dahjah/headplane_headscale_nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Complete Headscale and Headplane setup with Nginx subdomain, ACL policy fix, and API mismatch patch

Browse Source
This commit is contained in:
David Gillespie 2025-12-02 00:22:58 -07:00
commit c4ae963f23
27 changed files with 22454 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
configuration.nix Normal file
View File

@ -0,0 +1,55 @@
{ config, lib, pkgs, inputs, ... }: {
# Note: hardware-configuration.nix and headscale.nix are imported via flake.nix
imports = [ ];
time.timeZone = "America/Denver";
virtualisation.docker.enable = true;
boot.tmp.cleanOnBoot = true;
zramSwap.enable = true;
networking.hostName = "headscale";
networking.domain = "subnet01021712.vcn01021712.oraclevcn.com";
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [
''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDE3856oAY7HcFwP1y9AvlDXx4cyvAcqa16x8jO/5KZjz7pHXxo3dT/0Rgqjc/k9NgSVYdKK4huhheyB5svKLlZFzXs4HjRgWA+omLORU4UIyz4BenwBzhXjeVQy5tiMbSEoHpJn3Qty08UO8ItoDIZWeJyD4XeRvUexFtt+967JkmbWIS5oreTHBzOXMzqbx3oRt3AdA4PyOzYSYAL8ewXZs7hQtVsn4VNkGBxegEMF2H0SmsxIuRkgdEzV6duZ4Ufia4agW0IciCvD/SwWli34WJcZo1HdGPoSAzD3YRTWkm7ko8uVhDXP58g7A+VoaQTSZC+jaSTI1m7Zuxxr56j+Hhm3fCGqVunM4BqnVaaq1MrpF2U7IWu1NljCZ/0uekWmYjHKRO4J58udDAJdoZgfRGEVcITx1QuilTHmIe61AEjjfqxjKisrLkwzXSEtLQyCuReSYMEdcaFPl3cjTTjuECCoDmL3igVohwH7MbgFPmanX1VDpIE99xGUrun8MTQkp3pxwOvGOA7Pbwyc1jYunABWr8ulFFwscc0VZXBHsEgURqtMJT1XVdq5oYP9LZFVU7aiT/ZnTEbbzH6QRLxBB63US7iRxtbfHSzmZk40u4rX7O2I3reVVzxLPa7TXYCD76rOo7I7huTZ/rZ6I/vZmqIFfmhW0BbUlbUyoI7vQ==''
''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6ay8vzXVSUl4/gpHmkdP9Dq+QgJtfRvLpL78BQEu20gKEFLhJWvcyVOMtTXw3MDst/b/DGNhUXlUyRdrXDFYewxTPHoG72PIBUmtFRlVb9KFTLRZfT0U4PjbPwp9yxcjL4H3hV1+p/uUg0FMhtZc+x2nuZ9Sqi8IyaVG1Qzf8egQzmBeaH9E/VxZoZ0MjlFiN2Oq3MbSVOCKH/MrYtURbcFusNvKVNQHpAUQaf1tIFDB2O19yW0grs5jeDoOAAoJlT40O4VCcB5CyC7cLu3jFYY4Uh8mbI3Ju6GCYnt/gkV4HF2q+QbrZOo6wH9b3e85fPvIjg2Y5KZPRGViQDmU82e6g4IjePcQqx6+3/bgxwkDxPm9lZzF1NvtXXX28G+RHiE7aENrSLkqkbS1eAH102Y69OLYoGtaEBKpWh66UQP5oyTEqf0gS6VQq47n/L0i7AczYW5s+Z+lGznHaoiihWBa3nS3tlkkwJxLPapC/i4ee9aQlew8XtQGq+mCAxdvgAbODDXT7eX7DSWMdcUe9oZSlAT6MGA2bHfQkVl3/mh5DQ26tTF9v857WDjWHC7a4vM8ZIdumgzwIHGmA4KIC9RfPDdP1PcxAuUPqwm/fODPmCPFzZhcMP0xxFdoGxEz91CnZIFvxBzbU2mnhtJXiTSr22Axdm9oVps2T8V77gw== djg@djg-nix''
];
# nixpkgs.config.permittedInsecurePackages = [
# "headscale-0.23.0" # Required if using older headscale version
# ];
environment.systemPackages = with pkgs; [
git
wget
nano
curl
neofetch
(pkgs.writeShellScriptBin "generate-headscale-key" '' ${config.services.headscale.package}/bin/headscale apikeys create --expiration 999d '')
];
services.headplane = {
enable = true;
settings = {
server = {
host = "127.0.0.1";
port = 3000;
cookie_secret = "iQ0bUyaFgwaijWaSyZ1ILA9RwfywrbZ3";
cookie_secure = false; # Set to true if using HTTPS directly (nginx handles SSL for us)
};
headscale = {
url = "https://headscale.kennys.mom";
config_path = "/etc/headscale-strict.yml";
config_strict = true;
};
# Optionally configure OIDC here if needed
};
# Agent disabled due to upstream module bug
# See: https://github.com/tale/headplane/issues (type definition error)
agent.enable = false;
};
system.stateVersion = "23.11";
}

36
configuration.nix.workingalmost Normal file
View File

@ -0,0 +1,36 @@
{ config, lib, pkgs, inputs, ... }: {
imports = [
./hardware-configuration.nix
./headscale.nix
];
time.timeZone = "America/Denver";
virtualisation.docker.enable = true;
boot.tmp.cleanOnBoot = true;
zramSwap.enable = true;
networking.hostName = "headscale";
networking.domain = "subnet01021712.vcn01021712.oraclevcn.com";
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [
''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDE3856oAY7HcFwP1y9AvlDXx4cyvAcqa16x8jO/5KZjz7pHXxo3dT/0Rgqjc/k9NgSVYdKK4huhheyB5svKLlZFzXs4HjRgWA+omLORU4UIyz4BenwBzhXjeVQy5tiMbSEoHpJn3Qty08UO8ItoDIZWeJyD4XeRvUexFtt+967JkmbWIS5oreTHBzOXMzqbx3oRt3AdA4PyOzYSYAL8ewXZs7hQtVsn4VNkGBxegEMF2H0SmsxIuRkgdEzV6duZ4Ufia4agW0IciCvD/SwWli34WJcZo1HdGPoSAzD3YRTWkm7ko8uVhDXP58g7A+VoaQTSZC+jaSTI1m7Zuxxr56j+Hhm3fCGqVunM4BqnVaaq1MrpF2U7IWu1NljCZ/0uekWmYjHKRO4J58udDAJdoZgfRGEVcITx1QuilTHmIe61AEjjfqxjKisrLkwzXSEtLQyCuReSYMEdcaFPl3cjTTjuECCoDmL3igVohwH7MbgFPmanX1VDpIE99xGUrun8MTQkp3pxwOvGOA7Pbwyc1jYunABWr8ulFFwscc0VZXBHsEgURqtMJT1XVdq5oYP9LZFVU7aiT/ZnTEbbzH6QRLxBB63US7iRxtbfHSzmZk40u4rX7O2I3reVVzxLPa7TXYCD76rOo7I7huTZ/rZ6I/vZmqIFfmhW0BbUlbUyoI7vQ==''
''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6ay8vzXVSUl4/gpHmkdP9Dq+QgJtfRvLpL78BQEu20gKEFLhJWvcyVOMtTXw3MDst/b/DGNhUXlUyRdrXDFYewxTPHoG72PIBUmtFRlVb9KFTLRZfT0U4PjbPwp9yxcjL4H3hV1+p/uUg0FMhtZc+x2nuZ9Sqi8IyaVG1Qzf8egQzmBeaH9E/VxZoZ0MjlFiN2Oq3MbSVOCKH/MrYtURbcFusNvKVNQHpAUQaf1tIFDB2O19yW0grs5jeDoOAAoJlT40O4VCcB5CyC7cLu3jFYY4Uh8mbI3Ju6GCYnt/gkV4HF2q+QbrZOo6wH9b3e85fPvIjg2Y5KZPRGViQDmU82e6g4IjePcQqx6+3/bgxwkDxPm9lZzF1NvtXXX28G+RHiE7aENrSLkqkbS1eAH102Y69OLYoGtaEBKpWh66UQP5oyTEqf0gS6VQq47n/L0i7AczYW5s+Z+lGznHaoiihWBa3nS3tlkkwJxLPapC/i4ee9aQlew8XtQGq+mCAxdvgAbODDXT7eX7DSWMdcUe9oZSlAT6MGA2bHfQkVl3/mh5DQ26tTF9v857WDjWHC7a4vM8ZIdumgzwIHGmA4KIC9RfPDdP1PcxAuUPqwm/fODPmCPFzZhcMP0xxFdoGxEz91CnZIFvxBzbU2mnhtJXiTSr22Axdm9oVps2T8V77gw== djg@djg-nix''
];
# nixpkgs.config.permittedInsecurePackages = [
# "headscale-0.23.0" # Required if using older headscale version
# ];
environment.systemPackages = with pkgs; [
git
wget
nano
curl
neofetch
(pkgs.writeShellScriptBin "generate-headscale-key" '' ${config.services.headscale.package}/bin/headscale apikeys create --expiration 999d '')
inputs.headplane.packages.${pkgs.system}.headplane
];
system.stateVersion = "23.11";
}

173
flake.lock Normal file
View File

@ -0,0 +1,173 @@
{
"nodes": {
"devshell": {
"inputs": {
"nixpkgs": [
"headplane",
"nixpkgs"
]
},
"locked": {
"lastModified": 1741473158,
"narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
"owner": "numtide",
"repo": "devshell",
"rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"headplane": {
"inputs": {
"devshell": "devshell",
"flake-utils": "flake-utils",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1756071294,
"narHash": "sha256-2EDPYO2IpOlEZCMfiUMHN2m7FbkJa1RMsy13c0+ipug=",
"owner": "tale",
"repo": "headplane",
"rev": "bd8a7a56d4021edf58511c6ab333af864d91304c",
"type": "github"
},
"original": {
"owner": "tale",
"repo": "headplane",
"type": "github"
}
},
"headscale": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1756307353,
"narHash": "sha256-tpRq+EJ5DPtVFKnyK0+tL/5bOoYwyTW+N+eWZG8i/60=",
"owner": "juanfont",
"repo": "headscale",
"rev": "8e25f7f9dd12421a805f82f09676b592a39c61b9",
"type": "github"
},
"original": {
"owner": "juanfont",
"repo": "headscale",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1755829505,
"narHash": "sha256-4/Jd+LkQ2ssw8luQVkqVs9spDBVE6h/u/hC/tzngsPo=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f937f8ecd1c70efd7e9f90ba13dfb400cf559de4",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1756617294,
"narHash": "sha256-aGnd4AHIYCWQKChAkHPpX+YYCt7pA6y2LFFA/s8q0wQ=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "b4c2c57c31e68544982226d07e4719a2d86302a8",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"headplane": "headplane",
"headscale": "headscale",
"nixpkgs": "nixpkgs_2"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

187
flake.lock.bak Normal file
View File

@ -0,0 +1,187 @@
{
"nodes": {
"devshell": {
"inputs": {
"nixpkgs": [
"headplane",
"nixpkgs"
]
},
"locked": {
"lastModified": 1741473158,
"narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
"owner": "numtide",
"repo": "devshell",
"rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"headplane": {
"inputs": {
"devshell": "devshell",
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1748534730,
"narHash": "sha256-yM02IlC3barMBeIybXf38NKv4SwS3RiJtPkKtkw5hZc=",
"owner": "tale",
"repo": "headplane",
"rev": "2f316176c8c37ad63946d7075c727478f81303b2",
"type": "github"
},
"original": {
"owner": "tale",
"repo": "headplane",
"type": "github"
}
},
"headscale": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1748293508,
"narHash": "sha256-cLjhwnl2bVj/Q0pKp9QVpUKglvPUl2v3/VV1fTT8N/E=",
"owner": "juanfont",
"repo": "headscale",
"rev": "b8044c29ddc59d9c6346337d589b73a7e5b0511e",
"type": "github"
},
"original": {
"owner": "juanfont",
"repo": "headscale",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1747958103,
"narHash": "sha256-qmmFCrfBwSHoWw7cVK4Aj+fns+c54EBP8cGqp/yK410=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "fe51d34885f7b5e3e7b59572796e1bcb427eccb1",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1746300365,
"narHash": "sha256-thYTdWqCRipwPRxWiTiH1vusLuAy0okjOyzRx4hLWh4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f21e4546e3ede7ae34d12a84602a22246b31f7e0",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1748889542,
"narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"headplane": "headplane",
"headscale": "headscale",
"nixpkgs": "nixpkgs_3"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

187
flake.lock.bak2 Normal file
View File

@ -0,0 +1,187 @@
{
"nodes": {
"devshell": {
"inputs": {
"nixpkgs": [
"headplane",
"nixpkgs"
]
},
"locked": {
"lastModified": 1741473158,
"narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
"owner": "numtide",
"repo": "devshell",
"rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"headplane": {
"inputs": {
"devshell": "devshell",
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1748534730,
"narHash": "sha256-yM02IlC3barMBeIybXf38NKv4SwS3RiJtPkKtkw5hZc=",
"owner": "tale",
"repo": "headplane",
"rev": "2f316176c8c37ad63946d7075c727478f81303b2",
"type": "github"
},
"original": {
"owner": "tale",
"repo": "headplane",
"type": "github"
}
},
"headscale": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1748293508,
"narHash": "sha256-cLjhwnl2bVj/Q0pKp9QVpUKglvPUl2v3/VV1fTT8N/E=",
"owner": "juanfont",
"repo": "headscale",
"rev": "b8044c29ddc59d9c6346337d589b73a7e5b0511e",
"type": "github"
},
"original": {
"owner": "juanfont",
"repo": "headscale",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1747958103,
"narHash": "sha256-qmmFCrfBwSHoWw7cVK4Aj+fns+c54EBP8cGqp/yK410=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "fe51d34885f7b5e3e7b59572796e1bcb427eccb1",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1746300365,
"narHash": "sha256-thYTdWqCRipwPRxWiTiH1vusLuAy0okjOyzRx4hLWh4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f21e4546e3ede7ae34d12a84602a22246b31f7e0",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1748889542,
"narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"headplane": "headplane",
"headscale": "headscale",
"nixpkgs": "nixpkgs_3"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

187
flake.lock.bak3 Normal file
View File

@ -0,0 +1,187 @@
{
"nodes": {
"devshell": {
"inputs": {
"nixpkgs": [
"headplane",
"nixpkgs"
]
},
"locked": {
"lastModified": 1741473158,
"narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
"owner": "numtide",
"repo": "devshell",
"rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"headplane": {
"inputs": {
"devshell": "devshell",
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1748534730,
"narHash": "sha256-yM02IlC3barMBeIybXf38NKv4SwS3RiJtPkKtkw5hZc=",
"owner": "tale",
"repo": "headplane",
"rev": "2f316176c8c37ad63946d7075c727478f81303b2",
"type": "github"
},
"original": {
"owner": "tale",
"repo": "headplane",
"type": "github"
}
},
"headscale": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1748293508,
"narHash": "sha256-cLjhwnl2bVj/Q0pKp9QVpUKglvPUl2v3/VV1fTT8N/E=",
"owner": "juanfont",
"repo": "headscale",
"rev": "b8044c29ddc59d9c6346337d589b73a7e5b0511e",
"type": "github"
},
"original": {
"owner": "juanfont",
"repo": "headscale",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1747958103,
"narHash": "sha256-qmmFCrfBwSHoWw7cVK4Aj+fns+c54EBP8cGqp/yK410=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "fe51d34885f7b5e3e7b59572796e1bcb427eccb1",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1746300365,
"narHash": "sha256-thYTdWqCRipwPRxWiTiH1vusLuAy0okjOyzRx4hLWh4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f21e4546e3ede7ae34d12a84602a22246b31f7e0",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1748889542,
"narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"headplane": "headplane",
"headscale": "headscale",
"nixpkgs": "nixpkgs_3"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

173
flake.lock.bak4 Normal file
View File

@ -0,0 +1,173 @@
{
"nodes": {
"devshell": {
"inputs": {
"nixpkgs": [
"headplane",
"nixpkgs"
]
},
"locked": {
"lastModified": 1741473158,
"narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
"owner": "numtide",
"repo": "devshell",
"rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"headplane": {
"inputs": {
"devshell": "devshell",
"flake-utils": "flake-utils",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1749098081,
"narHash": "sha256-lsgbrSNLncNoMLvqjeAun/KahsHTrowBQKdMgo2dVjo=",
"owner": "dahjah",
"repo": "headplane",
"rev": "6c3930815e37375d31bf9c55904cb60dfcd84767",
"type": "github"
},
"original": {
"owner": "dahjah",
"repo": "headplane",
"type": "github"
}
},
"headscale": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1748293508,
"narHash": "sha256-cLjhwnl2bVj/Q0pKp9QVpUKglvPUl2v3/VV1fTT8N/E=",
"owner": "juanfont",
"repo": "headscale",
"rev": "b8044c29ddc59d9c6346337d589b73a7e5b0511e",
"type": "github"
},
"original": {
"owner": "juanfont",
"repo": "headscale",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1746300365,
"narHash": "sha256-thYTdWqCRipwPRxWiTiH1vusLuAy0okjOyzRx4hLWh4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f21e4546e3ede7ae34d12a84602a22246b31f7e0",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1748889542,
"narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"headplane": "headplane",
"headscale": "headscale",
"nixpkgs": "nixpkgs_2"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

23
flake.nix Normal file
View File

@ -0,0 +1,23 @@
{
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
headscale.url = "github:juanfont/headscale";
headplane = {
url = "github:tale/headplane";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, headscale, headplane, ... }@inputs: {
nixosConfigurations.headscale = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
./configuration.nix
./hardware-configuration.nix
./headscale.nix
headplane.nixosModules.headplane
({ pkgs, ... }: { nixpkgs.overlays = [ headplane.overlays.default ]; })
];
specialArgs = { inherit inputs; };
};
};
}

23
flake.nix.notworkingbackup Normal file
View File

@ -0,0 +1,23 @@
{
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
headscale.url = "github:juanfont/headscale";
headplane = {
url = "github:dahjah/headplane";
inputs.nixpkgs.follows = "nixpkgs"; # Add dependency tracking
};
};
outputs = { self, nixpkgs, headscale, headplane, ... }@inputs: {
nixosConfigurations.headscale = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
./configuration.nix
./hardware-configuration.nix
./headscale.nix
headplane.nixosModules.headplane # Changed to default
];
specialArgs = { inherit inputs; };
};
};
}

14
hardware-configuration.nix Normal file
View File

@ -0,0 +1,14 @@
{ modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.loader.grub = {
efiSupport = true;
efiInstallAsRemovable = true;
device = "nodev";
};
fileSystems."/boot" = { device = "/dev/disk/by-uuid/349C-BCCC"; fsType = "vfat"; };
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
boot.initrd.kernelModules = [ "nvme" ];
fileSystems."/" = { device = "/dev/mapper/ocivolume-root"; fsType = "xfs"; };
}

1
headplane Submodule

@ -0,0 +1 @@
Subproject commit dbdb759a7e4616231e0964074342c77e4b54fc28

12
headplane-fix.nix Normal file
View File

@ -0,0 +1,12 @@
# Fixed headplane module override
# This module fixes the type error in the upstream headplane module
# where agent.settings type is incorrectly defined
{ config, lib, pkgs, ... }:
{
options.services.headplane.agent.settings = lib.mkForce (lib.mkOption {
type = lib.types.attrsOf (lib.types.either lib.types.str lib.types.bool);
description = "Headplane agent env vars config. See: https://github.com/tale/headplane/blob/main/docs/Headplane-Agent.md";
default = {};
});
}

1
headplane-local-build/headplane Submodule

@ -0,0 +1 @@
Subproject commit fe2d7cb57af76e36d59fc30bdbbd5adf1a2b5ac1

17
headplane-node2nix/composition.nix Normal file
View File

@ -0,0 +1,17 @@
# This file has been generated by node2nix 1.11.1. Do not edit!
{pkgs ? import <nixpkgs> {
inherit system;
}, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_14"}:
let
nodeEnv = import ./node-env.nix {
inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
inherit pkgs nodejs;
libtool = if pkgs.stdenv.isDarwin then pkgs.cctools or pkgs.darwin.cctools else null;
};
in
import ./node-packages.nix {
inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
inherit nodeEnv;
}

689
headplane-node2nix/node-env.nix Normal file
View File

@ -0,0 +1,689 @@
# This file originates from node2nix
{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
let
# Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux;
python = if nodejs ? python then nodejs.python else python2;
# Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
tarWrapper = runCommand "tarWrapper" {} ''
mkdir -p $out/bin
cat > $out/bin/tar <<EOF
#! ${stdenv.shell} -e
$(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
EOF
chmod +x $out/bin/tar
'';
# Function that generates a TGZ file from a NPM project
buildNodeSourceDist =
{ name, version, src, ... }:
stdenv.mkDerivation {
name = "node-tarball-${name}-${version}";
inherit src;
buildInputs = [ nodejs ];
buildPhase = ''
export HOME=$TMPDIR
tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
'';
installPhase = ''
mkdir -p $out/tarballs
mv $tgzFile $out/tarballs
mkdir -p $out/nix-support
echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
'';
};
# Common shell logic
installPackage = writeShellScript "install-package" ''
installPackage() {
local packageName=$1 src=$2
local strippedName
local DIR=$PWD
cd $TMPDIR
unpackFile $src
# Make the base dir in which the target dependency resides first
mkdir -p "$(dirname "$DIR/$packageName")"
if [ -f "$src" ]
then
# Figure out what directory has been unpacked
packageDir="$(find . -maxdepth 1 -type d | tail -1)"
# Restore write permissions to make building work
find "$packageDir" -type d -exec chmod u+x {} \;
chmod -R u+w "$packageDir"
# Move the extracted tarball into the output folder
mv "$packageDir" "$DIR/$packageName"
elif [ -d "$src" ]
then
# Get a stripped name (without hash) of the source directory.
# On old nixpkgs it's already set internally.
if [ -z "$strippedName" ]
then
strippedName="$(stripHash $src)"
fi
# Restore write permissions to make building work
chmod -R u+w "$strippedName"
# Move the extracted directory into the output folder
mv "$strippedName" "$DIR/$packageName"
fi
# Change to the package directory to install dependencies
cd "$DIR/$packageName"
}
'';
# Bundle the dependencies of the package
#
# Only include dependencies if they don't exist. They may also be bundled in the package.
includeDependencies = {dependencies}:
lib.optionalString (dependencies != []) (
''
mkdir -p node_modules
cd node_modules
''
+ (lib.concatMapStrings (dependency:
''
if [ ! -e "${dependency.packageName}" ]; then
${composePackage dependency}
fi
''
) dependencies)
+ ''
cd ..
''
);
# Recursively composes the dependencies of a package
composePackage = { name, packageName, src, dependencies ? [], ... }@args:
builtins.addErrorContext "while evaluating node package '${packageName}'" ''
installPackage "${packageName}" "${src}"
${includeDependencies { inherit dependencies; }}
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
'';
pinpointDependencies = {dependencies, production}:
let
pinpointDependenciesFromPackageJSON = writeTextFile {
name = "pinpointDependencies.js";
text = ''
var fs = require('fs');
var path = require('path');
function resolveDependencyVersion(location, name) {
if(location == process.env['NIX_STORE']) {
return null;
} else {
var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
if(fs.existsSync(dependencyPackageJSON)) {
var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
if(dependencyPackageObj.name == name) {
return dependencyPackageObj.version;
}
} else {
return resolveDependencyVersion(path.resolve(location, ".."), name);
}
}
}
function replaceDependencies(dependencies) {
if(typeof dependencies == "object" && dependencies !== null) {
for(var dependency in dependencies) {
var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
if(resolvedVersion === null) {
process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
} else {
dependencies[dependency] = resolvedVersion;
}
}
}
}
/* Read the package.json configuration */
var packageObj = JSON.parse(fs.readFileSync('./package.json'));
/* Pinpoint all dependencies */
replaceDependencies(packageObj.dependencies);
if(process.argv[2] == "development") {
replaceDependencies(packageObj.devDependencies);
}
else {
packageObj.devDependencies = {};
}
replaceDependencies(packageObj.optionalDependencies);
replaceDependencies(packageObj.peerDependencies);
/* Write the fixed package.json file */
fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
'';
};
in
''
node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
${lib.optionalString (dependencies != [])
''
if [ -d node_modules ]
then
cd node_modules
${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
cd ..
fi
''}
'';
# Recursively traverses all dependencies of a package and pinpoints all
# dependencies in the package.json file to the versions that are actually
# being used.
pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
''
if [ -d "${packageName}" ]
then
cd "${packageName}"
${pinpointDependencies { inherit dependencies production; }}
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
fi
'';
# Extract the Node.js source code which is used to compile packages with
# native bindings
nodeSources = runCommand "node-sources" {} ''
tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
mv node-* $out
'';
# Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
addIntegrityFieldsScript = writeTextFile {
name = "addintegrityfields.js";
text = ''
var fs = require('fs');
var path = require('path');
function augmentDependencies(baseDir, dependencies) {
for(var dependencyName in dependencies) {
var dependency = dependencies[dependencyName];
// Open package.json and augment metadata fields
var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
var packageJSONPath = path.join(packageJSONDir, "package.json");
if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
console.log("Adding metadata fields to: "+packageJSONPath);
var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
if(dependency.integrity) {
packageObj["_integrity"] = dependency.integrity;
} else {
packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
}
if(dependency.resolved) {
packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
} else {
packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
}
if(dependency.from !== undefined) { // Adopt from property if one has been provided
packageObj["_from"] = dependency.from;
}
fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
}
// Augment transitive dependencies
if(dependency.dependencies !== undefined) {
augmentDependencies(packageJSONDir, dependency.dependencies);
}
}
}
if(fs.existsSync("./package-lock.json")) {
var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
if(![1, 2].includes(packageLock.lockfileVersion)) {
process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n");
process.exit(1);
}
if(packageLock.dependencies !== undefined) {
augmentDependencies(".", packageLock.dependencies);
}
}
'';
};
# Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
reconstructPackageLock = writeTextFile {
name = "reconstructpackagelock.js";
text = ''
var fs = require('fs');
var path = require('path');
var packageObj = JSON.parse(fs.readFileSync("package.json"));
var lockObj = {
name: packageObj.name,
version: packageObj.version,
lockfileVersion: 2,
requires: true,
packages: {
"": {
name: packageObj.name,
version: packageObj.version,
license: packageObj.license,
bin: packageObj.bin,
dependencies: packageObj.dependencies,
engines: packageObj.engines,
optionalDependencies: packageObj.optionalDependencies
}
},
dependencies: {}
};
function augmentPackageJSON(filePath, packages, dependencies) {
var packageJSON = path.join(filePath, "package.json");
if(fs.existsSync(packageJSON)) {
var packageObj = JSON.parse(fs.readFileSync(packageJSON));
packages[filePath] = {
version: packageObj.version,
integrity: "sha1-000000000000000000000000000=",
dependencies: packageObj.dependencies,
engines: packageObj.engines,
optionalDependencies: packageObj.optionalDependencies
};
dependencies[packageObj.name] = {
version: packageObj.version,
integrity: "sha1-000000000000000000000000000=",
dependencies: {}
};
processDependencies(path.join(filePath, "node_modules"), packages, dependencies[packageObj.name].dependencies);
}
}
function processDependencies(dir, packages, dependencies) {
if(fs.existsSync(dir)) {
var files = fs.readdirSync(dir);
files.forEach(function(entry) {
var filePath = path.join(dir, entry);
var stats = fs.statSync(filePath);
if(stats.isDirectory()) {
if(entry.substr(0, 1) == "@") {
// When we encounter a namespace folder, augment all packages belonging to the scope
var pkgFiles = fs.readdirSync(filePath);
pkgFiles.forEach(function(entry) {
if(stats.isDirectory()) {
var pkgFilePath = path.join(filePath, entry);
augmentPackageJSON(pkgFilePath, packages, dependencies);
}
});
} else {
augmentPackageJSON(filePath, packages, dependencies);
}
}
});
}
}
processDependencies("node_modules", lockObj.packages, lockObj.dependencies);
fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
'';
};
# Script that links bins defined in package.json to the node_modules bin directory
# NPM does not do this for top-level packages itself anymore as of v7
linkBinsScript = writeTextFile {
name = "linkbins.js";
text = ''
var fs = require('fs');
var path = require('path');
var packageObj = JSON.parse(fs.readFileSync("package.json"));
var nodeModules = Array(packageObj.name.split("/").length).fill("..").join(path.sep);
if(packageObj.bin !== undefined) {
fs.mkdirSync(path.join(nodeModules, ".bin"))
if(typeof packageObj.bin == "object") {
Object.keys(packageObj.bin).forEach(function(exe) {
if(fs.existsSync(packageObj.bin[exe])) {
console.log("linking bin '" + exe + "'");
fs.symlinkSync(
path.join("..", packageObj.name, packageObj.bin[exe]),
path.join(nodeModules, ".bin", exe)
);
}
else {
console.log("skipping non-existent bin '" + exe + "'");
}
})
}
else {
if(fs.existsSync(packageObj.bin)) {
console.log("linking bin '" + packageObj.bin + "'");
fs.symlinkSync(
path.join("..", packageObj.name, packageObj.bin),
path.join(nodeModules, ".bin", packageObj.name.split("/").pop())
);
}
else {
console.log("skipping non-existent bin '" + packageObj.bin + "'");
}
}
}
else if(packageObj.directories !== undefined && packageObj.directories.bin !== undefined) {
fs.mkdirSync(path.join(nodeModules, ".bin"))
fs.readdirSync(packageObj.directories.bin).forEach(function(exe) {
if(fs.existsSync(path.join(packageObj.directories.bin, exe))) {
console.log("linking bin '" + exe + "'");
fs.symlinkSync(
path.join("..", packageObj.name, packageObj.directories.bin, exe),
path.join(nodeModules, ".bin", exe)
);
}
else {
console.log("skipping non-existent bin '" + exe + "'");
}
})
}
'';
};
prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
let
forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
in
''
# Pinpoint the versions of all dependencies to the ones that are actually being used
echo "pinpointing versions of dependencies..."
source $pinpointDependenciesScriptPath
# Patch the shebangs of the bundled modules to prevent them from
# calling executables outside the Nix store as much as possible
patchShebangs .
# Deploy the Node.js package by running npm install. Since the
# dependencies have been provided already by ourselves, it should not
# attempt to install them again, which is good, because we want to make
# it Nix's responsibility. If it needs to install any dependencies
# anyway (e.g. because the dependency parameters are
# incomplete/incorrect), it fails.
#
# The other responsibilities of NPM are kept -- version checks, build
# steps, postprocessing etc.
export HOME=$TMPDIR
cd "${packageName}"
runHook preRebuild
${lib.optionalString bypassCache ''
${lib.optionalString reconstructLock ''
if [ -f package-lock.json ]
then
echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
rm package-lock.json
else
echo "No package-lock.json file found, reconstructing..."
fi
node ${reconstructPackageLock}
''}
node ${addIntegrityFieldsScript}
''}
npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
runHook postRebuild
if [ "''${dontNpmInstall-}" != "1" ]
then
# NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
rm -f npm-shrinkwrap.json
npm ${forceOfflineFlag} --nodedir=${nodeSources} --no-bin-links --ignore-scripts ${npmFlags} ${lib.optionalString production "--production"} install
fi
# Link executables defined in package.json
node ${linkBinsScript}
'';
# Builds and composes an NPM package including all its dependencies
buildNodePackage =
{ name
, packageName
, version ? null
, dependencies ? []
, buildInputs ? []
, production ? true
, npmFlags ? ""
, dontNpmInstall ? false
, bypassCache ? false
, reconstructLock ? false
, preRebuild ? ""
, dontStrip ? true
, unpackPhase ? "true"
, buildPhase ? "true"
, meta ? {}
, ... }@args:
let
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
in
stdenv.mkDerivation ({
name = "${name}${if version == null then "" else "-${version}"}";
buildInputs = [ tarWrapper python nodejs ]
++ lib.optional (stdenv.isLinux) utillinux
++ lib.optional (stdenv.isDarwin) libtool
++ buildInputs;
inherit nodejs;
inherit dontStrip; # Stripping may fail a build for some package deployments
inherit dontNpmInstall preRebuild unpackPhase buildPhase;
compositionScript = composePackage args;
pinpointDependenciesScript = pinpointDependenciesOfPackage args;
passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
installPhase = ''
source ${installPackage}
# Create and enter a root node_modules/ folder
mkdir -p $out/lib/node_modules
cd $out/lib/node_modules
# Compose the package and all its dependencies
source $compositionScriptPath
${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
# Create symlink to the deployed executable folder, if applicable
if [ -d "$out/lib/node_modules/.bin" ]
then
ln -s $out/lib/node_modules/.bin $out/bin
# Fixup all executables
ls $out/bin/* | while read i
do
file="$(readlink -f "$i")"
chmod u+rwx "$file"
if isScript "$file"
then
sed -i 's/\r$//' "$file" # convert crlf to lf
fi
done
fi
# Create symlinks to the deployed manual page folders, if applicable
if [ -d "$out/lib/node_modules/${packageName}/man" ]
then
mkdir -p $out/share
for dir in "$out/lib/node_modules/${packageName}/man/"*
do
mkdir -p $out/share/man/$(basename "$dir")
for page in "$dir"/*
do
ln -s $page $out/share/man/$(basename "$dir")
done
done
fi
# Run post install hook, if provided
runHook postInstall
'';
meta = {
# default to Node.js' platforms
platforms = nodejs.meta.platforms;
} // meta;
} // extraArgs);
# Builds a node environment (a node_modules folder and a set of binaries)
buildNodeDependencies =
{ name
, packageName
, version ? null
, src
, dependencies ? []
, buildInputs ? []
, production ? true
, npmFlags ? ""
, dontNpmInstall ? false
, bypassCache ? false
, reconstructLock ? false
, dontStrip ? true
, unpackPhase ? "true"
, buildPhase ? "true"
, ... }@args:
let
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
in
stdenv.mkDerivation ({
name = "node-dependencies-${name}${if version == null then "" else "-${version}"}";
buildInputs = [ tarWrapper python nodejs ]
++ lib.optional (stdenv.isLinux) utillinux
++ lib.optional (stdenv.isDarwin) libtool
++ buildInputs;
inherit dontStrip; # Stripping may fail a build for some package deployments
inherit dontNpmInstall unpackPhase buildPhase;
includeScript = includeDependencies { inherit dependencies; };
pinpointDependenciesScript = pinpointDependenciesOfPackage args;
passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
installPhase = ''
source ${installPackage}
mkdir -p $out/${packageName}
cd $out/${packageName}
source $includeScriptPath
# Create fake package.json to make the npm commands work properly
cp ${src}/package.json .
chmod 644 package.json
${lib.optionalString bypassCache ''
if [ -f ${src}/package-lock.json ]
then
cp ${src}/package-lock.json .
chmod 644 package-lock.json
fi
''}
# Go to the parent folder to make sure that all packages are pinpointed
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
# Expose the executables that were installed
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
mv ${packageName} lib
ln -s $out/lib/node_modules/.bin $out/bin
'';
} // extraArgs);
# Builds a development shell
buildNodeShell =
{ name
, packageName
, version ? null
, src
, dependencies ? []
, buildInputs ? []
, production ? true
, npmFlags ? ""
, dontNpmInstall ? false
, bypassCache ? false
, reconstructLock ? false
, dontStrip ? true
, unpackPhase ? "true"
, buildPhase ? "true"
, ... }@args:
let
nodeDependencies = buildNodeDependencies args;
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ];
in
stdenv.mkDerivation ({
name = "node-shell-${name}${if version == null then "" else "-${version}"}";
buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
buildCommand = ''
mkdir -p $out/bin
cat > $out/bin/shell <<EOF
#! ${stdenv.shell} -e
$shellHook
exec ${stdenv.shell}
EOF
chmod +x $out/bin/shell
'';
# Provide the dependencies in a development shell through the NODE_PATH environment variable
inherit nodeDependencies;
shellHook = lib.optionalString (dependencies != []) ''
export NODE_PATH=${nodeDependencies}/lib/node_modules
export PATH="${nodeDependencies}/bin:$PATH"
'';
} // extraArgs);
in
{
buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
buildNodePackage = lib.makeOverridable buildNodePackage;
buildNodeDependencies = lib.makeOverridable buildNodeDependencies;
buildNodeShell = lib.makeOverridable buildNodeShell;
}

5886
headplane-node2nix/node-packages.nix Normal file
View File

File diff suppressed because it is too large Load Diff

14087
headplane-node2nix/package-lock.json generated Normal file
View File

File diff suppressed because it is too large Load Diff

88
headplane-node2nix/package.json Normal file
View File

@ -0,0 +1,88 @@
{
"name": "headplane",
"private": true,
"sideEffects": false,
"version": "0.5.10",
"type": "module",
"scripts": {
"build": "react-router build",
"dev": "HEADPLANE_LOAD_ENV_OVERRIDES=true HEADPLANE_CONFIG_PATH=./config.example.yaml react-router dev",
"start": "node build/server/index.js",
"typecheck": "tsc"
},
"dependencies": {
"@dnd-kit/core": "^6.3.1",
"@dnd-kit/modifiers": "^7.0.0",
"@dnd-kit/sortable": "^8.0.0",
"@dnd-kit/utilities": "^3.2.2",
"@fontsource-variable/inter": "^5.1.1",
"@hono/node-server": "^1.14.0",
"@kubernetes/client-node": "^0.22.3",
"@primer/octicons-react": "^19.14.0",
"@react-aria/toast": "3.0.0-beta.18",
"@react-router/node": "^7.4.0",
"@react-stately/toast": "3.0.0-beta.7",
"@shopify/lang-jsonc": "^1.0.0",
"@tailwindcss/postcss": "^4.1.0",
"@types/react": "^19.0.2",
"@types/react-dom": "^19.0.2",
"@uiw/codemirror-theme-github": "^4.23.7",
"@uiw/codemirror-theme-xcode": "^4.23.8",
"@uiw/react-codemirror": "^4.23.7",
"arktype": "^2.0.4",
"clsx": "^2.1.1",
"dotenv": "^16.4.7",
"isbot": "^5.1.19",
"lucide-react": "^0.473.0",
"mime": "^4.0.6",
"openid-client": "^6.1.7",
"react": "19.0.0",
"react-aria": "^3.37.0",
"react-codemirror-merge": "^4.23.7",
"react-dom": "19.0.0",
"react-error-boundary": "^5.0.0",
"react-icons": "^5.5.0",
"react-router": "^7.4.0",
"react-router-hono-server": "^2.11.0",
"react-stately": "^3.35.0",
"remix-utils": "^8.0.0",
"tailwind-merge": "^2.6.0",
"undici": "^7.2.0",
"usehooks-ts": "^3.1.0",
"ws": "^8.18.1",
"yaml": "^2.7.0",
"zod": "^3.24.1"
},
"devDependencies": {
"@babel/preset-typescript": "^7.26.0",
"@biomejs/biome": "^1.9.4",
"@react-router/dev": "^7.4.0",
"@types/websocket": "^1.0.10",
"@types/ws": "^8.5.13",
"autoprefixer": "^10.4.21",
"babel-plugin-react-compiler": "19.0.0-beta-55955c9-20241229",
"lefthook": "^1.10.9",
"postcss": "^8.5.3",
"react-router-dom": "^7.4.0",
"react-scan": "^0.1.0",
"tailwindcss": "^4.0.0",
"@tailwindcss/postcss": "^4.1.0",
"tailwindcss-animate": "^1.0.7",
"tailwindcss-react-aria-components": "^2.0.0",
"typescript": "^5.8.2",
"vite": "^6.2.2",
"vite-node": "^3.0.8",
"vite-plugin-babel": "^1.3.0",
"vite-tsconfig-paths": "^5.1.4"
},
"engines": {
"node": ">=22",
"pnpm": ">=10 <11"
},
"pnpm": {
"patchedDependencies": {
"@shopify/lang-jsonc@1.0.0": "patches/@shopify__lang-jsonc@1.0.0.patch",
"react-router-hono-server": "patches/react-router-hono-server.patch"
}
}
}

25
headplane.nix.notneeded Normal file
View File

@ -0,0 +1,25 @@
{ config, lib, inputs, pkgs, ... }: # Added pkgs to arguments
let
domain = "kennys.mom";
in {
imports = [ inputs.headplane.nixosModules.default ];
services.headplane = {
enable = true;
settings = {
server.addr = "127.0.0.1:8080"; # Use dedicated port
headscale = {
url = "https://headscale.${domain}";
grpc_address = "127.0.0.1:50443";
api_key_file = "/etc/headscale/apikey";
};
};
};
# Required firewall openings
networking.firewall.allowedTCPPorts = [
50443 # Headscale gRPC port
];
}

114
headplane.nix.original Normal file
View File

@ -0,0 +1,114 @@
{ config, pkgs, ... }:
let
domain = "kennys.mom";
headplanePort = 3000; # Adjusted to match your configuration
headplaneDir = "/opt/headplane"; # Directory to store the project
configYamlPath = "/etc/headplane/config/headplane.yaml"; # Path to the generated config YAML
headscaleConfigPath = "/var/lib/headscale/config.yaml"; # Default path for Headscale config
cookieSecret = "iQ0bUyaFgwaijWaSyZ1ILA9RwfywrbZ3";
# Define the structure of the YAML file data
yamlData = {
server = {
host = "0.0.0.0";
port = headplanePort;
cookie_secret = cookieSecret;
cookie_secure = false;
};
headscale = {
url = "https://headscale.${domain}";
config_path = headscaleConfigPath;
config_strict = true;
};
integration = {
proc = {
enabled = true;
};
};
};
# Define a YAML format for generating the configuration
settingsFormat = pkgs.formats.yaml { };
# Generate the headplane.yaml file using the settings format
configFile = settingsFormat.generate "headplane.yaml" yamlData;
# If you need to create another config file for CLI, you could do so here (optional)
# cliConfigFile = settingsFormat.generate "cli_config.yaml" cliData;
in
{
# Ensure the generated config file is placed in the correct location
environment.etc."headplane/config/headplane.yaml".source = configFile;
services = {
# NGINX configuration for Headplane
nginx = {
enable = true;
virtualHosts."headplane.${domain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:${toString headplanePort}";
proxyWebsockets = true;
};
};
};
};
# Ensure the necessary directories exist
# systemd.tmpfiles.rules = [
# "d /etc/headplane/config 0755 root root" # Creating directory for headplane.yaml
# "d /opt/headplane 0755 root root" # Ensure the main directory for Headplane exists
# ];
# Systemd service for building, running, and managing Headplane
# systemd.services.headplane = {
# description = "Headplane Service";
# wantedBy = [ "multi-user.target" ];
# # Use a shell script to automate building and running Headplane
# # script = ''
# # # Clone Headplane repository if not already cloned
# # if [ ! -d "${headplaneDir}" ]; then
# # echo "CLONING REPO NOW";
# # git clone https://github.com/tale/headplane ${headplaneDir}
# # fi
# # cd ${headplaneDir}
# # # Install dependencies and build the project
# # ${pkgs.pnpm}/bin/pnpm install
# # ${pkgs.pnpm}/bin/pnpm build
# # # Start the Headplane server with the generated config
# # node build/headplane/server.js --config ${configYamlPath}
# # # ${pkgs.nodejs}/bin/node ${headplaneDir}/build/headplane/server.js --config ${configYamlPath}
# # '';
# # serviceConfig = {
# # Restart = "always"; # Ensure the service is always running
# # User = "headplane"; # You may need to create this user (e.g., `useradd headplane`)
# # Group = "headplane"; # Same for the group
# # WorkingDirectory = headplaneDir;
# # ExecStart = "${pkgs.nodejs}/bin/node ${headplaneDir}/build/server/index.js --config ${configYamlPath}";
# # };
# };
# Optional: Ensure we have necessary dependencies like Node.js, pnpm, etc.
# environment.systemPackages = with pkgs; [
# nodejs
# nodePackages.pnpm
# git
# ];
# # Create the headplane user and group
# users.groups.headplane = {};
# users.users.headplane = {
# isSystemUser = true;
# home = "/opt/headplane";
# group = "headplane";
# };
}

32
headplane2.nix.old Normal file
View File

@ -0,0 +1,32 @@
{ config, pkgs, ... }:
let
domain = "kennys.mom";
headplanePort = 3000; # Adjusted to match your configuration
headplaneDir = "/opt/headplane"; # Directory to store the project
configYamlPath = "/etc/headplane/config/headplane.yaml"; # Path to the generated config YAML
headscaleConfigPath = "/var/lib/headscale/config.yaml"; # Default path for Headscale config
cookieSecret = "iQ0bUyaFgwaijWaSyZ1ILA9RwfywrbZ3";
in
{
services = {
headplane = {
enable=true;
};
# NGINX configuration for Headplane
nginx = {
enable = true;
virtualHosts."headplane.${domain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:${toString headplanePort}";
proxyWebsockets = true;
};
};
};
};
}

32
headplane3.nix.old Normal file
View File

@ -0,0 +1,32 @@
{ config, pkgs, ... }:
let
domain = "kennys.mom";
headplanePort = 3000; # Adjusted to match your configuration
headplaneDir = "/opt/headplane"; # Directory to store the project
configYamlPath = "/etc/headplane/config/headplane.yaml"; # Path to the generated config YAML
headscaleConfigPath = "/var/lib/headscale/config.yaml"; # Default path for Headscale config
cookieSecret = "iQ0bUyaFgwaijWaSyZ1ILA9RwfywrbZ3";
in
{
services = {
headplane = {
enable=true;
};
# NGINX configuration for Headplane
nginx = {
enable = true;
virtualHosts."headplane.${domain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:${toString headplanePort}";
proxyWebsockets = true;
};
};
};
};
}

79
headplane4.nix.old Normal file
View File

@ -0,0 +1,79 @@
{ config, pkgs, ... }:
let
domain = "kennys.mom";
headplanePort = 3000;
cookieSecret = "iQ0bUyaFgwaijWaSyZ1ILA9RwfywrbZ3";
yamlData = {
server = {
host = "0.0.0.0";
port = headplanePort;
cookie_secret = cookieSecret;
cookie_secure = false;
};
headscale = {
url = "https://headscale.${domain}";
config_path = "/var/lib/headscale/config.yaml";
config_strict = true;
};
integration = { proc = { enabled = true; }; };
};
yamlFormat = pkgs.formats.yaml { };
configFile = yamlFormat.generate "headplane.yaml" yamlData;
headplane = pkgs.stdenv.mkDerivation {
pname = "headplane";
version = "test";
src = pkgs.fetchFromGitHub {
owner = "dahjah";
repo = "headplane";
rev = "test";
sha256 = "1vs2cdh1w30cfrdf428k066chkh0ag03byrbr8c1i69984jq0jqv";
};
buildInputs = [
pkgs.nodejs_22
(pkgs.yarn.override { nodejs = pkgs.nodejs_22; })
];
installPhase = ''
export HOME=$PWD
export PATH=${pkgs.nodejs_22}/bin:$PATH
yarn install --ignore-engines --frozen-lockfile || yarn install --ignore-engines --network-concurrency 1 --frozen-lockfile
yarn build
mkdir -p $out/share/headplane
cp -r build/* $out/share/headplane/
mkdir -p $out/bin
cat > $out/bin/headplane <<EOF
#!${pkgs.runtimeShell}
exec ${pkgs.nodejs_22}/bin/node $out/share/headplane/server/index.js "\$@"
EOF
chmod +x $out/bin/headplane
'';
};
in
{
environment.systemPackages = [ headplane ];
environment.etc."headplane/config.yaml".source = configFile;
users.users.headplane = {
isSystemUser = true;
group = "headplane";
description = "Headplane service user";
};
users.groups.headplane = {};
systemd.services.headplane = {
description = "Headplane Web UI";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${headplane}/bin/headplane --config /etc/headplane/config.yaml";
Restart = "on-failure";
User = "headplane";
Group = "headplane";
DynamicUser = false;
};
};
}

80
headplane5.nix.old Normal file
View File

@ -0,0 +1,80 @@
{ config, lib, pkgs, ... }:
let
domain = "kennys.mom";
headplanePort = 3000;
cookieSecret = "iQ0bUyaFgwaijWaSyZ1ILA9RwfywrbZ3";
# Generate YAML config for headplane
yamlData = {
server = {
host = "0.0.0.0";
port = headplanePort;
cookie_secret = cookieSecret;
cookie_secure = false;
};
headscale = {
url = "https://headscale.${domain}";
config_path = "/var/lib/headscale/config.yaml";
config_strict = true;
};
integration = { proc = { enabled = true; }; };
};
yamlFormat = pkgs.formats.yaml { };
configFile = yamlFormat.generate "headplane.yaml" yamlData;
headplanePkg = pkgs.stdenv.mkDerivation {
pname = "headplane";
version = "0.5.10";
src = pkgs.fetchFromGitHub {
owner = "tale";
repo = "headplane";
rev = "0.5.10";
sha256 = "sha256-Nx4rqH/dV/jg7txvXa40malRPYBeKE+ifd1pUswq/Gg=";
};
buildInputs = [
pkgs.nodejs_22
(pkgs.yarn.override { nodejs = pkgs.nodejs_22; })
];
installPhase = ''
export HOME=$PWD
export PATH=${pkgs.nodejs_22}/bin:$PATH
yarn install --ignore-engines --frozen-lockfile || yarn install --ignore-engines --network-concurrency 1 --frozen-lockfile
yarn build
mkdir -p $out/share/headplane
cp -r build/* $out/share/headplane/
mkdir -p $out/bin
cat > $out/bin/headplane <<EOF
#!${pkgs.runtimeShell}
exec ${pkgs.nodejs_22}/bin/node $out/share/headplane/server/index.js "\$@"
EOF
chmod +x $out/bin/headplane
'';
};
in
{
environment.systemPackages = [ headplanePkg ];
environment.etc."headplane/config.yaml".source = configFile;
users.users.headplane = {
isSystemUser = true;
group = "headplane";
description = "Headplane service user";
};
users.groups.headplane = {};
systemd.services.headplane = {
description = "Headplane Web UI";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${headplanePkg}/bin/headplane --config /etc/headplane/config.yaml";
Restart = "on-failure";
User = "headplane";
Group = "headplane";
DynamicUser = false;
};
};
}

149
headscale.nix Normal file
View File

@ -0,0 +1,149 @@
{
config,
pkgs,
lib,
...
}:
let
domain = "kennys.mom";
derpPort = 3478;
# Generate the exact YAML config headplane wants
format = pkgs.formats.yaml {};
configStrict = lib.recursiveUpdate (builtins.removeAttrs config.services.headscale.settings [ "oidc" ]) {
tls_cert_path = "/dev/null";
tls_key_path = "/dev/null";
policy.path = "/dev/null";
};
headscaleConfigFile = format.generate "headscale-strict.yml" configStrict;
in
{
services.headscale = {
enable = true;
address = "0.0.0.0";
port = 8085;
settings = {
dns = {
override_local_dns = true;
base_domain = "hs.${domain}";
magic_dns = true;
domains = [ "hs.${domain}" ];
nameservers = {
global = [
"1.1.1.1"
"9.9.9.9"
];
};
};
server_url = "https://headscale.${domain}";
metrics_listen_addr = "127.0.0.1:8095";
logtail = {
enabled = false;
};
log = {
level = "warn";
};
derp.server = {
enable = true;
region_id = 999;
stun_listen_addr = "0.0.0.0:${toString derpPort}";
};
ip_prefixes = [
"100.64.0.0/10"
"fd7a:115c:a1e0::/48"
];
grpc_listen_addr = "127.0.0.1:50443"; # Required for Headplane communication
api_key_path = "/etc/headscale/apikey";
policy.mode = "database";
};
};
# Put strict config as file for headplane
environment.etc."headscale-strict.yml".source = headscaleConfigFile;
services.nginx = {
enable = true;
virtualHosts."headscale.${domain}" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://127.0.0.1:${toString config.services.headscale.port}";
proxyWebsockets = true;
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
'';
};
"/metrics" = {
proxyPass = "http://${config.services.headscale.settings.metrics_listen_addr}/metrics";
};
};
};
# Separate virtual host for Headplane UI
virtualHosts."headplane.${domain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
return = "301 http://$host/admin";
};
locations."/admin" = {
proxyPass = "http://127.0.0.1:3000";
proxyWebsockets = true;
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
'';
};
# Also proxy assets and other paths to headplane
locations."/assets" = {
proxyPass = "http://127.0.0.1:3000";
};
locations."/api" = {
proxyPass = "http://127.0.0.1:3000";
};
};
};
# configure ssl certificate options
security.acme = {
defaults.email = "dj@monumetric.com";
acceptTerms = true;
};
# punch through firewall
networking.firewall.allowedUDPPorts = [ derpPort ];
networking.firewall.allowedTCPPorts = [
80
443
];
# add headscale package to system
environment.systemPackages = [ config.services.headscale.package ];
# Ensure headscale API key exists for Headplane
systemd.services.headscale-api-key = {
description = "Generate Headscale API key for Headplane";
wantedBy = [ "multi-user.target" ];
before = [ "headplane.service" ];
after = [ "headscale.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
if [ ! -f /etc/headscale/apikey ]; then
echo "Generating Headscale API key..."
mkdir -p /etc/headscale
${config.services.headscale.package}/bin/headscale apikeys create --expiration 999d > /etc/headscale/apikey
chmod 600 /etc/headscale/apikey
echo "API key generated at /etc/headscale/apikey"
else
echo "API key already exists"
fi
'';
};
}

103
headscale.nix.working-old Normal file
View File

@ -0,0 +1,103 @@
{
config,
...
}:
let
domain = "kennys.mom"; # domain to use
derpPort = 3478; # default derp port
in
{
services = {
# enable headscale service and configure
headscale = {
enable = true;
address = "0.0.0.0";
port = 8085;
settings = {
dns = {
override_local_dns = true;
base_domain = "hs.${domain}";
magic_dns = true;
domains = [ "hs.${domain}" ];
nameservers = {
global = [
"1.1.1.1"
"9.9.9.9"
];
};
};
server_url = "https://headscale.${domain}";
metrics_listen_addr = "127.0.0.1:8095";
logtail = {
enabled = false;
};
log = {
level = "warn";
};
derp.server = {
enable = true;
region_id = 999;
stun_listen_addr = "0.0.0.0:${toString derpPort}";
};
ip_prefixes = [
"100.64.0.0/10"
"fd7a:115c:a1e0::/48"
];
grpc_listen_addr = "127.0.0.1:50443"; # Required for Headplane communication
api_key_path = "/etc/headscale/apikey"; # Add this line
};
};
# reverse proxy with ssl
nginx = {
enable = true;
virtualHosts."headscale.${domain}" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://127.0.0.1:${toString config.services.headscale.port}";
proxyWebsockets = true;
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
'';
};
"/metrics" = {
proxyPass = "http://${config.services.headscale.settings.metrics_listen_addr}/metrics";
};
"/headplane/" = {
proxyPass = "http://127.0.0.1:8080/";
proxyWebsockets = true; # Remove explicit proxy_http_version
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
'';
};
};
};
};
};
# configure ssl certificate options
security.acme = {
defaults.email = "dj@monumetric.com";
acceptTerms = true;
};
# punch through firewall
networking.firewall.allowedUDPPorts = [ derpPort ];
networking.firewall.allowedTCPPorts = [
80
443
];
# add headscale package to system
environment.systemPackages = [ config.services.headscale.package ];
}

1
result Symbolic link
View File

@ -0,0 +1 @@
/nix/store/p9zd0gs1jrjpphmcsa0gdkxczz4cgd1w-nixos-system-headscale-25.05.20250831.b4c2c57