helmrelease.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-3.6.1/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: headscale
  namespace: headscale
spec:
  chart:
    spec:
      chart: app-template
      version: 3.6.1
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  values:
    controllers:
      headscale:
        containers:
          app:
            image:
              repository: ghcr.io/juanfont/headscale
              tag: v0.24.3@sha256:d5b4a6eb6d65d99b11c42e64883764ace90eaf6a89716794054bde9615e05be7
              pullPolicy: IfNotPresent
            command: [headscale, serve]
            env:
              HEADSCALE_SERVER_URL: https://${app_url}
              HEADSCALE_LISTEN_ADDR: 0.0.0.0:8080
              HEADSCALE_METRICS_LISTEN_ADDR: 0.0.0.0:9090

              HEADSCALE_PRIVATE_KEY_PATH: /etc/headscale/private.key
              HEADSCALE_NOISE: "{}"
              HEADSCALE_NOISE_PRIVATE_KEY_PATH: /etc/headscale/noise_private.key

              HEADSCALE_PREFIXES_V4: 100.64.0.0/10
              HEADSCALE_PREFIXES_V6: fd7a:115c:a1e0::/48

              HEADSCALE_DERP_URLS: https://controlplane.tailscale.com/derpmap/default
              HEADSCALE_DERP_AUTO_UPDATE_ENABLED: "true"
              HEADSCALE_DERP_UPDATE_FREQUENCY: "24h"

              HEADSCALE_EPHEMERAL_NODE_INACTIVITY_TIMEOUT: "30m"

              HEADSCALE_DNS_NAMESERVERS_GLOBAL: "1.1.1.1 1.0.0.1"
              HEADSCALE_DNS_MAGIC_DNS: "true"
              HEADSCALE_DNS_BASE_DOMAIN: ${base_domain}

              HEADSCALE_OIDC_ISSUER: ${oidc_issuer}
              HEADSCALE_OIDC_CLIENT_ID: ${oidc_client_id}
              HEADSCALE_OIDC_CLIENT_SECRET: ${oidc_client_secret}

              HEADSCALE_DATABASE_TYPE: postgres
              HEADSCALE_DATABASE_POSTGRES_HOST: postgresql-rw
              HEADSCALE_DATABASE_POSTGRES_PORT: "5432"
              HEADSCALE_DATABASE_POSTGRES_SSL: "true"
              HEADSCALE_DATABASE_POSTGRES_NAME: headscale
              HEADSCALE_DATABASE_POSTGRES_USER: headscale
              HEADSCALE_DATABASE_POSTGRES_PASS:
                secretKeyRef:
                  name: postgresql-app
                  key: password
            probes:
              liveness:
                enabled: true
                type: HTTP
                path: /health
              readiness:
                enabled: true
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
            securityContext:
              readOnlyRootFilesystem: true
        pod:
          terminationGracePeriodSeconds: 3
          labels:
            policy.gabe565.com/egress-namespace: "true"
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-ingress: "true"
            policy.gabe565.com/ingress-prometheus: "true"
      admin:
        strategy: RollingUpdate
        containers:
          main:
            image:
              repository: goodieshq/headscale-admin
              tag: 0.24.8
            securityContext:
              readOnlyRootFilesystem: true
            probes:
              liveness:
                enabled: true
              readiness:
                enabled: true
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
        pod:
          labels:
            policy.gabe565.com/ingress-ingress: "true"
          securityContext:
            runAsUser: 65534
            runAsGroup: 65534

    service:
      headscale:
        controller: headscale
        ports:
          http:
            primary: true
            port: 8080
          metrics:
            port: 9090
      admin:
        controller: admin
        ports:
          http:
            port: 80

    persistence:
      config:
        enabled: true
        type: secret
        name: headscale-config
        advancedMounts:
          headscale:
            app:
              - path: /etc/headscale/config.yaml
                subPath: config.yaml
              - path: /etc/headscale/private.key
                subPath: private.key
              - path: /etc/headscale/noise_private.key
                subPath: noise_private.key
      tmp:
        enabled: true
        type: emptyDir
        advancedMounts:
          headscale:
            app:
              - path: /var/run/headscale
                subPath: run

    ingress:
      headscale:
        enabled: true
        hosts:
          - host: ${app_url}
            paths:
              - path: /
                service:
                  identifier: headscale
                  port: http
        tls: &tls
          - secretName: ${certificate_name}
            hosts:
              - ${app_url}
      admin:
        enabled: true
        hosts:
          - host: ${app_url}
            paths:
              - path: /admin
                service:
                  identifier: admin
                  port: http
        tls: *tls

    secrets:
      config:
        enabled: true
        stringData:
          config.yaml: "{}"
          private.key: ${private_key}
          noise_private.key: ${noise_private_key}

    serviceMonitor:
      main:
        enabled: true
        serviceName: headscale
        endpoints:
          - port: metrics
            scheme: http
            path: /metrics
            interval: 1m
            scrapeTimeout: 10s