darmanandClaude Opus 4.8
ac42f231f5
nixpkgs only carries Zitadel 2.71, which predates the login-v2 split and
cannot take a v3/v4 database (its migrations are forward-only), so the
instance running on the old Debian VPS could never have moved onto it.
authentik-nix ships 2026.5.4 and tracks upstream closely.
The authentik-nix input deliberately does not follow our nixpkgs, per
upstream's warning that overriding it breaks their pinned python
dependency set. That costs a second nixpkgs in the lock, so add
nix-community's Cachix to common.nix -- without it the closure is ~400
local derivations (npm, rust, python). The laptop that runs
scripts/deploy needs the same two lines in /etc/nix/nix.custom.conf.
Authentik's own module creates the database and orders its units against
postgresql.target, and recent versions need no redis, so the wiring is
just the module plus a secret. Pin postgresql explicitly so that editing
system.stateVersion can never silently demand a pg_upgrade of the
identity store.
Secret ownership is not uniform and the difference matters: authentik
and caddy take a systemd EnvironmentFile, which PID 1 reads as root
before dropping privileges, so root:root 0400 is correct. Headplane
opens its secret paths itself while already running as the headscale
user, so those three need an explicit owner or they fail to start.
Also on neptun:
- Pass Caddy's ACME account email through the same EnvironmentFile
mechanism and reference it with the Caddyfile {$VAR} placeholder.
services.caddy.email would render the address into the world-readable
store.
- Stop accepting MagicDNS from our own control server. headscale pushes
override_local_dns, so joining the tailnet would point neptun's
resolv.conf at a MagicDNS served by the tailscaled neptun itself hosts
-- a tailscaled failure would then also take out DNS, ACME renewal and
finally the certs for the control server every other node needs in
order to recover.
- Give headplane a writable DNS extra-records file. Its view of
headscale's config stays read-only, which is the right outcome for a
declarative box; records are data rather than config.
- Require a password for sudo. Deploys become interactive, but darman's
key is otherwise the only thing between the public internet and root.
- Enable zram (8 GB, and disko leaves no room for a swap device), and let
tailscaled-autoconnect retry instead of failing permanently when the
control server isn't up yet on a first boot.
networking.hosts still carries a PLACEHOLDER address for jupiter --
replace it from `headscale nodes list` once jupiter first enrols.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
2.9 KiB
Nix
62 lines
2.9 KiB
Nix
{ config, ... }:
|
|
|
|
# Headplane — web UI for headscale (services/vpn/headscale.nix; must be enabled
|
|
# first), running as headscale's own OS user.
|
|
#
|
|
# It reads headscale's config from the nix store, which is read-only — so the
|
|
# UI DISPLAYS the settings but can't change them. That's the intended shape
|
|
# for a declaratively-configured box (config_strict already defaults off
|
|
# upstream for exactly this reason); edit them here and rebuild instead.
|
|
# DNS extra-records are the one thing worth making editable, since they're
|
|
# data rather than config — hence the writable extra_records file below,
|
|
# which also spares headplane from restarting headscale on every change.
|
|
#
|
|
# Served at vpn.mgaction.town/admin (path-routed alongside headscale itself,
|
|
# see hosts/neptun/configuration.nix). base_url is the site root WITHOUT the
|
|
# /admin prefix — Headplane appends that itself, including for the OIDC
|
|
# callback.
|
|
#
|
|
# Auth is Authentik (services/identity/authentik.nix) via OIDC. client_id,
|
|
# client_secret, and the headscale API key can't be known until
|
|
# Authentik/headscale are actually deployed, so they're placeholders below;
|
|
# direct API-key login still works as a fallback until then. Once live:
|
|
# 1. In Authentik: create an OAuth2/OpenID Provider + Application with slug
|
|
# `headplane` and redirect URI
|
|
# https://vpn.mgaction.town/admin/oidc/callback. Copy the generated
|
|
# client ID into oidc.client_id below.
|
|
# 2. `./scripts/edit_secrets secrets/neptun.yaml` and replace
|
|
# headplane_oidc_client_secret with the provider's client secret.
|
|
# 3. `headscale apikeys create` on the box, and replace
|
|
# headplane_headscale_api_key the same way.
|
|
#
|
|
# NOTE: Authentik issues per-application, so the issuer carries the app slug —
|
|
# it is NOT the bare host the way Zitadel's was.
|
|
{
|
|
# Writable DNS extra-records, shared by both services (they run as the same
|
|
# user). tmpfiles seeds an empty JSON array — headscale won't start against
|
|
# a missing or unparseable file.
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/headscale 0750 headscale headscale -"
|
|
"f /var/lib/headscale/extra_records.json 0640 headscale headscale - []"
|
|
];
|
|
services.headscale.settings.dns.extra_records_path = "/var/lib/headscale/extra_records.json";
|
|
|
|
services.headplane = {
|
|
enable = true;
|
|
settings.headscale.dns_records_path = "/var/lib/headscale/extra_records.json";
|
|
|
|
settings.server = {
|
|
cookie_secret_path = config.sops.secrets.headplane_cookie_secret.path;
|
|
cookie_secure = true; # served over HTTPS via Caddy
|
|
base_url = "https://vpn.mgaction.town";
|
|
};
|
|
|
|
settings.oidc = {
|
|
issuer = "https://auth.mgaction.town/application/o/headplane/";
|
|
client_id = "REPLACE_ME_authentik_client_id"; # not secret, but not known until the app exists in Authentik
|
|
client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path;
|
|
headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path;
|
|
};
|
|
};
|
|
}
|