{ config, ... }:

# Headplane — web UI for headscale (services/headscale.nix; must be enabled
# first). Runs as headscale's own OS user via "native process integration",
# so it can restart headscale when settings change from the UI.
#
# No OIDC wired up — log in with a headscale API key instead
# (`headscale apikeys create` on the box, pasted into the Headplane login
# page). headscale.url/config_path/public_url all default correctly off of
# services.headscale's own options, so nothing to repeat here.
{
  services.headplane = {
    enable = true;
    settings.server = {
      cookie_secret_path = config.sops.secrets.headplane_cookie_secret.path;
      cookie_secure = true;   # served over HTTPS via Caddy
      base_url = "https://headplane.mgaction.town";
    };
  };
}