apiVersion: v1
kind: ConfigMap
metadata:
  name: headscale-config
  namespace: {{ .namespace }}
data:
  config.yaml: |
    server_url: "https://{{ .domain }}"
    listen_addr: "0.0.0.0:8080"
    grpc_listen_addr: "0.0.0.0:50443"
    grpc_allow_insecure: false
    metrics_listen_addr: "127.0.0.1:9090"

    # Trust forwarded IPs from Traefik ingress
    trusted_proxies:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"

    log:
      level: info
      format: text

    database:
      type: sqlite
      sqlite:
        path: /var/lib/headscale/db.sqlite
        write_ahead_log: true
        wal_autocheckpoint: 1000

    policy:
      mode: file
      path: /etc/headscale/acls.hujson

    tls_letsencrypt_hostname: ""
    tls_cert_path: ""
    tls_key_path: ""

    noise:
      private_key_path: /var/lib/headscale/noise_private.key

    prefixes:
      v6: fd7a:115c:a1e0::/48
      v4: 100.64.0.0/10
      allocation: sequential

    derp:
      server:
        enabled: false
        region_id: 999
        region_code: headscale
        region_name: Headscale Embedded DERP
        stun_listen_addr: "0.0.0.0:3478"
        private_key_path: /var/lib/headscale/derp_server_private.key
        automatically_add_embedded_derp_region: true
      urls:
        - https://controlplane.tailscale.com/derpmap/default
      paths: []
      auto_update_enabled: true
      update_frequency: 24h

    dns:
      magic_dns: true
      base_domain: {{ .vpnBaseDomain }}
      override_local_dns: true
      nameservers:
        global:
          - 1.1.1.1
          - 1.0.0.1
      search_domains: []

    node:
      ephemeral:
        inactivity_timeout: 30m

    unix_socket: /var/lib/headscale/headscale.sock
    unix_socket_permission: "0770"

  acls.hujson: |
    {
      "acls": [
        {
          "action": "accept",
          "src": ["*"],
          "dst": ["*:*"]
        }
      ]
    }