pastilhasandClaude Opus 5
e13128846b
headscale leaves the platform. 45 files move to plugins/offscale/ and the
platform stops knowing it exists.
api/router.ts the thin auth-gated proxy, now at /api/offscale
sidecar/ 18 files, the whole headscale contract and its admin keys
db/ schema + queries, offscale_servers
web/ 26 files as panels and a layout — no screen, per the rule
removed from the platform: the hono mount, the `headscale` capability, the
App.tsx route pair, the screen and its barrel, the AppRegistry spread, the
officerdev re-exports, the dock tile, the page-title rule, and both database
barrels. tsgo is clean and nothing references it.
the imports tell the story of what the plugin↔host API actually is. the sidecar
takes @@/sidecar/protocol, @@/sidecar/connect, @@/data-path and
@@/officer-url.mjs; the queries take officerdb/db and officerdb/crypto; the
schema takes officerdb/auth/schema for the one reference a plugin may make; the
web half takes useClient, copyToClipboard, WorkspaceView and TerminalView from
the officerdev barrel. all of it resolves because a plugin lives inside the repo
— no publishing, no version negotiation.
AND IT FOUND A REAL BUG IN THE INSTALLER. createSidecarProxy learns its port
from a one-shot `<name>:server` event and subscribes when the plugin's router is
first imported — at mount. install started the sidecar BEFORE mounting, so the
announcement fired into a void: process online, routes mounted, every request
answering `503 sidecar not available` until something forced a reconnect. it
would have hit every plugin with an http sidecar. `example` never caught it
because it has no listener to announce.
install and enable now mount before starting; disable still unmounts before
stopping. neither direction leaves a mounted route in front of a sidecar that
cannot be reached.
verified live: /api/offscale/_officer/servers answers {"servers":[]}, /offscale
and /offscale/nodes serve, the old /api/headscale is 404, the offscale
capability is registered from the manifest, and officer-offscale is online.
757 pass, same 10 pre-existing failures.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
47 lines
2.2 KiB
TypeScript
47 lines
2.2 KiB
TypeScript
import type { PluginManifest } from '@@/plugins/manifest';
|
|
|
|
// Offscale — Headscale, plus the Companion that ships beside it.
|
|
//
|
|
// Not a rename of Headscale and not a fork: the server underneath is stock, and the Companion adds what
|
|
// Headscale itself does not do — the invite flow being the first of them. The distinct name marks a
|
|
// distinct product rather than a badge on someone else's.
|
|
//
|
|
// The first real plugin, extracted from the platform on 2026-08-15. Everything it needs is here:
|
|
//
|
|
// api/router.ts a thin auth-gated proxy — no Headscale knowledge, and it must never grow any
|
|
// sidecar/ the whole Headscale contract, holding the admin API keys
|
|
// db/ offscale_servers, and the only table this plugin owns
|
|
// web/ panels and a layout; the shell renders the Workspace
|
|
export const manifest: PluginManifest = {
|
|
publisher: 'officerdev',
|
|
version: '1.0.0',
|
|
platform: '>=1.0.0',
|
|
|
|
label: 'Offscale',
|
|
summary: 'Your tailnet — machines, users, pre-auth keys, access policy and device invites',
|
|
icon: 'Network',
|
|
color: '#818cf8',
|
|
|
|
// One permission gating the whole surface.
|
|
//
|
|
// `ownerOnly` because the credential behind it is a Headscale ADMIN api key that can delete every node
|
|
// on a tailnet, and there is no read-only version of it. A read grant would still be reading through
|
|
// that key; the protection is that non-owners cannot reach the routes at all.
|
|
//
|
|
// Read/write for members is the model recorded in docs/offscale-plugin.md and deliberately not enabled
|
|
// here yet: it needs the queries to resolve to the OWNER's rows rather than the caller's, which is a
|
|
// change inside this plugin and not a flag.
|
|
permissions: [
|
|
{
|
|
key: 'offscale',
|
|
label: 'Offscale',
|
|
description: 'The tailnet: machines, routes, keys and ACLs',
|
|
ownerOnly: true,
|
|
// Two POSTs that are really reads — a reachability probe and a policy DRAFT that never saves.
|
|
// Without declaring them a read-level account meets a broken feature where a withheld permission
|
|
// should be. Inert while ownerOnly, and correct the moment that changes.
|
|
readOnlyWrites: ['/ssh-test', '/policy/assist'],
|
|
},
|
|
],
|
|
};
|