Commit 70be86a

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ A4/d81/UDEmm8OEfU9iSdeSVLgtVajqOUbTUE8Wfn+5+
+SX7DGcRAsTXchZHE7V2Wi4H06h7Fl166b9Ns6q+M2nE
+-> \-grease UepA :I +- mTL~G
+tDEtv5KKP0zvsRlVxQ
+--- cbMhahcU9v7lmbuXlIXpyXJQAirJcundduQYCH3yIHQ
+Nr�.�\riq�
Ѫ���!�4UF�������v��j���Ő^��鲩�D��Ϯ�]�/K��:�N
\ No newline at end of file

@@ -10,6 +10,11 @@
       domains = ["goatcounter.hpcesia.com"];
     };
 
+    services.headplane = {
+      domain = "gate.trin.one";
+      port = 3466;
+      cookieSecretFileAged = ./headplane-cookie-secret.age;
+    };
     services.headscale = {
       domain = "gate.trin.one";
       port = 3465;
@@ -37,6 +42,7 @@
 
       den.aspects.services.artalk
       den.aspects.services.goatcounter
+      den.aspects.services.headplane
       den.aspects.services.headscale
       den.aspects.services.vaultwarden
       den.aspects.services.wakapi

@@ -0,0 +1,70 @@
+{lib, ...}: {
+  den.aspects.services.headplane = {
+    settings = {
+      domain = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 8081;
+      };
+      cookieSecretFileAged = lib.mkOption {
+        type = lib.types.path;
+        description = "An age encypted file containing the cookie secret. The secret must be exactly 32 characters long.";
+      };
+    };
+
+    persist = {
+      directories = [
+        {
+          directory = "/var/lib/headplane";
+          user = "headscale";
+          group = "headscale";
+          mode = "0700";
+        }
+      ];
+    };
+
+    reverseProxy = {host, ...}: let
+      cfg = host.settings.services.headplane;
+    in {
+      ${cfg.domain} = {
+        port = cfg.port;
+        path = "/admin";
+        stripPath = false;
+      };
+    };
+
+    nixos = {
+      host,
+      config,
+      ...
+    }: let
+      cfg = host.settings.services.headplane;
+    in {
+      services.headplane = {
+        enable = true;
+
+        settings = {
+          headscale = {
+            config_path = "/var/lib/headscale/config.yaml";
+            dns_records_path = "/var/lib/headscale/dns-records.json";
+          };
+          server = {
+            base_url = "https://${cfg.domain}/admin/oidc/callback";
+            port = cfg.port;
+            cookie_secret_path = config.vaultix.secrets.headplane-cookie-secret.path;
+          };
+        };
+      };
+
+      vaultix.secrets.headplane-cookie-secret = {
+        file = cfg.cookieSecretFileAged;
+        owner = config.services.headscale.user;
+        group = config.services.headscale.group;
+        mode = "0400";
+      };
+    };
+  };
+}

@@ -181,6 +181,7 @@
           exec ${lib.getExe hsCfg.package} serve --config ${mutableConfig}
         '';
       };
+
       vaultix.templates.headscale-env =
         lib.mkIf (hostAddr.ipv4.secret.name != null || hostAddr.ipv6.secret.name != null)
         {