{ ... }:

# Headscale — self-hosted control server for the tailnet. Every host's
# services/vpn/tailscale.nix points --login-server at https://vpn.mgaction.town
# (this host). MagicDNS base_domain "hosts.mgaction.town" matches the
# "jupiter.hosts.mgaction.town" names used in this repo's Caddy vhosts
# (e.g. hosts/neptun/configuration.nix) — don't change one without the other.
#
# TLS terminates at Caddy (see the host's configuration.nix); headscale
# itself only listens on localhost.
{
  services.headscale = {
    enable = true;
    port = 8082;   # off the default 8080 to stay clear of other web apps

    settings = {
      server_url = "https://vpn.mgaction.town";

      dns = {
        base_domain = "hosts.mgaction.town";
        nameservers.global = [ "1.1.1.1" "9.9.9.9" ];
      };
    };
  };
}