57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
31 lines
1.5 KiB
Bash
31 lines
1.5 KiB
Bash
# Copy to .env and fill in. docker compose picks .env up automatically.
|
|
|
|
# ─── Public hostnames ───────────────────────────────────────────────────────
|
|
# Bare hostname (no scheme) where headscale will be reached. Tailscale
|
|
# clients connect here over HTTPS.
|
|
HEADSCALE_DOMAIN=hs.example.com
|
|
|
|
# Email for Let's Encrypt registration / expiry notifications.
|
|
ACME_EMAIL=admin@example.com
|
|
|
|
# Magic-DNS suffix for nodes inside the tailnet. Example: with
|
|
# TAILNET_DOMAIN=tail.example.com, a host called "laptop" will resolve to
|
|
# laptop.tail.example.com. MUST be different from HEADSCALE_DOMAIN.
|
|
TAILNET_DOMAIN=tail.example.com
|
|
|
|
# ─── OIDC (pocket-id) ───────────────────────────────────────────────────────
|
|
# Hostname (no scheme) of your pocket-id deployment, used as the OIDC
|
|
# issuer. Must match the issuer URL pocket-id advertises at
|
|
# /.well-known/openid-configuration.
|
|
POCKETID_DOMAIN=auth.example.com
|
|
|
|
# Register a new OIDC client in pocket-id's admin UI with redirect URI:
|
|
# https://${HEADSCALE_DOMAIN}/oidc/callback
|
|
# Then paste the credentials here.
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
|
|
# ─── Image tags ─────────────────────────────────────────────────────────────
|
|
HEADSCALE_TAG=0.28.0
|
|
CADDY_TAG=2-alpine
|