Add command to force tags on nodes and list tags

acls.go

@@ -2,6 +2,7 @@ package headscale
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -251,7 +252,26 @@ func expandAlias(
 	if strings.HasPrefix(alias, "tag:") {
 		owners, err := expandTagOwners(aclPolicy, alias, stripEmailDomain)
 		if err != nil {
-			return ips, err
+			if errors.Is(err, errInvalidTag) {
+				for _, machine := range machines {
+					for _, t := range machine.ForcedTags {
+						if alias == t {
+							ips = append(ips, machine.IPAddresses.ToStringSlice()...)
+						}
+					}
+				}
+				if len(ips) == 0 {
+					return ips, fmt.Errorf(
+						"%w. %v isn't owned by a TagOwner and no forced tags are defined.",
+						errInvalidTag,
+						alias,
+					)
+				}
+
+				return ips, nil
+			} else {
+				return ips, err
+			}
 		}
 		for _, namespace := range owners {
 			machines := filterMachinesByNamespace(machines, namespace)
@@ -328,6 +348,9 @@ func excludeCorrectlyTaggedNodes(
 				break
 			}
 		}
+		if len(machine.ForcedTags) > 0 {
+			found = true
+		}
 		if !found {
 			out = append(out, machine)
 		}

acls_test.go

@@ -1017,6 +1017,44 @@ func Test_expandAlias(t *testing.T) {
 			want:    []string{},
 			wantErr: true,
 		},
+		{
+			name: "Forced tag defined",
+			args: args{
+				alias: "tag:hr-webserver",
+				machines: []Machine{
+					{
+						IPAddresses: MachineAddresses{
+							netaddr.MustParseIP("100.64.0.1"),
+						},
+						Namespace:  Namespace{Name: "joe"},
+						ForcedTags: []string{"tag:hr-webserver"},
+					},
+					{
+						IPAddresses: MachineAddresses{
+							netaddr.MustParseIP("100.64.0.2"),
+						},
+						Namespace:  Namespace{Name: "joe"},
+						ForcedTags: []string{"tag:hr-webserver"},
+					},
+					{
+						IPAddresses: MachineAddresses{
+							netaddr.MustParseIP("100.64.0.3"),
+						},
+						Namespace: Namespace{Name: "marc"},
+					},
+					{
+						IPAddresses: MachineAddresses{
+							netaddr.MustParseIP("100.64.0.4"),
+						},
+						Namespace: Namespace{Name: "mickael"},
+					},
+				},
+				aclPolicy:        ACLPolicy{},
+				stripEmailDomain: true,
+			},
+			want:    []string{"100.64.0.1", "100.64.0.2"},
+			wantErr: false,
+		},
 		{
 			name: "list host in namespace without correctly tagged servers",
 			args: args{
@@ -1143,6 +1181,47 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "exclude nodes with valid tags and with forced tags",
+			args: args{
+				aclPolicy: ACLPolicy{
+					TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
+				},
+				nodes: []Machine{
+					{
+						IPAddresses: MachineAddresses{
+							netaddr.MustParseIP("100.64.0.1"),
+						},
+						Namespace: Namespace{Name: "joe"},
+						HostInfo: HostInfo{
+							OS:          "centos",
+							Hostname:    "foo",
+							RequestTags: []string{"tag:accountant-webserver"},
+						},
+					},
+					{
+						IPAddresses: MachineAddresses{
+							netaddr.MustParseIP("100.64.0.2"),
+						},
+						Namespace:  Namespace{Name: "joe"},
+						ForcedTags: []string{"tag:accountant-webserver"},
+					},
+					{
+						IPAddresses: MachineAddresses{
+							netaddr.MustParseIP("100.64.0.4"),
+						},
+						Namespace: Namespace{Name: "joe"},
+					},
+				},
+				namespace: "joe",
+			},
+			want: []Machine{
+				{
+					IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.4")},
+					Namespace:   Namespace{Name: "joe"},
+				},
+			},
+		},
 		{
 			name: "all nodes have invalid tags, don't exclude them",
 			args: args{

cmd/headscale/cli/nodes.go

@@ -46,6 +46,25 @@ func init() {
 		log.Fatalf(err.Error())
 	}
 	nodeCmd.AddCommand(deleteNodeCmd)
+
+	nodeCmd.AddCommand(tagCmd)
+	addTagCmd.Flags().Uint64P("identifier", "i", 0, "Node identifier (ID)")
+	err = addTagCmd.MarkFlagRequired("identifier")
+	if err != nil {
+		log.Fatalf(err.Error())
+	}
+	addTagCmd.Flags().
+		StringSliceP("tags", "t", []string{}, "List of tags to add to the node")
+	tagCmd.AddCommand(addTagCmd)
+
+	delTagCmd.Flags().Uint64P("identifier", "i", 0, "Node identifier (ID)")
+	err = delTagCmd.MarkFlagRequired("identifier")
+	if err != nil {
+		log.Fatalf(err.Error())
+	}
+	delTagCmd.Flags().
+		StringSliceP("tags", "t", []string{}, "List of tags to remove from the node")
+	tagCmd.AddCommand(delTagCmd)
 }
 
 var nodeCmd = &cobra.Command{
@@ -311,6 +330,7 @@ func nodesToPtables(
 			"Last seen",
 			"Online",
 			"Expired",
+			"Tags",
 		},
 	}
 
@@ -356,6 +376,22 @@ func nodesToPtables(
 			expired = pterm.LightRed("yes")
 		}
 
+		var tags string
+		for _, tag := range machine.ForcedTags {
+			tags += "," + tag
+		}
+		for _, tag := range machine.InvalidTags {
+			if !containsString(machine.ForcedTags, tag) {
+				tags += "," + pterm.LightRed(tag)
+			}
+		}
+		for _, tag := range machine.ValidTags {
+			if !containsString(machine.ForcedTags, tag) {
+				tags += "," + pterm.LightGreen(tag)
+			}
+		}
+		tags = strings.TrimLeft(tags, ",")
+
 		var namespace string
 		if currentNamespace == "" || (currentNamespace == machine.Namespace.Name) {
 			namespace = pterm.LightMagenta(machine.Namespace.Name)
@@ -375,9 +411,177 @@ func nodesToPtables(
 				lastSeenTime,
 				online,
 				expired,
+				tags,
 			},
 		)
 	}
 
 	return tableData, nil
 }
+
+var tagCmd = &cobra.Command{
+	Use:     "tags",
+	Short:   "Manage the tags of Headscale",
+	Aliases: []string{"t", "tag"},
+}
+
+var addTagCmd = &cobra.Command{
+	Use:   "add",
+	Short: "Add tags to a node in your network",
+	Run: func(cmd *cobra.Command, args []string) {
+		output, _ := cmd.Flags().GetString("output")
+		ctx, client, conn, cancel := getHeadscaleCLIClient()
+		defer cancel()
+		defer conn.Close()
+
+		// retrieve flags from CLI
+		identifier, err := cmd.Flags().GetUint64("identifier")
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error converting ID to integer: %s", err),
+				output,
+			)
+
+			return
+		}
+		tagsToAdd, err := cmd.Flags().GetStringSlice("tags")
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error retrieving list of tags to add to machine, %v", err),
+				output,
+			)
+
+			return
+		}
+
+		// retrieve machine informations
+		request := &v1.GetMachineRequest{
+			MachineId: identifier,
+		}
+		resp, err := client.GetMachine(ctx, request)
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error retrieving machine: %s", err),
+				output,
+			)
+		}
+
+		// update machine
+		mergedTags := resp.Machine.GetForcedTags()
+		for _, tag := range tagsToAdd {
+			if !containsString(mergedTags, tag) {
+				mergedTags = append(mergedTags, tag)
+			}
+		}
+
+		machine := resp.GetMachine()
+		machine.ForcedTags = mergedTags
+
+		updateReq := &v1.UpdateMachineRequest{
+			Machine: machine,
+		}
+
+		// send updated machine upstream
+		updateResponse, err := client.UpdateMachine(ctx, updateReq)
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error while updating machine: %s", err),
+				output,
+			)
+		}
+
+		if updateResponse != nil {
+			SuccessOutput(
+				updateResponse.GetMachine(),
+				"Machine updated",
+				output,
+			)
+		}
+	},
+}
+
+var delTagCmd = &cobra.Command{
+	Use:     "del",
+	Short:   "remove tags to a node in your network",
+	Aliases: []string{"remove", "rm"},
+	Run: func(cmd *cobra.Command, args []string) {
+		output, _ := cmd.Flags().GetString("output")
+		ctx, client, conn, cancel := getHeadscaleCLIClient()
+		defer cancel()
+		defer conn.Close()
+
+		// retrieve flags from CLI
+		identifier, err := cmd.Flags().GetUint64("identifier")
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error converting ID to integer: %s", err),
+				output,
+			)
+
+			return
+		}
+		tagsToRemove, err := cmd.Flags().GetStringSlice("tags")
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error retrieving list of tags to add to machine: %v", err),
+				output,
+			)
+
+			return
+		}
+
+		// retrieve machine informations
+		request := &v1.GetMachineRequest{
+			MachineId: identifier,
+		}
+		resp, err := client.GetMachine(ctx, request)
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error retrieving machine: %s", err),
+				output,
+			)
+		}
+
+		// update machine
+		keepTags := resp.Machine.GetForcedTags()
+		for _, tag := range tagsToRemove {
+			for i, t := range keepTags {
+				if t == tag {
+					keepTags = append(keepTags[:i], keepTags[i+1:]...)
+				}
+			}
+		}
+
+		machine := resp.GetMachine()
+		machine.ForcedTags = keepTags
+
+		updateReq := &v1.UpdateMachineRequest{
+			Machine: machine,
+		}
+
+		// send updated machine upstream
+		updateResponse, err := client.UpdateMachine(ctx, updateReq)
+		if err != nil {
+			ErrorOutput(
+				err,
+				fmt.Sprintf("Error while updating machine: %s", err),
+				output,
+			)
+		}
+
+		if updateResponse != nil {
+			SuccessOutput(
+				updateResponse.GetMachine(),
+				"Machine updated",
+				output,
+			)
+		}
+	},
+}

cmd/headscale/cli/utils.go

@@ -127,7 +127,8 @@ func GetDERPConfig() headscale.DERPConfig {
 	stunAddr := viper.GetString("derp.server.stun_listen_addr")
 
 	if serverEnabled && stunAddr == "" {
-		log.Fatal().Msg("derp.server.stun_listen_addr must be set if derp.server.enabled is true")
+		log.Fatal().
+			Msg("derp.server.stun_listen_addr must be set if derp.server.enabled is true")
 	}
 
 	urlStrs := viper.GetStringSlice("derp.urls")
@@ -563,3 +564,13 @@ func GetFileMode(key string) fs.FileMode {
 
 	return fs.FileMode(mode)
 }
+
+func containsString(ss []string, s string) bool {
+	for _, v := range ss {
+		if v == s {
+			return true
+		}
+	}
+
+	return false
+}