tailscale / tailscale/tailscale

FR: Connection lifecycle hooks

Open
#6,367 12 comments 30 reactions 0 assignees View on GitHub
fr L1 Very few OS-linux P2 Aggravating pending T0 New feature
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
1d 23h
Merged PRs (30d)
132

Description

### What are you trying to do?

Hello! First of all, thanks for such a good VPN solution.

Our team is faced with a situation when we need to do some actions after the `tailscale up` establishes a connection. In particular, after connection establishment hosts in one of our networks receive a route that should not be on these hosts.

At the same time, this route should be propagated on almost all other hosts of our network. I spent some time to find a feature that can exclude route propagation for particular IPs, IP ranges, or subnets. And it seems like Tailscale has no such feature.

Therefore, after the connection establishment we need to remove the unneeded route from the route table manually:
```
> sudo ip ro del table 52 192.168.0.0/16
```

It's pretty inconvenient to do it manually every time. Moreover, if host will be rebooted we can't do that, because we lose access to the host due to this route will be present on the host after its restart.

As a workaround, we can to wrap the `tailscale` binary into bash script that passes CLI args transparently to the binary and if `up` command was called, then it will perform route cleanup.

But it's pretty inconvenient too.

### How should we solve this?

It seems like this problem could be fixed by introducing such feature as hooks. A hook can be a simple command or script, that should be executed at a particular point of the connection lifecycle.

Hooks can be of several types:
- Pre-up - before the connection establishment
- Post-up - after the connection establishment
- Pre-down - before the connection interruption
- Post-down - after the connection interruption

Lifecycle scheme:
```
pre-up post-up pre-down post-down
| | | |
v v v v
tailscale up --- (establishment) --- tailscale down --- (interruption) --->
```

In addition to solving this particular problem, this feature should bring a lot of flexibility to customize end users 'scenarios.

Possilbe CLI for the hooks:
1. Inline hooks:
- tailscale up|down **--pre-hook='{hook comand or set of commands}'**
- tailscale up|down **--post-hook='{hook comand or set of commands}'**
1. Hooks from script file/directory:
- tailscale up|down **--pre-hook-path='{path to script or directory containing scripts}'**
- tailscale up|down **--post-hook-path='{path to script or directory containing scripts}'**

### What is the impact of not solving this?

_No response_

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.