darmanandClaude Sonnet 5
5507dfac0a
Headscale is the tailnet control server every host's services/tailscale.nix already points at (--login-server=https://vpn.mgaction.town). MagicDNS base_domain "hosts.mgaction.town" matches the "jupiter.hosts.mgaction.town" names already used in this repo's Caddy vhosts. Headplane is its web UI, running as headscale's own user (native process integration, no container). No OIDC wired up - log in with a headscale API key generated on the box. Both proxied through Caddy; headscale's vhost needs flush_interval -1 since its node-update endpoint is a long-poll. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
786 B
Nix
21 lines
786 B
Nix
{ config, ... }:
|
|
|
|
# Headplane — web UI for headscale (services/headscale.nix; must be enabled
|
|
# first). Runs as headscale's own OS user via "native process integration",
|
|
# so it can restart headscale when settings change from the UI.
|
|
#
|
|
# No OIDC wired up — log in with a headscale API key instead
|
|
# (`headscale apikeys create` on the box, pasted into the Headplane login
|
|
# page). headscale.url/config_path/public_url all default correctly off of
|
|
# services.headscale's own options, so nothing to repeat here.
|
|
{
|
|
services.headplane = {
|
|
enable = true;
|
|
settings.server = {
|
|
cookie_secret_path = config.sops.secrets.headplane_cookie_secret.path;
|
|
cookie_secure = true; # served over HTTPS via Caddy
|
|
base_url = "https://headplane.mgaction.town";
|
|
};
|
|
};
|
|
}
|