{ config, ... }:

{
  services.headscale = {
    enable = true;
    port = 3001;
    settings = {
      server_url = "https://head.${config.domain2}";
      dns = {
        base_domain = "hn.${config.domain2}";
        # Kein globaler Resolver: Clients behalten ihr normales DNS.
        # unbound-pinix wird nur per Split-DNS fuer die Namen verteilt, die
        # er selbst beantwortet (tailnet-dns.nix).
        override_local_dns = false;
        nameservers.global = [ ];
      };
      logtail.enabled = false;
      oidc = {
        client_id = "headscale";
        client_secret_path = config.age.secrets.oidcHeadscale.path;
        issuer = "https://dex.${config.domain2}/dex";
        scope = [
          "openid"
          "profile"
          "email"
          "groups"
        ];
        # Only the intended personal account may create OIDC nodes. The
        # pinix LLDAP user `lukas` is a member of this group; the bootstrap
        # admin account remains usable for directory administration but is no
        # longer authorized to create another Headscale identity.
        allowed_groups = [ "intern" ];
      };
    };
  };

  # OIDC discovery happens at startup over HTTPS, through Traefik. Ordering
  # does not guarantee readiness; the module's restart policy retries.
  systemd.services.headscale = {
    after = [ "dex.service" "traefik.service" ];
    wants = [ "dex.service" "traefik.service" ];
    restartTriggers = [ config.age.secrets.oidcHeadscale.file ];
  };
}