44 lines
1.5 KiB
Nix
44 lines
1.5 KiB
Nix
{ config, ... }:
|
|
|
|
{
|
|
services.headscale = {
|
|
enable = true;
|
|
port = 3001;
|
|
settings = {
|
|
server_url = "https://head.${config.domain2}";
|
|
dns = {
|
|
base_domain = "hn.${config.domain2}";
|
|
# Kein globaler Resolver: Clients behalten ihr normales DNS.
|
|
# unbound-pinix wird nur per Split-DNS fuer die Namen verteilt, die
|
|
# er selbst beantwortet (tailnet-dns.nix).
|
|
override_local_dns = false;
|
|
nameservers.global = [ ];
|
|
};
|
|
logtail.enabled = false;
|
|
oidc = {
|
|
client_id = "headscale";
|
|
client_secret_path = config.age.secrets.oidcHeadscale.path;
|
|
issuer = "https://dex.${config.domain2}/dex";
|
|
scope = [
|
|
"openid"
|
|
"profile"
|
|
"email"
|
|
"groups"
|
|
];
|
|
# Only the intended personal account may create OIDC nodes. The
|
|
# pinix LLDAP user `lukas` is a member of this group; the bootstrap
|
|
# admin account remains usable for directory administration but is no
|
|
# longer authorized to create another Headscale identity.
|
|
allowed_groups = [ "intern" ];
|
|
};
|
|
};
|
|
};
|
|
|
|
# OIDC discovery happens at startup over HTTPS, through Traefik. Ordering
|
|
# does not guarantee readiness; the module's restart policy retries.
|
|
systemd.services.headscale = {
|
|
after = [ "dex.service" "traefik.service" ];
|
|
wants = [ "dex.service" "traefik.service" ];
|
|
restartTriggers = [ config.age.secrets.oidcHeadscale.file ];
|
|
};
|
|
}
|