forust/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Wiki Activity

feat: headscale implementation #3

Merged
forust merged 7 commits from feat/tailscale into main 2026-01-02 02:06:50 +00:00
Conversation 0 Commits 7 Files Changed 11
+206 -21
11 changed files with 206 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+10 -6
View File
@@ -2,12 +2,7 @@
sync.ffs_lock
.sync.ffs_db
# Environment
.env
.env.anna
.env.forust
.env.*
!.env.*example
# Volumes and data directories
gitea/gitea-db/
@@ -24,6 +19,8 @@ termix/termix-data/*
cfddns/config.json
checkmk/checkmk/*
downtify/Downtify_downloads
headscale/config/*
headscale/data/*
# Steaming services files
streaming/jellyfin/*
@@ -87,3 +84,10 @@ replacements.txt
# Temp files
edu_master/temp/
temp/*
# Environment
.env
.env.anna
.env.forust
.env.*
!*example
adguardhome/compose.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ services:
- "853:853/tcp" # DNS over TLS
# - "67:67/udp" # DHCP
# - "68:68/tcp" # DHCP
- "3000:3000/tcp"
# - "3000:3000/tcp"
volumes:
- ./data/work:/opt/adguardhome/work
- ./data/conf:/opt/adguardhome/conf
authentik/compose.yaml
+3 -3
View File
@@ -26,9 +26,9 @@ services:
command: server
container_name: authentik-server
restart: unless-stopped
ports:
- ${PORT_HTTP:-9000}:9000
- ${PORT_HTTPS:-9443}:9443
# ports:
# - ${PORT_HTTP:-9000}:9000
# - ${PORT_HTTPS:-9443}:9443
env_file:
- .env
environment:
headscale/compose.yaml
+81
View File
@@ -0,0 +1,81 @@
services:
server:
image: headscale/headscale:latest
restart: unless-stopped
command: serve
networks:
- proxy
volumes:
- ./config:/etc/headscale
- ./data:/var/lib/headscale
labels:
- "traefik.enable=true"
- "traefik.docker.network=proxy"
- "traefik.http.services.headscale.loadbalancer.server.port=8080"
- "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
## SERVICE
# Prod Router
- "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
- "traefik.http.routers.headscale.entrypoints=websecure"
- "traefik.http.routers.headscale.service=headscale"
- "traefik.http.routers.headscale.tls=true"
# Local Router
- "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
- "traefik.http.routers.headscale-local.entrypoints=websecure"
- "traefik.http.routers.headscale-local.service=headscale"
- "traefik.http.routers.headscale-local.tls=true"
# Dev Router
- "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
- "traefik.http.routers.headscale-dev.entrypoints=websecure"
- "traefik.http.routers.headscale-dev.service=headscale"
- "traefik.http.routers.headscale-dev.tls=true"
## METRICS
# Prod Router
- "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
- "traefik.http.routers.headscale-metrics.entrypoints=websecure"
- "traefik.http.routers.headscale-metrics.service=headscale-metrics"
- "traefik.http.routers.headscale-metrics.tls=true"
# Local Router
- "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
- "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
- "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
- "traefik.http.routers.headscale-metrics-local.tls=true"
# Dev Router
- "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
- "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
- "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
- "traefik.http.routers.headscale-metrics-dev.tls=true"
web:
image: goodieshq/headscale-admin:latest
restart: unless-stopped
networks:
- proxy
labels:
- "traefik.enable=true"
- "treafik.docker.network=proxy"
- "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
# Prod Router
- "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
- "traefik.http.routers.headscale-ui.entrypoints=websecure"
- "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
- "traefik.http.routers.headscale-ui.service=headscale-ui"
- "traefik.http.routers.headscale-ui.tls=true"
# Local Router
- "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
- "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
- "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
- "traefik.http.routers.headscale-ui-local.service=headscale-ui"
- "traefik.http.routers.headscale-ui-local.tls=true"
# Dev Router
- "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
- "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
- "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
- "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
- "traefik.http.routers.headscale-ui-dev.tls=true"
networks:
proxy:
external: true
headscale/config/config.yaml.example
+79
View File
@@ -0,0 +1,79 @@
# https://wiki.serversatho.me/en/headscale
# # Prod server_url
# server_url: https://hs.example.com
# # Local server_url
# server_url: https://hs.internal_domain.internal
# # Dev server_url
# server_url: https://hs.dev_internal_domain.internal
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 127.0.0.1:9090
grpc_listen_addr: 127.0.0.1:50443
grpc_allow_insecure: false
noise:
private_key_path: /var/lib/headscale/noise_private.key
prefixes:
v4: 100.64.0.0/10
v6: fd7a:115c:a1e0::/48
allocation: sequential
derp:
server:
enabled: true
region_id: 999
region_code: "headscale"
region_name: "Headscale Embedded DERP"
stun_listen_addr: "0.0.0.0:3478"
private_key_path: /var/lib/headscale/derp_server_private.key
automatically_add_embedded_derp_region: true
ipv4: 1.2.3.4
ipv6: 2001:db8::1
urls:
- https://controlplane.tailscale.com/derpmap/default
paths: []
auto_update_enabled: true
update_frequency: 24h
disable_check_updates: false
ephemeral_node_inactivity_timeout: 30m
database:
type: sqlite
debug: false
gorm:
prepare_stmt: true
parameterized_queries: true
skip_err_record_not_found: true
slow_threshold: 1000
sqlite:
path: /var/lib/headscale/db.sqlite
write_ahead_log: true
wal_autocheckpoint: 1000
acme_url: https://acme-v02.api.letsencrypt.org/directory
acme_email: ""
tls_letsencrypt_hostname: ""
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
tls_letsencrypt_challenge_type: HTTP-01
tls_letsencrypt_listen: ":http"
tls_cert_path: ""
tls_key_path: ""
log:
format: text
level: info
policy:
mode: database
path: ""
dns:
magic_dns: true
base_domain: example.com
nameservers:
global:
- 1.1.1.1
- 1.0.0.1
- 2606:4700:4700::1111
- 2606:4700:4700::1001
split: {}
search_domains: []
extra_records: []
unix_socket: /var/run/headscale/headscale.sock
unix_socket_permission: "0770"
logtail:
enabled: false
randomize_client_port: false
homepages/compose.yaml
+4 -5
View File
@@ -3,8 +3,8 @@ services:
build:
context: .
dockerfile: Dockerfile.forust
ports:
- "8085:80"
# ports:
# - "8085:80"
restart: unless-stopped
volumes:
- ./forust_files:/usr/share/nginx/html
@@ -42,8 +42,8 @@ services:
build:
context: .
dockerfile: Dockerfile.xdfnx
ports:
- "8086:80"
# ports:
# - "8086:80"
restart: unless-stopped
volumes:
- ./xdfnx_files:/usr/share/nginx/html
@@ -77,7 +77,6 @@ services:
- "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
- "traefik.http.routers.xdfnx-dev.tls=true"
networks:
proxy:
external: true
penpot/compose.yaml
+2 -2
View File
@@ -86,8 +86,8 @@ services:
penpot-frontend:
image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
restart: always
ports:
- 9001:8080
# ports:
# - 9001:8080
volumes:
- penpot_assets:/opt/data/assets
tailscale/.env.example
+1
View File
@@ -0,0 +1 @@
TS_AUTHKEY=tskey-auth-xxxxx-CNTRL
tailscale/compose.yaml
+21
View File
@@ -0,0 +1,21 @@
services:
tailscale:
image: tailscale/tailscale:latest
container_name: tailscale
network_mode: host
restart: unless-stopped
cap_add:
- NET_ADMIN
- NET_RAW
volumes:
- tailscale_data:/var/lib/tailscale
- /dev/net/tun:/dev/net/tun
environment:
- TS_AUTHKEY=${TS_AUTHKEY}
- TS_STATE_DIR=/var/lib/tailscale
- TS_HOSTNAME=forust-server
# - TS_EXTRA_ARGS=--advertise-tags=tag:container
volumes:
tailscale_data:
name: tailscale_data
termix/compose.yaml
+2 -2
View File
@@ -3,8 +3,8 @@ services:
image: ghcr.io/lukegus/termix:latest
container_name: termix
restart: unless-stopped
ports:
- "3331:8080"
# ports:
# - "3331:8080"
volumes:
- ./termix-data:/app/data
environment:
uptime-kuma/compose.yaml
+2 -2
View File
@@ -5,9 +5,9 @@ services:
container_name: uptime-kuma
volumes:
- ./data:/app/data
ports:
# ports:
# <Host Port>:<Container Port>
- "3001:3001"
# - "3001:3001"
labels:
- "traefik.enable=true"
- "traefik.docker.network=proxy"