99 lines
4.1 KiB
YAML
99 lines
4.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: headplane-config
|
|
data:
|
|
config.yaml: |
|
|
# Configuration for the Headplane server and web application
|
|
server:
|
|
host: "0.0.0.0"
|
|
port: 3000
|
|
|
|
# The secret used to encode and decode web sessions
|
|
# Ensure that this is exactly 32 characters long
|
|
cookie_secret: "<change_me_to_something_secure!>"
|
|
|
|
# Should the cookies only work over HTTPS?
|
|
# Set to false if running via HTTP without a proxy
|
|
# (I recommend this is true in production)
|
|
cookie_secure: true
|
|
|
|
# Headscale specific settings to allow Headplane to talk
|
|
# to Headscale and access deep integration features
|
|
headscale:
|
|
# The URL to your Headscale instance
|
|
# (All API requests are routed through this URL)
|
|
# (THIS IS NOT the gRPC endpoint, but the HTTP endpoint)
|
|
#
|
|
# IMPORTANT: If you are using TLS this MUST be set to `https://`
|
|
url: "http://0.0.0.0:8080"
|
|
|
|
# If you use the TLS configuration in Headscale, and you are not using
|
|
# Let's Encrypt for your certificate, pass in the path to the certificate.
|
|
# (This has no effect `url` does not start with `https://`)
|
|
# tls_cert_path: "/var/lib/headplane/tls.crt"
|
|
|
|
# Optional, public URL if they differ
|
|
# This affects certain parts of the web UI
|
|
# public_url: "https://headscale.example.com"
|
|
|
|
# Path to the Headscale configuration file
|
|
# This is optional, but HIGHLY recommended for the best experience
|
|
# If this is read only, Headplane will show your configuration settings
|
|
# in the Web UI, but they cannot be changed.
|
|
config_path: "/etc/headscale/config.yaml"
|
|
|
|
# Headplane internally validates the Headscale configuration
|
|
# to ensure that it changes the configuration in a safe way.
|
|
# If you want to disable this validation, set this to false.
|
|
config_strict: true
|
|
|
|
# Integration configurations for Headplane to interact with Headscale
|
|
# Only one of these should be enabled at a time or you will get errors
|
|
integration:
|
|
kubernetes:
|
|
enabled: true
|
|
# Validates the manifest for the Pod to ensure all of the criteria
|
|
# are set correctly. Turn this off if you are having issues with
|
|
# shareProcessNamespace not being validated correctly.
|
|
validate_manifest: true
|
|
# This should be the name of the Pod running Headscale and Headplane.
|
|
# If this isn't static you should be using the Kubernetes Downward API
|
|
# to set this value (refer to docs/Integrated-Mode.md for more info).
|
|
pod_name: "headscale"
|
|
|
|
|
|
|
|
# # OIDC Configuration for simpler authentication
|
|
# # (This is optional, but recommended for the best experience)
|
|
# oidc:
|
|
# issuer: "https://accounts.google.com"
|
|
# client_id: "your-client-id"
|
|
|
|
# # The client secret for the OIDC client
|
|
# # Either this or `client_secret_path` must be set for OIDC to work
|
|
# client_secret: "<your-client-secret>"
|
|
# # You can alternatively set `client_secret_path` to read the secret from disk.
|
|
# # The path specified can resolve environment variables, making integration
|
|
# # with systemd's `LoadCredential` straightforward:
|
|
# # client_secret_path: "${CREDENTIALS_DIRECTORY}/oidc_client_secret"
|
|
|
|
# disable_api_key_login: false
|
|
# token_endpoint_auth_method: "client_secret_post"
|
|
|
|
# # If you are using OIDC, you need to generate an API key
|
|
# # that can be used to authenticate other sessions when signing in.
|
|
# #
|
|
# # This can be done with `headscale apikeys create --expiration 999d`
|
|
# headscale_api_key: "<your-headscale-api-key>"
|
|
|
|
# # Optional, but highly recommended otherwise Headplane
|
|
# # will attempt to automatically guess this from the issuer
|
|
# #
|
|
# # This should point to your publicly accessibly URL
|
|
# # for your Headplane instance with /admin/oidc/callback
|
|
# redirect_uri: "http://localhost:3000/admin/oidc/callback"
|
|
|
|
# # Stores the users and their permissions for Headplane
|
|
# # This is a path to a JSON file, default is specified below.
|
|
# user_storage_file: "/var/lib/headplane/users.json" |