make it so you can provide your own authentication module.

Please let me know what you think of this feature and I can probably provide a PR.

[josevalim]

If Tailscale sets a header that you can verify inside Plug, then you can send a PR to add Livebook.ZTA.Tailscale that works like Livebook.ZTA.Cloudflare. :)

[wojtekmach]

Right I don’t think we look at uri.userinfo but one can write a custom step that does so or do the logic directly outside of a step.

[hkrutzer]

Unfortunately it looks like Req doesn't work with Tailscale over a unix socket currently. If I look at a request (Req.get("http://myhost.sock/path", unix_socket: "/tmp/tailscale2.sock")) with socat -t100 -x -v UNIX-LISTEN:/tmp/tailscale2.sock,mode=777,reuseaddr,fork UNIX-CONNECT:/var/run/tailscale/tailscaled.sock

it ignores the hostname:

 47 45 54 20 2f 70 61 74 68 20 48 54 54 50 2f 31  GET /path HTTP/1
 2e 31 0d 0a                                      .1..
 68 6f 73 74 3a 20 6c 6f 63 61 6c 68 6f 73 74 3a  host: localhost:
 30 0d 0a                                         0..

and setting the hostname explicitly (Req.get("http://myhost.sock/path", unix_socket: "/tmp/tailscale2.sock", connect_options: [hostname: "foo"])) adds a :0 (that seems to happen for localhost as well):

 68 6f 73 74 3a 20 66 6f 6f 3a 30 0d 0a           host: foo:0..

Tailscale checks for the correct hostname and only allows the correct one.

[wojtekmach]

What if you set host header explicitly? Req.get(…, headers: [host: "…"])

[wojtekmach]

Do you know off the top of you head how to expose domain socket using store installed Tailscale? It’s ok if you don’t and I’d just google for it some more.

[hkrutzer]

Good call, it works with the host header set! I'll try to look into what seems like a bug later (probably in Finch I guess) but it looks like it's not blocking.

With respect to the socket, as far as I know it can't be exposed when installed via the App Store, probably due to sandboxing. You have to install it in a different way. On MacOS I've also installed it via the App Store, so I'm testing the socket on Linux.

[michaelterryio]

This is brilliant. GitHub should let you sponsor issues and ideas. I would put $100 toward this.

[hkrutzer]

If you want you can help out by testing my branch! #2207

[michaelterryio]

Great! I'm using your branch as we speak on Mac and Ubuntu. 😎