fix outbound stuff

18 files changed, 362 insertions, 411 deletions

diff --git a/deploy.yml b/deploy.yml
index fff39f3..250f4b3 100644
--- a/deploy.yml
+++ b/deploy.yml
@@ -25,7 +25,7 @@
   ansible.builtin.import_playbook: playbooks/portainer.yml
 
 - name: Keepalived
-  ansible.builtin.import_playbook: playbooks/portainer.yml
+  ansible.builtin.import_playbook: playbooks/keepalived.yml
 
 - name: Pihole
   ansible.builtin.import_playbook: playbooks/pihole.yml
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 40d888c..5066a4d 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -8,6 +8,9 @@ rfc1918_cgnat_networks:
   - 100.64.0.0/10
 
 timezone: "America/Los_Angeles"
+domain: "liz.coffee"
+idm_domain: "idm.{{ domain }}"
+headscale_host: "vpn.{{ domain }}"
 
-# first deployment
-homelab_build: true
+# first deployment?
+homelab_build: false
diff --git a/group_vars/kanidm.yml b/group_vars/kanidm.yml
index 0e871a9..4e508eb 100644
--- a/group_vars/kanidm.yml
+++ b/group_vars/kanidm.yml
@@ -1,5 +1,4 @@
 ---
 
 kanidm_base: "{{ swarm_base }}/kanidm"
-kanidm_host: "idm.liz.coffee"
 
diff --git a/group_vars/outbound.yml b/group_vars/outbound.yml
index c8cde32..0dac73a 100644
--- a/group_vars/outbound.yml
+++ b/group_vars/outbound.yml
@@ -1,10 +1,21 @@
 ---
 
-headscale_host: 'vpn.liz.coffee'
 headscale_url: 'https://{{ headscale_host }}'
-headscale_base_domain: 'vpn.liz.coffee'
+headscale_base_domain: '{{ headscale_host }}'
 headscale_port: '8080'
-headscale_listen_addr: '127.0.0.1:{{ headscale_port }}'
+headscale_listen_addr: '0.0.0.0:{{ headscale_port }}'
 
 headscale_dns_for_connected_clients_1: '1.1.1.1'
 headscale_dns_for_connected_clients_2: '1.0.0.1'
+
+generate_api_key: '{{ homelab_build }}'
+api_key_expiration: '1y'
+generate_auth_key: '{{ homelab_build }}'
+auth_key_expiration: '1y'
+auth_key_user: 'pocketmonsters'
+
+headscale_allowed_users:
+  - liz
+  - lucina
+  - riley
+  - "{{ auth_key_user }}"
diff --git a/group_vars/traefik.yml b/group_vars/traefik.yml
index 85d890b..75d7e0f 100644
--- a/group_vars/traefik.yml
+++ b/group_vars/traefik.yml
@@ -1,6 +1,6 @@
 ---
 
-# super incredible processing servers
-traefik_domain: sips.liz.coffee
+# super internal private servers
+traefik_domain: "sips.{{ domain }}"
 certs_email: "{{ cloudflare_email }}"
 traefik_base: "{{ swarm_base }}/traefik"
diff --git a/playbooks/roles/kanidm/templates/stacks/docker-compose.yml b/playbooks/roles/kanidm/templates/stacks/docker-compose.yml
index 4ce98d2..8ba1c98 100644
--- a/playbooks/roles/kanidm/templates/stacks/docker-compose.yml
+++ b/playbooks/roles/kanidm/templates/stacks/docker-compose.yml
@@ -11,7 +11,7 @@ services:
       - /bin/sh
       - -c
       - |
-        [ ! -f "/certs/{{ kanidm_host }}.pem" ] && sleep 60
+        [ ! -f "/certs/{{ idm_domain }}.pem" ] && sleep 60
         /sbin/kanidmd server -c /data/server.toml
     healthcheck:
       disable: true
@@ -24,7 +24,7 @@ services:
         - traefik.swarm.network=proxy
         - traefik.http.routers.kanidm.tls=true
         - traefik.http.routers.kanidm.tls.certResolver=letsencrypt
-        - traefik.http.routers.kanidm.rule=Host(`{{ kanidm_host }}`)
+        - traefik.http.routers.kanidm.rule=Host(`{{ idm_domain }}`)
         - traefik.http.routers.kanidm.entrypoints=websecure
         - traefik.http.services.kanidm.loadbalancer.server.port=8443
         - traefik.http.services.kanidm.loadbalancer.server.scheme=https
diff --git a/playbooks/roles/kanidm/templates/volumes/data/server.toml b/playbooks/roles/kanidm/templates/volumes/data/server.toml
index 5e42bc8..75bd7c2 100644
--- a/playbooks/roles/kanidm/templates/volumes/data/server.toml
+++ b/playbooks/roles/kanidm/templates/volumes/data/server.toml
@@ -2,9 +2,9 @@ bindaddress = "0.0.0.0:8443"
 ldapbindaddress = "0.0.0.0:3636"
 trust_x_forward_for = true
 db_path = "/data/kanidm.db"
-tls_chain = "/certs/{{ kanidm_host }}.pem"
-tls_key = "/certs/{{ kanidm_host }}.key"
+tls_chain = "/certs/{{ idm_domain }}.pem"
+tls_key = "/certs/{{ idm_domain }}.key"
 log_level = "info"
 
-domain = "{{ kanidm_host }}"
-origin = "https://{{ kanidm_host }}"
+domain = "{{ idm_domain }}"
+origin = "https://{{ idm_domain }}"
diff --git a/playbooks/roles/outbound/tasks/main.yml b/playbooks/roles/outbound/tasks/main.yml
index 84070d6..863351f 100644
--- a/playbooks/roles/outbound/tasks/main.yml
+++ b/playbooks/roles/outbound/tasks/main.yml
@@ -1,17 +1,18 @@
 ---
 
-- name: Build headscale compose dirs
+# Headscale setup
+- name: Build headscale compose dirs and files
   ansible.builtin.file:
     state: directory
     dest: '/etc/docker/compose/headscale/{{ item.path }}'
-  with_filetree: '../templates'
+  with_filetree: '../templates/headscale'
   when: item.state == 'directory'
 
-- name: Build headscale compose files
+- name: Build headscale compose templates
   ansible.builtin.template:
     src: '{{ item.src }}'
     dest: '/etc/docker/compose/headscale/{{ item.path }}'
-  with_filetree: '../templates'
+  with_filetree: '../templates/headscale'
   when: item.state == 'file'
 
 - name: Daemon-reload and enable headscale
@@ -21,8 +22,86 @@
     daemon_reload: true
     name: docker-compose@headscale
 
-- name: Perform rollout incase daemon already started
+- name: Perform rollout for headscale
   ansible.builtin.shell:
-    cmd: /usr/local/bin/docker-rollout rollout -f docker-compose.yml headscale
+    cmd: "/usr/local/bin/docker-rollout rollout -f docker-compose.yml headscale"
+    chdir: "/etc/docker/compose/headscale"
+
+# User API Key
+- name: Generate API key if homelab build
+  ansible.builtin.shell:
+    cmd: docker compose exec -it headscale headscale apikeys create --expiration "{{ api_key_expiration }}"
     chdir: /etc/docker/compose/headscale
+  register: api_key_result
+  when: generate_api_key
+
+- name: Store and display API key
+  when: generate_api_key
+  block:
+    - name: Define API Key Variable
+      set_fact:
+        headscale_api_key: "{{ api_key_result.stdout }}"
+
+    - name: Echo new key
+      ansible.builtin.debug:
+        msg: "Please store this API Key! {{ headscale_api_key }}"
+
+    - name: Pause until user confirms
+      ansible.builtin.pause:
+        prompt: "Press return when ready!"
+
+# System user auth key
+- name: Create system key user and auth key if homelab build
+  when: generate_auth_key
+  block:
+    - name: Create system key user
+      ansible.builtin.shell:
+        cmd: docker compose exec -it headscale headscale users create "{{ auth_key_user }}"
+        chdir: /etc/docker/compose/headscale
+
+    - name: Create auth key preauthkey
+      ansible.builtin.shell:
+        cmd: docker compose exec -it headscale headscale preauthkeys create --reusable --expiration "{{ auth_key_expiration }}" --user "{{ auth_key_user }}"
+        chdir: /etc/docker/compose/headscale
+      register: auth_key_result
+
+    - name: Store and display Auth Key
+      block:
+        - name: Define Auth Key Variable
+          set_fact:
+            headscale_user_auth_key: "{{ auth_key_result.stdout }}"
+
+        - name: Echo new auth key
+          ansible.builtin.debug:
+            msg: "Please store this Auth Key for user {{ auth_key_user }}! {{ headscale_user_auth_key }}"
+
+        - name: Pause until user confirms
+          ansible.builtin.pause:
+            prompt: "Press return when ready!"
+
+# Proxy setup (AFTER API key generation)
+- name: Build proxy compose dirs and files
+  ansible.builtin.file:
+    state: directory
+    dest: '/etc/docker/compose/proxy/{{ item.path }}'
+  with_filetree: '../templates/proxy'
+  when: item.state == 'directory'
+
+- name: Build proxy compose templates
+  ansible.builtin.template:
+    src: '{{ item.src }}'
+    dest: '/etc/docker/compose/proxy/{{ item.path }}'
+  with_filetree: '../templates/proxy'
+  when: item.state == 'file'
 
+- name: Daemon-reload and enable proxy
+  ansible.builtin.systemd_service:
+    state: started
+    enabled: true
+    daemon_reload: true
+    name: docker-compose@proxy
+
+- name: Perform rollout for proxy
+  ansible.builtin.shell:
+    cmd: "/usr/local/bin/docker-rollout rollout -f docker-compose.yml proxy"
+    chdir: "/etc/docker/compose/proxy"
diff --git a/playbooks/roles/outbound/templates/config/config.yaml b/playbooks/roles/outbound/templates/config/config.yaml
deleted file mode 100644
index 6d3fdae..0000000
--- a/playbooks/roles/outbound/templates/config/config.yaml
+++ /dev/null
@@ -1,387 +0,0 @@
----
-
-server_url: '{{ headscale_url }}'
-listen_addr: '{{ headscale_listen_addr }}'
-
-# Address to listen to /metrics, you may want
-# to keep this endpoint private to your internal
-# network
-#
-metrics_listen_addr: 127.0.0.1:9090
-
-# Address to listen for gRPC.
-# gRPC is used for controlling a headscale server
-# remotely with the CLI
-# Note: Remote access _only_ works if you have
-# valid certificates.
-#
-# For production:
-# grpc_listen_addr: 0.0.0.0:50443
-grpc_listen_addr: 127.0.0.1:50443
-
-# Allow the gRPC admin interface to run in INSECURE
-# mode. This is not recommended as the traffic will
-# be unencrypted. Only enable if you know what you
-# are doing.
-grpc_allow_insecure: false
-
-# The Noise section includes specific configuration for the
-# TS2021 Noise protocol
-noise:
-  # The Noise private key is used to encrypt the
-  # traffic between headscale and Tailscale clients when
-  # using the new Noise-based protocol.
-  private_key_path: /var/lib/headscale/noise_private.key
-
-# List of IP prefixes to allocate tailaddresses from.
-# Each prefix consists of either an IPv4 or IPv6 address,
-# and the associated prefix length, delimited by a slash.
-# It must be within IP ranges supported by the Tailscale
-# client - i.e., subnets of 100.64.0.0/10 and fd7a:115c:a1e0::/48.
-# See below:
-# IPv6: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#LL81C52-L81C71
-# IPv4: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#L33
-# Any other range is NOT supported, and it will cause unexpected issues.
-prefixes:
-  v4: 100.64.0.0/10
-  v6: fd7a:115c:a1e0::/48
-
-  # Strategy used for allocation of IPs to nodes, available options:
-  # - sequential (default): assigns the next free IP from the previous given IP.
-  # - random: assigns the next free IP from a pseudo-random IP generator (crypto/rand).
-  allocation: sequential
-
-# DERP is a relay system that Tailscale uses when a direct
-# connection cannot be established.
-# https://tailscale.com/blog/how-tailscale-works/#encrypted-tcp-relays-derp
-#
-# headscale needs a list of DERP servers that can be presented
-# to the clients.
-derp:
-  server:
-    # If enabled, runs the embedded DERP server and merges it into the rest of the DERP config
-    # The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place
-    enabled: false
-
-    # Region ID to use for the embedded DERP server.
-    # The local DERP prevails if the region ID collides with other region ID coming from
-    # the regular DERP config.
-    region_id: 999
-
-    # Region code and name are displayed in the Tailscale UI to identify a DERP region
-    region_code: "headscale"
-    region_name: "Headscale Embedded DERP"
-
-    # Listens over UDP at the configured address for STUN connections - to help with NAT traversal.
-    # When the embedded DERP server is enabled stun_listen_addr MUST be defined.
-    #
-    # For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/
-    stun_listen_addr: "0.0.0.0:3478"
-
-    # Private key used to encrypt the traffic between headscale DERP
-    # and Tailscale clients.
-    # The private key file will be autogenerated if it's missing.
-    #
-    private_key_path: /var/lib/headscale/derp_server_private.key
-
-    # This flag can be used, so the DERP map entry for the embedded DERP server is not written automatically,
-    # it enables the creation of your very own DERP map entry using a locally available file with the parameter DERP.paths
-    # If you enable the DERP server and set this to false, it is required to add the DERP server to the DERP map using DERP.paths
-    automatically_add_embedded_derp_region: true
-
-    # For better connection stability (especially when using an Exit-Node and DNS is not working),
-    # it is possible to optionally add the public IPv4 and IPv6 address to the Derp-Map using:
-    ipv4: 1.2.3.4
-    ipv6: 2001:db8::1
-
-  # List of externally available DERP maps encoded in JSON
-  urls:
-    - https://controlplane.tailscale.com/derpmap/default
-
-  # Locally available DERP map files encoded in YAML
-  #
-  # This option is mostly interesting for people hosting
-  # their own DERP servers:
-  # https://tailscale.com/kb/1118/custom-derp-servers/
-  #
-  # paths:
-  #   - /etc/headscale/derp-example.yaml
-  paths: []
-
-  # If enabled, a worker will be set up to periodically
-  # refresh the given sources and update the derpmap
-  # will be set up.
-  auto_update_enabled: true
-
-  # How often should we check for DERP updates?
-  update_frequency: 24h
-
-# Disables the automatic check for headscale updates on startup
-disable_check_updates: false
-
-# Time before an inactive ephemeral node is deleted?
-ephemeral_node_inactivity_timeout: 30m
-
-database:
-  # Database type. Available options: sqlite, postgres
-  # Please note that using Postgres is highly discouraged as it is only supported for legacy reasons.
-  # All new development, testing and optimisations are done with SQLite in mind.
-  type: sqlite
-
-  # Enable debug mode. This setting requires the log.level to be set to "debug" or "trace".
-  debug: false
-
-  # GORM configuration settings.
-  gorm:
-    # Enable prepared statements.
-    prepare_stmt: true
-
-    # Enable parameterized queries.
-    parameterized_queries: true
-
-    # Skip logging "record not found" errors.
-    skip_err_record_not_found: true
-
-    # Threshold for slow queries in milliseconds.
-    slow_threshold: 1000
-
-  # SQLite config
-  sqlite:
-    path: /var/lib/headscale/db.sqlite
-
-    # Enable WAL mode for SQLite. This is recommended for production environments.
-    # https://www.sqlite.org/wal.html
-    write_ahead_log: true
-
-    # Maximum number of WAL file frames before the WAL file is automatically checkpointed.
-    # https://www.sqlite.org/c3ref/wal_autocheckpoint.html
-    # Set to 0 to disable automatic checkpointing.
-    wal_autocheckpoint: 1000
-
-  # # Postgres config
-  # Please note that using Postgres is highly discouraged as it is only supported for legacy reasons.
-  # See database.type for more information.
-  # postgres:
-  #   # If using a Unix socket to connect to Postgres, set the socket path in the 'host' field and leave 'port' blank.
-  #   host: localhost
-  #   port: 5432
-  #   name: headscale
-  #   user: foo
-  #   pass: bar
-  #   max_open_conns: 10
-  #   max_idle_conns: 10
-  #   conn_max_idle_time_secs: 3600
-
-  #   # If other 'sslmode' is required instead of 'require(true)' and 'disabled(false)', set the 'sslmode' you need
-  #   # in the 'ssl' field. Refers to https://www.postgresql.org/docs/current/libpq-ssl.html Table 34.1.
-  #   ssl: false
-
-### TLS configuration
-#
-## Let's encrypt / ACME
-#
-# headscale supports automatically requesting and setting up
-# TLS for a domain with Let's Encrypt.
-#
-# URL to ACME directory
-acme_url: https://acme-v02.api.letsencrypt.org/directory
-
-# Email to register with ACME provider
-acme_email: ""
-
-# Domain name to request a TLS certificate for:
-tls_letsencrypt_hostname: ""
-
-# Path to store certificates and metadata needed by
-# letsencrypt
-# For production:
-tls_letsencrypt_cache_dir: /var/lib/headscale/cache
-
-# Type of ACME challenge to use, currently supported types:
-# HTTP-01 or TLS-ALPN-01
-# See: docs/ref/tls.md for more information
-tls_letsencrypt_challenge_type: HTTP-01
-# When HTTP-01 challenge is chosen, letsencrypt must set up a
-# verification endpoint, and it will be listening on:
-# :http = port 80
-tls_letsencrypt_listen: ":http"
-
-## Use already defined certificates:
-tls_cert_path: ""
-tls_key_path: ""
-
-log:
-  # Output formatting for logs: text or json
-  format: text
-  level: info
-
-## Policy
-# headscale supports Tailscale's ACL policies.
-# Please have a look to their KB to better
-# understand the concepts: https://tailscale.com/kb/1018/acls/
-policy:
-  # The mode can be "file" or "database" that defines
-  # where the ACL policies are stored and read from.
-  mode: file
-  # If the mode is set to "file", the path to a
-  # HuJSON file containing ACL policies.
-  path: ""
-
-## DNS
-#
-# headscale supports Tailscale's DNS configuration and MagicDNS.
-# Please have a look to their KB to better understand the concepts:
-#
-# - https://tailscale.com/kb/1054/dns/
-# - https://tailscale.com/kb/1081/magicdns/
-# - https://tailscale.com/blog/2021-09-private-dns-with-magicdns/
-#
-# Please note that for the DNS configuration to have any effect,
-# clients must have the `--accept-dns=true` option enabled. This is the
-# default for the Tailscale client. This option is enabled by default
-# in the Tailscale client.
-#
-# Setting _any_ of the configuration and `--accept-dns=true` on the
-# clients will integrate with the DNS manager on the client or
-# overwrite /etc/resolv.conf.
-# https://tailscale.com/kb/1235/resolv-conf
-#
-# If you want stop Headscale from managing the DNS configuration
-# all the fields under `dns` should be set to empty values.
-dns:
-  # Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).
-  magic_dns: true
-
-  # Defines the base domain to create the hostnames for MagicDNS.
-  # This domain _must_ be different from the server_url domain.
-  # `base_domain` must be a FQDN, without the trailing dot.
-  # The FQDN of the hosts will be
-  # `hostname.base_domain` (e.g., _myhost.example.com_).
-  base_domain: "{{ headscale_base_domain }}"
-
-  # List of DNS servers to expose to clients.
-  nameservers:
-    global:
-      - {{ headscale_dns_for_connected_clients_1 }}
-      - {{ headscale_dns_for_connected_clients_2 }}
-
-      # NextDNS (see https://tailscale.com/kb/1218/nextdns/).
-      # "abc123" is example NextDNS ID, replace with yours.
-      # - https://dns.nextdns.io/abc123
-
-    # Split DNS (see https://tailscale.com/kb/1054/dns/),
-    # a map of domains and which DNS server to use for each.
-    split:
-      {}
-      # foo.bar.com:
-      #   - 1.1.1.1
-      # darp.headscale.net:
-      #   - 1.1.1.1
-      #   - 8.8.8.8
-
-  # Set custom DNS search domains. With MagicDNS enabled,
-  # your tailnet base_domain is always the first search domain.
-  search_domains: []
-
-  # Extra DNS records
-  # so far only A and AAAA records are supported (on the tailscale side)
-  # See: docs/ref/dns.md
-  extra_records: []
-  #   - name: "grafana.myvpn.example.com"
-  #     type: "A"
-  #     value: "100.64.0.3"
-  #
-  #   # you can also put it in one line
-  #   - { name: "prometheus.myvpn.example.com", type: "A", value: "100.64.0.3" }
-  #
-  # Alternatively, extra DNS records can be loaded from a JSON file.
-  # Headscale processes this file on each change.
-  # extra_records_path: /var/lib/headscale/extra-records.json
-
-# Unix socket used for the CLI to connect without authentication
-# Note: for production you will want to set this to something like:
-unix_socket: /var/run/headscale/headscale.sock
-unix_socket_permission: "0770"
-#
-# headscale supports experimental OpenID connect support,
-# it is still being tested and might have some bugs, please
-# help us test it.
-# OpenID Connect
-# oidc:
-#   only_start_if_oidc_is_available: true
-#   issuer: "https://your-oidc.issuer.com/path"
-#   client_id: "your-oidc-client-id"
-#   client_secret: "your-oidc-client-secret"
-#   # Alternatively, set `client_secret_path` to read the secret from the file.
-#   # It resolves environment variables, making integration to systemd's
-#   # `LoadCredential` straightforward:
-#   client_secret_path: "${CREDENTIALS_DIRECTORY}/oidc_client_secret"
-#   # client_secret and client_secret_path are mutually exclusive.
-#
-#   # The amount of time from a node is authenticated with OpenID until it
-#   # expires and needs to reauthenticate.
-#   # Setting the value to "0" will mean no expiry.
-#   expiry: 180d
-#
-#   # Use the expiry from the token received from OpenID when the user logged
-#   # in, this will typically lead to frequent need to reauthenticate and should
-#   # only been enabled if you know what you are doing.
-#   # Note: enabling this will cause `oidc.expiry` to be ignored.
-#   use_expiry_from_token: false
-#
-#   # Customize the scopes used in the OIDC flow, defaults to "openid", "profile" and "email" and add custom query
-#   # parameters to the Authorize Endpoint request. Scopes default to "openid", "profile" and "email".
-#
-#   scope: ["openid", "profile", "email", "custom"]
-#   extra_params:
-#     domain_hint: example.com
-#
-#   # List allowed principal domains and/or users. If an authenticated user's domain is not in this list, the
-#   # authentication request will be rejected.
-#
-#   allowed_domains:
-#     - example.com
-#   # Note: Groups from keycloak have a leading '/'
-#   allowed_groups:
-#     - /headscale
-#   allowed_users:
-#     - alice@example.com
-#
-#   # Optional: PKCE (Proof Key for Code Exchange) configuration
-#   # PKCE adds an additional layer of security to the OAuth 2.0 authorization code flow
-#   # by preventing authorization code interception attacks
-#   # See https://datatracker.ietf.org/doc/html/rfc7636
-#   pkce:
-#     # Enable or disable PKCE support (default: false)
-#     enabled: false
-#     # PKCE method to use:
-#     # - plain: Use plain code verifier
-#     # - S256: Use SHA256 hashed code verifier (default, recommended)
-#     method: S256
-#
-#   # Map legacy users from pre-0.24.0 versions of headscale to the new OIDC users
-#   # by taking the username from the legacy user and matching it with the username
-#   # provided by the OIDC. This is useful when migrating from legacy users to OIDC
-#   # to force them using the unique identifier from the OIDC and to give them a
-#   # proper display name and picture if available.
-#   # Note that this will only work if the username from the legacy user is the same
-#   # and there is a possibility for account takeover should a username have changed
-#   # with the provider.
-#   # When this feature is disabled, it will cause all new logins to be created as new users.
-#   # Note this option will be removed in the future and should be set to false
-#   # on all new installations, or when all users have logged in with OIDC once.
-#   map_legacy_users: false
-
-# Logtail configuration
-# Logtail is Tailscales logging and auditing infrastructure, it allows the control panel
-# to instruct tailscale nodes to log their activity to a remote server.
-logtail:
-  # Enable logtail for this headscales clients.
-  # As there is currently no support for overriding the log server in headscale, this is
-  # disabled by default. Enabling this will make your clients send logs to Tailscale Inc.
-  enabled: false
-
-# Enabling this option makes devices prefer a random port for WireGuard traffic over the
-# default static port 41641. This option is intended as a workaround for some buggy
-# firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.
-randomize_client_port: false
diff --git a/playbooks/roles/outbound/templates/headscale/config/acl.json b/playbooks/roles/outbound/templates/headscale/config/acl.json
new file mode 100644
index 0000000..fe1197a
--- /dev/null
+++ b/playbooks/roles/outbound/templates/headscale/config/acl.json
@@ -0,0 +1,12 @@
+{
+  "groups": {
+    "group:admin": ["liz"]
+  },
+  "acls": [
+    {
+      "action": "accept",
+      "src": ["{{ auth_key_user }}"],
+      "dst": ["{{ auth_key_user }}:*", "10.0.0.0/8:*"]
+    }
+  ]
+}
diff --git a/playbooks/roles/outbound/templates/headscale/config/config.yaml b/playbooks/roles/outbound/templates/headscale/config/config.yaml
new file mode 100644
index 0000000..660708e
--- /dev/null
+++ b/playbooks/roles/outbound/templates/headscale/config/config.yaml
@@ -0,0 +1,169 @@
+---
+
+server_url: '{{ headscale_url }}'
+listen_addr: '{{ headscale_listen_addr }}'
+
+# Address to listen to /metrics, you may want
+# to keep this endpoint private to your internal
+# network
+#
+metrics_listen_addr: 127.0.0.1:9090
+
+# The Noise section includes specific configuration for the
+# TS2021 Noise protocol
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: random
+
+# DERP is a relay system that Tailscale uses when a direct
+# connection cannot be established.
+# https://tailscale.com/blog/how-tailscale-works/#encrypted-tcp-relays-derp
+#
+# headscale needs a list of DERP servers that can be presented
+# to the clients.
+derp:
+  server:
+    # If enabled, runs the embedded DERP server and merges it into the rest of the DERP config
+    # The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place
+    enabled: false
+
+    # Region ID to use for the embedded DERP server.
+    # The local DERP prevails if the region ID collides with other region ID coming from
+    # the regular DERP config.
+    region_id: 999
+
+    # Region code and name are displayed in the Tailscale UI to identify a DERP region
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+
+    # Listens over UDP at the configured address for STUN connections - to help with NAT traversal.
+    # When the embedded DERP server is enabled stun_listen_addr MUST be defined.
+    #
+    # For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/
+    stun_listen_addr: "0.0.0.0:3478"
+
+    # Private key used to encrypt the traffic between headscale DERP
+    # and Tailscale clients.
+    # The private key file will be autogenerated if it's missing.
+    #
+    private_key_path: /var/lib/headscale/derp_server_private.key
+
+    # This flag can be used, so the DERP map entry for the embedded DERP server is not written automatically,
+    # it enables the creation of your very own DERP map entry using a locally available file with the parameter DERP.paths
+    # If you enable the DERP server and set this to false, it is required to add the DERP server to the DERP map using DERP.paths
+    automatically_add_embedded_derp_region: true
+
+    # For better connection stability (especially when using an Exit-Node and DNS is not working),
+    # it is possible to optionally add the public IPv4 and IPv6 address to the Derp-Map using:
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+
+  # List of externally available DERP maps encoded in JSON
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+
+  # Locally available DERP map files encoded in YAML
+  #
+  # This option is mostly interesting for people hosting
+  # their own DERP servers:
+  # https://tailscale.com/kb/1118/custom-derp-servers/
+  #
+  # paths:
+  #   - /etc/headscale/derp-example.yaml
+  paths: []
+
+  # If enabled, a worker will be set up to periodically
+  # refresh the given sources and update the derpmap
+  # will be set up.
+  auto_update_enabled: true
+
+  # How often should we check for DERP updates?
+  update_frequency: 24h
+
+# Disables the automatic check for headscale updates on startup
+disable_check_updates: false
+
+# Time before an inactive ephemeral node is deleted?
+ephemeral_node_inactivity_timeout: 30m
+
+database:
+  type: sqlite
+
+  # Enable debug mode. This setting requires the log.level to be set to "debug" or "trace".
+  debug: false
+
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+
+  # SQLite config
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+
+
+log:
+  # Output formatting for logs: text or json
+  format: text
+  level: info
+
+policy:
+  mode: file
+  path: "/etc/headscale/acl.json"
+
+dns:
+  magic_dns: true
+  base_domain: "{{ headscale_base_domain }}"
+  nameservers:
+    global:
+      - {{ headscale_dns_for_connected_clients_1 }}
+      - {{ headscale_dns_for_connected_clients_2 }}
+    split:
+      {}
+      # foo.bar.com:
+      #   - 1.1.1.1
+  search_domains: []
+
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+
+oidc:
+  only_start_if_oidc_is_available: false
+  issuer: "https://{{ idm_domain }}"
+  client_id: "headscale"
+  client_secret: "{{ headscale_oidc_secret }}"
+
+  scope: ["openid", "profile", "email"]
+  pkce:
+    # Enable or disable PKCE support (default: false)
+    enabled: true
+    # PKCE method to use:
+    # - plain: Use plain code verifier
+    # - S256: Use SHA256 hashed code verifier (default, recommended)
+    method: S256
+
+  allowed_domains:
+    - {{ domain }}
+  allowed_users: {{ headscale_allowed_users }}
+  strip_email_domain: true
+
+# Logtail configuration
+# Logtail is Tailscales logging and auditing infrastructure, it allows the control panel
+# to instruct tailscale nodes to log their activity to a remote server.
+logtail:
+  # Enable logtail for this headscales clients.
+  # As there is currently no support for overriding the log server in headscale, this is
+  # disabled by default. Enabling this will make your clients send logs to Tailscale Inc.
+  enabled: false
+
+# Enabling this option makes devices prefer a random port for WireGuard traffic over the
+# default static port 41641. This option is intended as a workaround for some buggy
+# firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.
+randomize_client_port: false
diff --git a/playbooks/roles/outbound/templates/data/.gitkeep b/playbooks/roles/outbound/templates/headscale/data/.gitkeep
index e69de29..e69de29 100644
--- a/playbooks/roles/outbound/templates/data/.gitkeep
+++ b/playbooks/roles/outbound/templates/headscale/data/.gitkeep
diff --git a/playbooks/roles/outbound/templates/docker-compose.yml b/playbooks/roles/outbound/templates/headscale/docker-compose.yml
index c644ca4..ee140fb 100644
--- a/playbooks/roles/outbound/templates/docker-compose.yml
+++ b/playbooks/roles/outbound/templates/headscale/docker-compose.yml
@@ -16,7 +16,7 @@ services:
       - VIRTUAL_PORT={{ headscale_port }}
       - LETSENCRYPT_HOST={{ headscale_host }}
     healthcheck:
-      test: ["CMD", "wget", "-qO", "-", "http://localhost:8080/health"] 
+      test: ["CMD", "wget", "-qO", "-", "http://localhost:{{ headscale_port }}/health"] 
       interval: 10s
       timeout: 5s
       retries: 3
@@ -32,7 +32,7 @@ services:
       - VIRTUAL_PORT={{ headscale_port }}
       - LETSENCRYPT_HOST={{ headscale_host }}
       - VIRTUAL_PATH=/web/ 
-      - VIRTUAL_DEST=/
+      - VIRTUAL_DEST=/web/
 
 networks:
   proxy:
diff --git a/playbooks/roles/outbound/templates/proxy/data/.gitkeep b/playbooks/roles/outbound/templates/proxy/data/.gitkeep
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/playbooks/roles/outbound/templates/proxy/data/.gitkeep
diff --git a/playbooks/roles/outbound/templates/proxy/docker-compose.yml b/playbooks/roles/outbound/templates/proxy/docker-compose.yml
new file mode 100644
index 0000000..3074047
--- /dev/null
+++ b/playbooks/roles/outbound/templates/proxy/docker-compose.yml
@@ -0,0 +1,36 @@
+services:
+  headscale-client:
+    image: tailscale/tailscale:latest
+    environment:
+      - TS_AUTHKEY={{ headscale_user_auth_key }}
+      - TS_EXTRA_ARGS=--login-server=https://{{ headscale_host }} --accept-routes --accept-dns --stateful-filtering=false
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_USERSPACE=false
+      - TZ={{ timezone }}
+    hostname: headscale-outbound
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+    volumes:
+      - ./data:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+    networks:
+      - headnet
+  proxy:
+    image: nginx:latest
+    depends_on:
+      - headscale-client
+    networks:
+      - proxy
+      - headnet
+    environment:
+      - VIRTUAL_HOST=*.{{ domain }},{{ domain }}
+      - VIRTUAL_PORT=80
+      - LETSENCRYPT_HOST=*.{{ domain }},{{ domain }}
+
+networks:
+  headnet:
+  proxy:
+    external: true
+
diff --git a/playbooks/roles/traefik/templates/stacks/docker-compose.yml b/playbooks/roles/traefik/templates/stacks/docker-compose.yml
index 9f999e3..dfdd6ba 100644
--- a/playbooks/roles/traefik/templates/stacks/docker-compose.yml
+++ b/playbooks/roles/traefik/templates/stacks/docker-compose.yml
@@ -1,7 +1,32 @@
-version: '3.8'
 services:
+  headscale-client:
+    image: tailscale/tailscale:latest
+    hostname: headscale-traefik
+    restart: unless-stopped
+    environment:
+      - TS_AUTHKEY={{ headscale_user_auth_key }}
+      - TS_EXTRA_ARGS=--login-server=https://{{ headscale_host }} --accept-dns --stateful-filtering=false
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_USERSPACE=false
+      - TZ={{ timezone }}
+    volumes:
+      - {{ traefik_base }}/volumes/headscale:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+    networks:
+      - headnet
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role == manager]
   traefik:
     image: traefik:v3
+    restart: unless-stopped
+    depends_on:
+      - headscale-client
     ports:
       - 80:80
       - 443:443
@@ -17,6 +42,7 @@ services:
       - {{ traefik_base }}/volumes/certs:/certs
     networks:
       - proxy
+      - headnet
     deploy:
       mode: global
       placement:
@@ -39,3 +65,4 @@ networks:
     name: proxy
     driver: overlay
     attachable: true
+  headnet:
diff --git a/playbooks/roles/traefik/templates/volumes/headscale/.gitkeep b/playbooks/roles/traefik/templates/volumes/headscale/.gitkeep
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/playbooks/roles/traefik/templates/volumes/headscale/.gitkeep
diff --git a/secrets.txt b/secrets.txt
index f75cc8d..bf6b4f8 100644
--- a/secrets.txt
+++ b/secrets.txt
@@ -5,3 +5,5 @@ cloudflare_dns_api_token
 cloudflare_email
 ceph_secret
 pihole_webpwd
+headscale_oidc_secret
+headscale_user_auth_key