Paul Payne
e25b07126c
Patch/minor bumps: - akaunting: 3.1.21 -> 3.2.3 - aptly: 1.6.2 -> 1.6.3 - baserow: 2.2.2 -> 2.4.1 - crowdsec: v1.7.8 -> v1.8.1 - docker-registry: 3.0.0 -> 3.1.2 - etherpad: 2.2.7 -> 2.6.1 - headlamp: v0.42.0 -> v0.46.0 - headscale: 0.29.1 -> 0.29.5 - indico: 3.3.12 -> 3.3.14 - karrot: v17.4.1 -> v17.4.2 - keila: 0.17.1 -> 0.30.3 - lemmy: 0.19.15 -> 0.19.19 - loomio: 3.0.24 -> 3.12.0 - mastodon: 4.5.3 -> 4.7.3 - mautic: 7.1.2 -> 7.2.1 - memcached: 1.6.32 -> 1.6.45 - mobilizon: 5.2.3 -> 5.2.4 - nocodb: 2026.04.1 -> 2026.09.1 - open-webui: 0.9.5 -> 0.12.3 - outline: 1.8.1 -> 1.11.0 - peertube: 8.2.1 -> 8.2.4 - pixelfed: 0.12.7 -> 0.15.1 - pretix: 2026.5.1 -> 2026.8.0 - synapse: v1.144.0 -> v1.163.0 - traefik: v3.4.1 -> v3.7.16 - typebot: 3.17.1 -> 3.19.1 - vaultwarden: 1.37.1 -> 1.37.4 - writefreely: 0.15.1 -> 0.17.2 Multi-file updates for apps with workers/sidekiq/streaming: - mastodon (5 files), indico (3 files), karrot (4 files), lemmy (2 files), loomio (2 files), typebot (2 files), pixelfed (2 files), synapse (2 refs), pretix (2 refs), aptly (2 refs)
Headscale
Headscale is an open-source, self-hosted implementation of the Tailscale control plane. It lets you run your own private WireGuard-based mesh VPN using the Tailscale client.
Configuration
Key settings in config.yaml:
- domain - Where the Headscale control plane API is accessible
- vpnBaseDomain - Base domain for MagicDNS hostnames assigned to nodes (default:
vpn.{your-cloud-domain}) - storage - Persistent volume size (default:
2Gi)
First-Time Setup
-
Add and deploy the app:
wild app add headscale wild app deploy headscale -
Create a user (namespace) in Headscale:
kubectl exec -n headscale deploy/headscale -- headscale users create <username> -
Generate a pre-auth key for that user:
kubectl exec -n headscale deploy/headscale -- headscale preauthkeys create --user <user-id> --reusable --expiration 24hNote:
--userrequires the numeric user ID, not the username. Runheadscale users listto get the ID. -
On each device you want to join the VPN, install the Tailscale client and connect it to your Headscale instance:
tailscale up --login-server https://<your-headscale-domain> --authkey <preauthkey>
Registering Nodes via Browser Auth
If a Tailscale client connects without a pre-auth key, it shows an auth URL in its logs. Register that node with:
kubectl exec -n headscale deploy/headscale -- headscale nodes register --auth-id <hskey-authreq-XXXX> --user <username>
Note: --user here accepts the username string (not the numeric ID).
Useful Commands
# List users
kubectl exec -n headscale deploy/headscale -- headscale users list
# List connected nodes
kubectl exec -n headscale deploy/headscale -- headscale nodes list
# Create a pre-auth key (requires numeric user ID)
kubectl exec -n headscale deploy/headscale -- headscale preauthkeys create --user <id> --reusable
# Delete a node
kubectl exec -n headscale deploy/headscale -- headscale nodes delete --identifier <node-id>
Notes
- Headscale uses SQLite by default — no external database dependency
- Configuration is managed via a ConfigMap (
headscale-config) — changes require restarting the pod - In Headscale v0.29+, different commands accept different user identifier types:
preauthkeysandusers destroyrequire the numeric ID, whilenodes registeraccepts the username string