homelab/headscale/compose.yaml

services:
  headscale:
    image: headscale/headscale:latest
    restart: unless-stopped
    container_name: headscale-server
    command: serve
    ports:
      - 18080:8080
      - 19090:9090
    networks:
      - proxy
    volumes:
      - ./config/headscale.yaml:/etc/headscale/config.yaml
      - data:/var/lib/headscale
      - ./config/policy.json:/var/lib/headscale/policy.json
    labels:
      - "me.tale.headplane.target: headscale"
      - "traefik.enable=true"
      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"

      ## SERVICE
      # Prod Router
      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
      - "traefik.http.routers.headscale.entrypoints=websecure"
      - "traefik.http.routers.headscale.service=headscale"
      - "traefik.http.routers.headscale.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
      - "traefik.http.routers.headscale-local.entrypoints=websecure"
      - "traefik.http.routers.headscale-local.service=headscale"
      - "traefik.http.routers.headscale-local.tls=true"
      # Dev Router
      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
      - "traefik.http.routers.headscale-dev.service=headscale"
      - "traefik.http.routers.headscale-dev.tls=true"

      ## METRICS
      # Prod Router
      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics.tls=true"
      # Local Router
      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics-local.tls=true"
      # Dev Router
      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics-dev.tls=true"
  headplane:
    image: ghcr.io/tale/headplane:latest
    container_name: headplane
    restart: unless-stopped
    ports:
      - "13000:3000"
    volumes:
      - ./config/headplane.yaml:/etc/headplane/config.yaml
      - ./config/headscale.yaml:/etc/headscale/config.yaml
      - headplane-data:/var/lib/headplane
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.headplane.loadbalancer.server.port=3000"

      # Middleware: add /admin prefix for root requests
      - "traefik.http.middlewares.headplane-prefix.addPrefix.prefix=/admin"

      # Prod Root Router
      - "traefik.http.routers.headplane-root.rule=Host(`hp.forust.xyz`)"
      - "traefik.http.routers.headplane-root.entrypoints=websecure"
      - "traefik.http.routers.headplane-root.middlewares=headplane-prefix"
      - "traefik.http.routers.headplane-root.tls.certresolver=letsencrypt"
      # Prod Router
      - "traefik.http.routers.headplane.rule=Host(`hp.forust.xyz`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headplane.entrypoints=websecure"
      - "traefik.http.routers.headplane.tls.certresolver=letsencrypt"
      # Local Root Router
      - "traefik.http.routers.headplane-root-local.rule=Host(`hp.workstation.internal`)"
      - "traefik.http.routers.headplane-root-local.entrypoints=websecure"
      - "traefik.http.routers.headplane-root-local.middlewares=headplane-prefix"
      - "traefik.http.routers.headplane-root-local.tls=true"
      # Local Router
      - "traefik.http.routers.headplane-local.rule=Host(`hp.workstation.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headplane-local.entrypoints=websecure"
      - "traefik.http.routers.headplane-local.tls=true"
      # Dev Root Router
      - "traefik.http.routers.headplane-root-dev.rule=Host(`hp.gigaforust.internal`)"
      - "traefik.http.routers.headplane-root-dev.entrypoints=websecure"
      - "traefik.http.routers.headplane-root-dev.middlewares=headplane-prefix"
      - "traefik.http.routers.headplane-root-dev.tls=true"
      # Dev Router
      - "traefik.http.routers.headplane-dev.rule=Host(`hp.gigaforust.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headplane-dev.entrypoints=websecure"
      - "traefik.http.routers.headplane-dev.tls=true"
  web:
    image: goodieshq/headscale-admin:latest
    restart: unless-stopped
    ports:
      - 10080:80
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"

      # Prod Router
      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
      - "traefik.http.routers.headscale-ui.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui-local.tls=true"
      # Dev Router
      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui-dev.tls=true"
    networks:
      - proxy
volumes:
  data:
  headplane-data:
    name: headplane_data
networks:
  proxy:
    external: true