From 01a20fff4ed653bb4530cb33f0458c1f4d0f570f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Fri, 14 Aug 2026 17:43:42 +0000 Subject: [PATCH] the invite flow replaced device enrolment; it is not a gap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit closes the one open item left by deleting /api/vpn. removing the vpn capability leaves no member-grantable headscale surface and that is correct: the owner mints an invite from the headscale app, the companion turns it into the redirect the phone claims, and the device joins. no per-member permission on officer is involved at any step. recorded as decided rather than open so nobody reintroduces a member-facing enrolment route believing something was lost. nothing was — /api/vpn/enroll was the design the invite flow replaced, and it never had a UI. Co-Authored-By: Claude Opus 5 --- docs/offscale-plugin.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/docs/offscale-plugin.md b/docs/offscale-plugin.md index b1e961a8..c09aba57 100644 --- a/docs/offscale-plugin.md +++ b/docs/offscale-plugin.md @@ -271,9 +271,17 @@ in the invite (`https:///officer-api`). (`EXEMPT_API_PREFIXES`) because Bitwarden clients carry a Vaultwarden bearer rather than a platform JWT. The exemption must be declared with a reason or the boot check refuses. Not needed today. -**Open:** the `vpn` capability is the only member-grantable piece of headscale — everything else is -`admin`. If it disappears with the route, members lose the ability to enrol their own devices. Decide -deliberately rather than losing it in the move. +**Not an open question — decided.** Removing `vpn` leaves no member-grantable headscale surface, and that +is correct. The invite flow supersedes it completely: + +1. the Officer headscale app holds an admin API key for the Headscale server +2. from it the owner mints an **invite** — a URL pointing at the Companion +3. the Companion turns that into the redirect the phone app claims +4. the device joins + +That path needs no per-member permission on Officer at all, and it is the one that exists and works. +`/api/vpn/enroll` was the design it replaced, not a capability still waiting for a UI — there never was +one. Do not reintroduce a member-facing enrolment route on the assumption something is missing. ---