{config, pkgs, lib, ...}:
{

services.headscale = {
  enable = true;
  port = 3001;
  settings = {
    server_url = "https://head.${config.domain}";
    dns.base_domain = "hn.${config.domain}";
    dns.nameservers.global = [ config.tailnetIPs.blunix ];
    logtail.enabled = false;
    oidc = {
      client_id = "headscale";
      client_secret_path = config.age.secrets.oidcHeadscale.path;
      issuer = "https://dex.${config.domain}/dex";
      scope = [
        "openid"
        "profile"
        "email"
        "groups"
      ];
      allowed_groups =  [ "intern" ];
  };
};
};

systemd.services.headscale.restartTriggers = [
  config.age.secrets.oidcHeadscale.file
];

}