57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
49 lines
1.4 KiB
Markdown
49 lines
1.4 KiB
Markdown
# headscale
|
|
|
|
[Headscale](https://headscale.net) — a self-hosted Tailscale control server —
|
|
behind Caddy, with OIDC login delegated to [pocket-id](../pocket-id/).
|
|
|
|
## Prerequisite
|
|
|
|
Register an OIDC client in pocket-id's admin UI with redirect URI:
|
|
|
|
```
|
|
https://${HEADSCALE_DOMAIN}/oidc/callback
|
|
```
|
|
|
|
Then paste its `OIDC_CLIENT_ID` / `OIDC_CLIENT_SECRET` below.
|
|
|
|
## Required `.env` values
|
|
|
|
| Variable | Notes |
|
|
|----------|-------|
|
|
| `HEADSCALE_DOMAIN` | Public hostname (e.g. `hs.example.com`). Clients connect here over HTTPS. |
|
|
| `ACME_EMAIL` | Let's Encrypt registration email. |
|
|
| `TAILNET_DOMAIN` | MagicDNS suffix (e.g. `tail.example.com`). Must differ from `HEADSCALE_DOMAIN`. |
|
|
| `POCKETID_DOMAIN` | OIDC issuer hostname (your pocket-id). |
|
|
| `OIDC_CLIENT_ID` / `OIDC_CLIENT_SECRET` | From the pocket-id client above. |
|
|
|
|
The deploy substitutes these into `config.yaml` from the embedded template. See
|
|
[`.env.example`](.env.example).
|
|
|
|
## Deploy
|
|
|
|
```bash
|
|
./automations.sh # Deploy on this host → deploy: headscale
|
|
```
|
|
|
|
Or build + run the self-contained artifact:
|
|
|
|
```bash
|
|
./build.sh
|
|
scp deploy.sh root@host:
|
|
ssh root@host 'bash deploy.sh'
|
|
# non-interactive: pass HEADSCALE_DOMAIN, ACME_EMAIL, TAILNET_DOMAIN,
|
|
# POCKETID_DOMAIN, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, SKIP_PROMPTS=1
|
|
```
|
|
|
|
Unattended provisioning: [`cloud-init.yml`](cloud-init.yml).
|
|
|
|
DNS for `HEADSCALE_DOMAIN` must resolve to the host and 80/443 be reachable
|
|
before deploy.
|