{ ... }:

# Headscale — self-hosted control server for the tailnet. Every host's
# services/tailscale.nix points --login-server at https://vpn.mgaction.town
# (this host). MagicDNS base_domain "hosts.mgaction.town" matches the
# "jupiter.hosts.mgaction.town" style names already used throughout this
# repo's Caddy vhosts (e.g. hosts/neptun/configuration.nix) — don't change
# one without the other.
#
# TLS terminates at Caddy (see the host's configuration.nix for the vhost,
# proxying with `flush_interval -1` since headscale's node-update endpoint
# is a long-poll and needs unbuffered responses); headscale itself only
# listens on localhost.
{
  services.headscale = {
    enable = true;
    port = 8082;   # zitadel already sits on the usual 8080 on this host

    settings = {
      server_url = "https://vpn.mgaction.town";

      dns = {
        base_domain = "hosts.mgaction.town";
        nameservers.global = [ "1.1.1.1" "9.9.9.9" ];
      };
    };
  };
}