Implement VPN Service

[majst01]

Description

Dependents:

• Add VPN parameters to apiserver helm-charts#143
• Add VPN parameters to apiserver metal-roles#510

TODO:

• wire up in service.go
• create vpn connected machines cmd
• create headscale client based on optional configuration
• add firewall vpn ip to vpn response
• decide which headscale api version we should start with (v0.27.1 otherwise we get: username cannot start with a number
  • Proposal: disable headscale support in the metal-apiserver until we updated headscale to v0.27.x
• Decide if we should expose more vpn endpoints for admins (like node list)

Update procedure from headscale 0.23.1 -> v0.27.1

Update must be done in incremental steps like so: 0.23.1 -> v0.24.3 -> v0.25.1 -> v0.26.1 -> v0.27.1

When going to v0.26.1 and then to v0.27.1 existing tailscale clients go into offline

k exec -it headscale-5bcfdc76f-4pcgw -- headscale node list
ID | Hostname                             | Name                                 | MachineKey | NodeKey | User                                 | IP addresses                  | Ephemeral | Last seen           | Expiration          | Connected | Expired
1  | 00000000-0000-0000-0000-000000000001 | 00000000-0000-0000-0000-000000000001 | [9WZII]    | [THS1G] | 00000000-0000-0000-0000-000000000001 | 100.64.0.1, fd7a:115c:a1e0::1 | false     | 2025-12-22 17:25:42 | 0001-01-01 00:00:00 | offline   | no

but running systemctl restart tailscaled on the firewall, solves this:

k exec -it headscale-5bcfdc76f-4pcgw -- headscale node list
ID | Hostname                             | Name                                 | MachineKey | NodeKey | User                                 | IP addresses                  | Ephemeral | Last seen           | Expiration          | Connected | Expired
1  | 00000000-0000-0000-0000-000000000001 | 00000000-0000-0000-0000-000000000001 | [9WZII]    | [THS1G] | 00000000-0000-0000-0000-000000000001 | 100.64.0.1, fd7a:115c:a1e0::1 | false     | 2025-12-22 17:28:06 | 0001-01-01 00:00:00 | online    | no 

We should upgrade the production environments with this procedure

[codecov]

Codecov Report

❌ Patch coverage is 61.05919% with 125 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.10%. Comparing base (d79caaa) to head (a2630f3).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/server/vpn-cmd.go	0.00%	49 Missing ⚠️
pkg/service/vpn/admin/vpn-service.go	69.65%	28 Missing and 16 partials ⚠️
cmd/server/serve-cmd.go	28.57%	10 Missing ⚠️
pkg/repository/machine.go	46.66%	4 Missing and 4 partials ⚠️
pkg/service/services.go	0.00%	7 Missing and 1 partial ⚠️
pkg/headscale/client.go	75.00%	3 Missing and 2 partials ⚠️
cmd/server/main.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #102      +/-   ##
==========================================
- Coverage   70.42%   70.10%   -0.33%     
==========================================
  Files         130      134       +4     
  Lines       10546    10844     +298     
==========================================
+ Hits         7427     7602     +175     
- Misses       2352     2451      +99     
- Partials      767      791      +24     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[iljarotar]

TODO

• test in mini-lab