admin/skato-ansible
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects 3 Releases Wiki Activity

created major large-scale changes

Browse Source
This commit is contained in:
xenobyte
2026-07-12 15:27:58 -04:00
parent e8b29bb8e8
commit e53d6255e0
99 changed files with 4183 additions and 2093 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
roles/init-server/templates/headscale/config.yaml.j2
View File

@@ -10,13 +10,29 @@
#
# https://myheadscale.example.com:443
#
server_url: {{ tail.scheme + '://' + tail.domain + tail.port }}
{% if mode == 'prod' %}
{% if headscale.port is defined and headscale.port != None %}
server_url: {{ headscale.scheme + '://' + web_fqdn + ':' + (headscale.port | string) }}
{% else %}
server_url: {{ headscale.scheme + '://' + web_fqdn + ':80' }}
{% endif %}
{% else %}
{% if headscale.port is defined and headscale.port != None %}
server_url: {{ 'http://' + web_fqdn + ':' + (headscale.port | string) }}
{% else %}
server_url: {{ 'http://' + web_fqdn + ':443' }}
{% endif %}
{% endif %}
# Address to listen to / bind to on the server
#
# For production:
# listen_addr: 0.0.0.0:8080
listen_addr: {{ '0.0.0.0' + tail.port }}
{% if headscale.port is defined and headscale.port != None %}
listen_addr: {{ '0.0.0.0' + ':' + (headscale.port | string) }}
{% else %}
listen_addr: 0.0.0.0:80
{% endif %}
# Address to listen to /metrics and /debug, you may want
# to keep this endpoint private to your internal network
@@ -31,8 +47,8 @@ metrics_listen_addr: 127.0.0.1:9090
#
# For production:
# grpc_listen_addr: 0.0.0.0:50443
{% if tail.grpc.expose %}
grpc_listen_addr: {{ '0.0.0.0' + tail.grpc.port }}
{% if headscale.grpc.expose %}
grpc_listen_addr: {{ '0.0.0.0' + ':' + (headscale.grpc.port | string) }}
{% else %}
grpc_listen_addr: 127.0.0.1:50443
{% endif %}
@@ -41,7 +57,7 @@ grpc_listen_addr: 127.0.0.1:50443
# mode. This is not recommended as the traffic will
# be unencrypted. Only enable if you know what you
# are doing.
{% if tail.grpc.secure %}
{% if headscale.grpc.secure %}
grpc_allow_insecure: false
{% else %}
grpc_allow_insecure: true
@@ -253,6 +269,7 @@ database:
# # in the 'ssl' field. Refers to https://www.postgresql.org/docs/current/libpq-ssl.html Table 34.1.
# ssl: false
{% if mode == 'prod' or headscale.scheme == 'https' %}
### TLS configuration
#
## Let's encrypt / ACME
@@ -260,32 +277,42 @@ database:
# headscale supports automatically requesting and setting up
# TLS for a domain with Let's Encrypt.
#
{% if certbot is undefined or certbot == None %}
# URL to ACME directory
acme_url: https://acme-v02.api.letsencrypt.org/directory
# acme_url: https://acme-v02.api.letsencrypt.org/directory
# Email to register with ACME provider
acme_email: ""
# acme_email: ""
# Domain name to request a TLS certificate for:
tls_letsencrypt_hostname: ""
# tls_letsencrypt_hostname: ""
# Path to store certificates and metadata needed by
# letsencrypt
# For production:
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
# tls_letsencrypt_cache_dir: /var/lib/headscale/cache
# Type of ACME challenge to use, currently supported types:
# HTTP-01 or TLS-ALPN-01
# See: https://headscale.net/stable/ref/tls/
tls_letsencrypt_challenge_type: HTTP-01
# tls_letsencrypt_challenge_type: HTTP-01
# When HTTP-01 challenge is chosen, letsencrypt must set up a
# verification endpoint, and it will be listening on:
# :http = port 80
tls_letsencrypt_listen: ":http"
# tls_letsencrypt_listen: ":http"
{% else %}
{% if not certbot.containerized %}
## Use already defined certificates:
tls_cert_path: ""
tls_key_path: ""
tls_cert_path: {{ '/etc/letsencrypt/live/' + web_fqdn + '/fullchain.pem' }}
tls_key_path: {{ '/etc/letsencrypt/live/' + web_fqdn + '/privkey.pem' }}
{% else %}
tls_cert_path: {{ ansible_user_home.stdout + '/.config/letsencrypt/live/' + web_fqdn + '/fullchain.pem' }}
tls_key_path: {{ ansible_user_home.stdout + '/.config/letsencrypt/live/' + web_fqdn + '/privkey.pem' }}
## Use already defined certificates:
{% endif %}
{% endif %}
{% endif %}
log:
# Valid log levels: panic, fatal, error, warn, info, debug, trace
@@ -335,7 +362,7 @@ dns:
# `base_domain` must be a FQDN, without the trailing dot.
# The FQDN of the hosts will be
# `hostname.base_domain` (e.g., _myhost.example.com_).
base_domain: {{ tail.magic_dns.domain }}
base_domain: {{ headscale.magic_dns.domain }}
# Whether to use the local DNS settings of a node or override the local DNS
# settings (default) and force the use of Headscale's DNS configuration.
@@ -343,7 +370,7 @@ dns:
# List of DNS servers to expose to clients.
nameservers:
global: {{ tail.magic_dns.nameservers }}
global: {{ headscale.magic_dns.nameservers }}
# NextDNS (see https://tailscale.com/docs/integrations/nextdns).
# "abc123" is example NextDNS ID, replace with yours.