how to use DERP_VERIFY_CLIENT_URL

[ench2]

if i set - DERP_VERIFY_CLIENT_URL=http://aa.bb.com/verify

and what is the code in url http://aa.bb.com/verify

[kaaanata]

DERP_VERIFY_CLIENT_URL is an environment variable that allows you to set up client admission control for your DERP server.

How it works:

1. When a Tailscale client tries to connect to your DERP server
2. The DERP server makes a POST request to your verification URL
3. Your endpoint returns {"allow": true} or {"allow": false}
4. The DERP server accepts or rejects the client based on your response

Request format (what DERP sends to your URL):

{
  "nodePublic": "nodekey:abc123...",
  "source": "192.168.1.100"
}

Response format (what your server should return):

{
  "allow": true
}

Usage:

docker run -d \
  -e DERP_VERIFY_CLIENT_URL=http://your-server:8080/verify \
  fredliang/derper

[europacafe]

So if I'm using headscale, the url must be my headscale url with verify, e.g., https://headscale.mydomain.com/verify.

To test:

1. to obtain full node key: sudo tailscale status --json
2. to test true or false for such node key: curl https://headscale.mydomain.com/verify -d '{"nodePublic": "nodekey:fbf5c3789ffc......ed3644f35dfda1b133e79a032c", "source": "192.168.2.1"}'