{"id":52,"date":"2026-08-26T15:08:24","date_gmt":"2026-08-26T15:08:24","guid":{"rendered":"http:\/\/100.64.0.14:8088\/?p=52"},"modified":"2026-08-27T10:17:12","modified_gmt":"2026-08-27T10:17:12","slug":"headscale%e9%80%9a%e8%bf%87acl%e8%ae%be%e7%bd%ae%e5%86%85%e7%bd%91%e7%94%a8%e6%88%b7%e9%9a%94%e7%a6%bb","status":"publish","type":"post","link":"https:\/\/speedtest.lcsh.top\/?p=52","title":{"rendered":"Headscale\u901a\u8fc7ACL\u8bbe\u7f6e\u5185\u7f51\u7528\u6237\u9694\u79bb"},"content":{"rendered":"\n

4. \u901a\u8fc7ACL\u8bbe\u7f6e\u865a\u62df\u5c40\u57df\u7f51\u4e2d\u4e0d\u540c\u7528\u6237\u8bbe\u5907\u4e92\u76f8\u9694\u79bb<\/h2>\n\n\n\n

\u7531\u4e8e\u5404\u79cd\u539f\u56e0\uff0c\u865a\u62df\u5c40\u57df\u7f51\u7684\u67d0\u4e9b\u8bbe\u5907\u6709\u88ab\u653b\u51fb\u98ce\u9669\uff0c\u4e0d\u80fd\u8ba9\u5b83\u4e0e\u5b89\u5168\u7684\u8bbe\u5907\u4e92\u8bbf\uff0c\u6240\u4ee5\u9700\u8981\u901a\u8fc7ACL\u9694\u79bb\u8fd9\u4e9b\u8bbe\u5907\u3002<\/p>\n\n\n\n

\u9996\u5148\uff0c\u5728headscale\u4e0a\u65b0\u5efa\u4e00\u4e2a\u7528\u6237\uff1a<\/p>\n\n\n\n

docker exec -it headscale headscale users create fragile_dev<\/code><\/p>\n\n\n\n

docker exec -it headscale headscale preauthkeys create --user <fragile_dev\u7684\u7528\u6237ID> --reusable -e 3600d<\/code><\/p>\n\n\n\n

\u540c\u6837\u8bb0\u4e0bheadscale\u7ed9\u51fa\u7684AuthKey\uff0c\u7b49\u4f1a\u513f\u7528\u6700\u4e0a\u9762\u7684\u547d\u4ee4\u52a0\u5165\u8fd9\u4e2a\u5c40\u57df\u7f51\u3002<\/p>\n\n\n\n

\u6700\u91cd\u8981\u7684\u4e00\u6b65\uff1a\u5728Headscale ACL\u6dfb\u52a0\u8bbf\u95ee\u63a7\u5236\u3002<\/p>\n\n\n\n

4.1 \u7f16\u5199ACL hujson\u6587\u4ef6<\/h3>\n\n\n\n

\u5728\u6211\u7684\u914d\u7f6e\u4e2d\uff0c\u7f16\u8f91vim \/etc\/derp\/headscale\/acl.hujson<\/code><\/p>\n\n\n\n

{\n  \/\/ 1. \u5b9a\u4e49\u7ec4\uff08Headscale \u7528\u6237\u540d\u672b\u5c3e\u5fc5\u987b\u5e26 @\uff09\n  \"groups\": {\n    \"group:vnet\": [\"fragile_dev@\"]\n  },\n\n  \/\/ 2. \u8bbf\u95ee\u63a7\u5236\u5217\u8868\n  \"acls\": [\n    \/\/ \u89c4\u5219 1\uff1a\u53ea\u5141\u8bb8 vnet \u7ec4\uff08\u5373 fragile_dev \u7528\u6237\u4e0b\u7684\u670d\u52a1\u5668\uff09\u4e92\u76f8\u901a\u4fe1\n    {\n      \"action\": \"accept\",\n      \"src\": [\"group:vnet\"],\n      \"dst\": [\"group:vnet:*\"]\n    },\n\n    \/\/ \u89c4\u5219 2\uff1a\u5141\u8bb8\u5176\u5b83\u6240\u6709\u666e\u901a\u7528\u6237\u7684\u8bbe\u5907\u5728\u201c\u540c\u7528\u6237\u5185\u90e8\u201d\u4e92\u8bbf\uff0c\u963b\u65ad\u8de8\u7528\u6237\u8bbf\u95ee\n    {\n      \"action\": \"accept\",\n      \"src\": [\"autogroup:member\"],\n      \"dst\": [\"autogroup:self:*\"]\n    }\n  ]\n}<\/code><\/pre>\n\n\n\n
\u7136\u540e:wq\u4fdd\u5b58\u3002<\/p>\n\n\n\n
4.2 \u914d\u7f6eACL\u6587\u4ef6\u8def\u5f84<\/h3>\n\n\n\n
server_url: https:\/\/<SERVER_URL>\nlisten_addr: 0.0.0.0:8080\nmetrics_listen_addr: 0.0.0.0:9090\ngrpc_listen_addr: 0.0.0.0:50443\ngrpc_allow_insecure: true\n\n# \u3010\u52a0\u5728\u8fd9\u91cc\u3011\u914d\u7f6e ACL \u6587\u4ef6\u8def\u5f84\uff08\u9876\u5c42\u53c2\u6570\uff0c\u65e0\u7f29\u8fdb\uff09\n#  \u6ce8\u610f\u8fd9\u91cc\u8981\u5199\u5bb9\u5668\u5185\u90e8\u5bf9\u5e94\u7684acl.hujson\u8def\u5f84\nacl_policy_path: \/etc\/headscale\/acl.hujson\n\nprivate_key_path: \/var\/lib\/headscale\/private.key\nnoise:\n  private_key_path: \/var\/lib\/headscale\/noise_private.key\n...<\/code><\/pre>\n\n\n\n
4.3 \u68c0\u67e5<\/h3>\n\n\n\n
\u7531\u4e8e\u73b0\u5728\u6709\u5728\u8fd0\u884c\u4e2d\u7684\u5c40\u57df\u7f51\uff0c\u6240\u4ee5\u9700\u8981\u6d4b\u8bd5\u914d\u7f6e\u6587\u4ef6\u65e0\u8bef\u540e\u518d\u5e94\u7528\u3002\u4fdd\u5b58\u4ee5\u4e0a\u6587\u4ef6\u4e4b\u540e\uff0c\u8f93\u5165\u547d\u4ee4\u6d4b\u8bd5headscale\u914d\u7f6eYAML\u6587\u4ef6:
docker exec -it headscale headscale configtest<\/code><\/p>\n\n\n\n
\u8f93\u5165\u547d\u4ee4\u6d4b\u8bd5ACL\u8bbf\u95ee\u63a7\u5236\u6587\u4ef6:<\/p>\n\n\n\n
docker exec -it headscale headscale policy check --file \/etc\/headscale\/acl.hujson<\/code><\/p>\n\n\n\n
\u786e\u8ba4\u8f93\u51fa Policy is valid.<\/code> \u540e\uff0c\u8fd0\u884c docker restart headscale<\/code>\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
4. \u901a\u8fc7ACL\u8bbe\u7f6e\u865a\u62df\u5c40\u57df\u7f51\u4e2d\u4e0d\u540c\u7528\u6237\u8bbe\u5907\u4e92\u76f8\u9694\u79bb \u7531\u4e8e\u5404\u79cd\u539f\u56e0\uff0c\u865a\u62df\u5c40\u57df\u7f51\u7684\u67d0\u4e9b\u8bbe\u5907\u6709\u88ab\u653b\u51fb\u98ce\u9669\uff0c\u4e0d\u80fd\u8ba9\u5b83\u4e0e\u5b89\u5168\u7684\u8bbe\u5907\u4e92\u8bbf\uff0c\u6240\u4ee5\u9700\u8981\u901a\u8fc7ACL\u9694\u79bb\u8fd9\u4e9b\u8bbe\u5907\u3002 \u9996\u5148\uff0c\u5728headscale\u4e0a\u65b0\u5efa\u4e00\u4e2a\u7528\u6237\uff1a docker exec -it headscale headscale users create fragile_dev docker exec -it headscale headscale  […]<\/p>\n","protected":false},"author":1,"featured_media":15,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-52","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category--tech-notes"],"_links":{"self":[{"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=52"}],"version-history":[{"count":3,"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts\/52\/revisions"}],"predecessor-version":[{"id":58,"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=\/wp\/v2\/posts\/52\/revisions\/58"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=\/wp\/v2\/media\/15"}],"wp:attachment":[{"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/speedtest.lcsh.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}