Adds headscale app.

2026-06-19 21:33:05 +00:00
parent 777bab792c
commit 761712ba71
11 changed files with 343 additions and 0 deletions
--- a/headscale/versions/1/configmap.yaml
+++ b/headscale/versions/1/configmap.yaml
@@ -0,0 +1,88 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: headscale-config
+  namespace: {{ .namespace }}
+data:
+  config.yaml: |
+    server_url: "https://{{ .domain }}"
+    listen_addr: "0.0.0.0:8080"
+    grpc_listen_addr: "0.0.0.0:50443"
+    grpc_allow_insecure: false
+    metrics_listen_addr: "127.0.0.1:9090"
+
+    # Trust forwarded IPs from Traefik ingress
+    trusted_proxies:
+      - "10.0.0.0/8"
+      - "172.16.0.0/12"
+      - "192.168.0.0/16"
+
+    log:
+      level: info
+      format: text
+
+    database:
+      type: sqlite
+      sqlite:
+        path: /var/lib/headscale/db.sqlite
+        write_ahead_log: true
+        wal_autocheckpoint: 1000
+
+    policy:
+      mode: file
+      path: /etc/headscale/acls.hujson
+
+    tls_letsencrypt_hostname: ""
+    tls_cert_path: ""
+    tls_key_path: ""
+
+    noise:
+      private_key_path: /var/lib/headscale/noise_private.key
+
+    prefixes:
+      v6: fd7a:115c:a1e0::/48
+      v4: 100.64.0.0/10
+      allocation: sequential
+
+    derp:
+      server:
+        enabled: false
+        region_id: 999
+        region_code: headscale
+        region_name: Headscale Embedded DERP
+        stun_listen_addr: "0.0.0.0:3478"
+        private_key_path: /var/lib/headscale/derp_server_private.key
+        automatically_add_embedded_derp_region: true
+      urls:
+        - https://controlplane.tailscale.com/derpmap/default
+      paths: []
+      auto_update_enabled: true
+      update_frequency: 24h
+
+    dns:
+      magic_dns: true
+      base_domain: {{ .vpnBaseDomain }}
+      override_local_dns: true
+      nameservers:
+        global:
+          - 1.1.1.1
+          - 1.0.0.1
+      search_domains: []
+
+    node:
+      ephemeral:
+        inactivity_timeout: 30m
+
+    unix_socket: /var/lib/headscale/headscale.sock
+    unix_socket_permission: "0770"
+
+  acls.hujson: |
+    {
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }