darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

neptun: serve Headplane at vpn.mgaction.town/admin, auth via Zitadel OIDC

Browse Source 
Path-route Headplane under /admin on the same vhost as headscale instead of
its own subdomain - Caddy handle blocks split on the prefix, headscale gets
everything else. base_url drops to the site root since Headplane appends
/admin (and the OIDC callback path) itself.

Wire Zitadel as the OIDC provider. client_id/client_secret/the headscale
API key can't be real until Zitadel and headscale are actually deployed and
an application/key exist, so those are REPLACE_ME placeholders for now
(documented in services/headplane.nix) - direct API-key login stays enabled
as a fallback so this can't lock anyone out in the meantime.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
darman
2026-07-19 22:42:03 +02:00
co-authored by Claude Sonnet 5
parent 5507dfac0a
commit c4702b577c
4 changed files with 51 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/headplane.nix
+27 -5
View File
@@ -4,17 +4,39 @@
# first). Runs as headscale's own OS user via "native process integration",
# so it can restart headscale when settings change from the UI.
#
# No OIDC wired up — log in with a headscale API key instead
# (`headscale apikeys create` on the box, pasted into the Headplane login
# page). headscale.url/config_path/public_url all default correctly off of
# services.headscale's own options, so nothing to repeat here.
# Served at vpn.mgaction.town/admin (path-routed alongside headscale itself
# by Caddy — see hosts/neptun/configuration.nix), not its own subdomain.
# base_url is the site root WITHOUT the /admin prefix — Headplane appends
# that itself, including for the OIDC callback (.../admin/oidc/callback).
#
# Auth is Zitadel (services/zitadel.nix), via OIDC. client_id isn't secret
# (it's a public identifier) so it's a plain string here, but it — along
# with client_secret and the headscale API key — can't be known until
# Zitadel/headscale are actually deployed and running. Until then these are
# placeholders; direct headscale-API-key login (disable_api_key_login stays
# false) still works as a fallback so this doesn't lock anyone out. Once
# live:
# 1. In Zitadel: create a project + a Web application for Headplane, with
# redirect URI https://vpn.mgaction.town/admin/oidc/callback. Copy the
# generated client ID into oidc.client_id below.
# 2. `./scripts/edit_secrets secrets/neptun.yaml` and replace
# headplane_oidc_client_secret with the app's client secret.
# 3. `headscale apikeys create` on the box, and replace
# headplane_headscale_api_key the same way.
{
services.headplane = {
enable = true;
settings.server = {
cookie_secret_path = config.sops.secrets.headplane_cookie_secret.path;
cookie_secure = true; # served over HTTPS via Caddy
base_url = "https://headplane.mgaction.town";
base_url = "https://vpn.mgaction.town";
};
settings.oidc = {
issuer = "https://auth.mgaction.town";
client_id = "REPLACE_ME_zitadel_client_id"; # not secret, but not known until the app exists in Zitadel
client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path;
headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path;
};
};
}