feat: headscale implementation

- Headscale server
- Using goodieshq/headscale-admin as ui
- UI protected by security-chain
- Metrics available at /metrics

headscale/compose.yaml

@@ -12,47 +12,67 @@ services:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"
       - "traefik.http.services.headscale.loadbalancer.server.port=8080"
+      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
 
+      ## SERVICE
       # Prod Router
-      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`) && PathPrefix(`/`)"
+      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
       - "traefik.http.routers.headscale.entrypoints=websecure"
       - "traefik.http.routers.headscale.service=headscale"
       - "traefik.http.routers.headscale.tls=true"
       # Local Router
-      - "traefik.http.routers.headscale.rule=Host(`hs.workstation.internal`) && PathPrefix(`/`)"
+      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
-      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale-local.entrypoints=websecure"
-      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale-local.service=headscale"
-      - "traefik.http.routers.headscale.tls=true"
+      - "traefik.http.routers.headscale-local.tls=true"
       # Dev Router
-      - "traefik.http.routers.headscale.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/`)"
+      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
-      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
-      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale-dev.service=headscale"
-      - "traefik.http.routers.headscale.tls=true"
+      - "traefik.http.routers.headscale-dev.tls=true"
-  ui:
+
-    image: ghcr.io/gurucomputing/headscale-ui:latest
+      ## METRICS
-    container_name: headscale-ui
+      # Prod Router
+      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-dev.tls=true"
+  admin-ui:
+    image: goodieshq/headscale-admin:latest
     restart: unless-stopped
     networks:
       - proxy
     labels:
-      # My normal config
       - "traefik.enable=true"
-      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
       - "treafik.docker.network=proxy"
-
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+      
       # Prod Router
-      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/web`)"
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
       - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
       - "traefik.http.routers.headscale-ui.service=headscale-ui"
       - "traefik.http.routers.headscale-ui.tls=true"
       # Local Router
-      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/web`)"
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
       - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
       - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
       - "traefik.http.routers.headscale-ui-local.tls=true"
       # Dev Router
-      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/web`)"
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
       - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
       - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
       - "traefik.http.routers.headscale-ui-dev.tls=true"
 

headscale/config/config.yaml.example

@@ -0,0 +1,79 @@
+# https://wiki.serversatho.me/en/headscale
+
+# # Prod server_url
+# server_url: https://hs.example.com
+# # Local server_url
+# server_url: https://hs.internal_domain.internal
+# # Dev server_url
+# server_url: https://hs.dev_internal_domain.internal
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+disable_check_updates: false
+ephemeral_node_inactivity_timeout: 30m
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+log:
+  format: text
+  level: info
+policy:
+  mode: database
+  path: ""
+dns:
+  magic_dns: true
+  base_domain: example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+      - 2606:4700:4700::1111
+      - 2606:4700:4700::1001
+    split: {}
+  search_domains: []
+  extra_records: []
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false
+randomize_client_port: false