darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

neptun: serve Headplane at vpn.mgaction.town/admin, auth via Zitadel OIDC

Browse Source 
Path-route Headplane under /admin on the same vhost as headscale instead of
its own subdomain - Caddy handle blocks split on the prefix, headscale gets
everything else. base_url drops to the site root since Headplane appends
/admin (and the OIDC callback path) itself.

Wire Zitadel as the OIDC provider. client_id/client_secret/the headscale
API key can't be real until Zitadel and headscale are actually deployed and
an application/key exist, so those are REPLACE_ME placeholders for now
(documented in services/headplane.nix) - direct API-key login stays enabled
as a fallback so this can't lock anyone out in the meantime.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
darman
2026-07-19 22:42:03 +02:00
co-authored by Claude Sonnet 5
parent 5507dfac0a
commit c4702b577c
4 changed files with 51 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/neptun/secrets.nix
+5
View File
@@ -38,5 +38,10 @@
'';
# Headplane: cookie_secret_path takes a path natively (no store leak).
# oidc.client_secret + the headscale API key are still REPLACE_ME
# placeholders (see services/headplane.nix) until Zitadel/headscale are
# actually deployed and those get created for real.
sops.secrets.headplane_cookie_secret = { };
sops.secrets.headplane_oidc_client_secret = { };
sops.secrets.headplane_headscale_api_key = { };
}