feat(headscale): add self-hosted Tailscale control server stack

CLI-managed (no web UI), sqlite-backed, fronted by Traefik like the other stacks. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-16 15:55:36 +02:00
parent aaa4564a0b
commit 4951492f4c
4 changed files with 104 additions and 0 deletions
@@ -0,0 +1,64 @@
+# Base Headscale config. Host-specific values (server_url, listen addrs) are
+# overridden via HEADSCALE_* environment variables in compose.yml, following
+# headscale's viper env-binding (HEADSCALE_SERVER_URL overrides server_url, etc).
+# Full reference: https://github.com/juanfont/headscale/blob/main/config-example.yaml
+
+server_url: https://headscale.example.com
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+
+derp:
+  server:
+    enabled: false
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+
+disable_check_updates: false
+
+node:
+  ephemeral:
+    inactivity_timeout: 30m
+
+database:
+  type: sqlite
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+
+log:
+  format: text
+  level: info
+
+policy:
+  mode: file
+  path: ""
+
+dns:
+  magic_dns: true
+  base_domain: hs.internal
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+  search_domains: []
+
+# TLS is terminated by Traefik; headscale itself serves plain HTTP internally.
+tls_letsencrypt_hostname: ""
+tls_cert_path: ""
+tls_key_path: ""