{ config, ... }:

# Headplane — web UI for headscale (services/vpn/headscale.nix; enable first),
# running as headscale's OS user.
#
# It reads headscale's config from the nix store, so the UI DISPLAYS settings
# but can't change them (edit here and rebuild instead) — except DNS
# extra-records, which are data rather than config, hence the writable
# extra_records file below.
#
# Served at vpn.mgaction.town/admin (path-routed with headscale, see
# hosts/neptun/configuration.nix); base_url excludes the /admin prefix, which
# Headplane appends itself including for the OIDC callback.
#
# Auth is Authentik via OIDC; client_id/client_secret/API key are placeholders
# until Authentik/headscale are deployed (direct API-key login works as a
# fallback until then). Once live:
#   1. In Authentik: create an OAuth2/OpenID Provider + Application with slug
#      `headplane` and redirect URI
#      https://vpn.mgaction.town/admin/oidc/callback. Copy the generated
#      client ID into oidc.client_id below.
#   2. `./scripts/edit_secrets secrets/neptun.yaml` and replace
#      headplane_oidc_client_secret with the provider's client secret.
#   3. `headscale apikeys create` on the box, and replace
#      headplane_headscale_api_key the same way.
{
  # Writable DNS extra-records, shared by both services (they run as the same
  # user). tmpfiles seeds an empty JSON array — headscale won't start against
  # a missing or unparseable file.
  systemd.tmpfiles.rules = [
    "d /var/lib/headscale 0750 headscale headscale -"
    "f /var/lib/headscale/extra_records.json 0640 headscale headscale - []"
  ];
  services.headscale.settings.dns.extra_records_path = "/var/lib/headscale/extra_records.json";

  services.headplane = {
    enable = true;
    settings.headscale.dns_records_path = "/var/lib/headscale/extra_records.json";

    settings.server = {
      cookie_secret_path = config.sops.secrets.headplane_cookie_secret.path;
      cookie_secure = true;   # served over HTTPS via Caddy
      base_url = "https://vpn.mgaction.town";
    };

    settings.oidc = {
      issuer = "https://auth.mgaction.town/application/o/headplane/";
      # Not a secret — Authentik hands the client ID out at the authorize
      # endpoint. Regenerating the provider in Authentik changes it.
      client_id = "NNzYUrSBlCqxyCTfxlEJRpT5v5EQWHLpfOsXBine";
      client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path;
      headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path;
    };
  };
}