Request for Configuration of --verify-clients Parameter in Built-in DERP

[zsio]

I am currently using the built-in DERP in Headscale and I noticed that the --verify-clients parameter is not configurable. This situation implies that the DERP I am using could be publicly accessible, which raises security concerns.

I am writing to inquire if there is a possibility to restrict the use of the built-in DERP to my clients only. This feature will greatly enhance the security of my connections and ensure that only authorized clients can use the DERP.

Looking forward to your response and potential solutions to this issue.

[StudyingLover]

I am considering migrating from Tailscale to Headscale, but I hesitated when I suddenly notice this issue because I cannot tolerate others freeloading on my server without my permission.

[masterwishx]

Also interested in this future as using my own DERP server...

[ShadowJonathan]

When researching tailscale I noticed this fairly subtle codepath being used for it, it requires an active embedded tailscale client to be sending peer updates to the derp server, apparantly.