Add headscale

roles/headscale/tasks/main.yaml

@@ -0,0 +1,36 @@
+---
+- name: Headscale service
+  ansible.builtin.import_role:
+    name: service
+  vars:
+    service_name: headscale
+    service_container_image: docker.io/headscale/headscale:stable
+    service_container_command: serve
+    service_container_mounts:
+      - type: volume
+        source: data
+        destination: /var/lib/headscale
+      - type: template
+        source: config.yaml.j2
+        destination: /etc/headscale/config.yaml
+      - type: template
+        source: policy.hujson.j2
+        destination: /etc/headscale/policy.hujson
+        template_validate_command: headscale policy check --file /etc/headscale/policy.hujson
+    service_container_http_port: 8080
+    service_domains:
+      - "{{ headscale_domain }}"
+    service_container_publish_ports:
+      - name: stun
+        container_port: 3478
+        protocol: udp
+        host_port: 3478
+    service_container_secrets: "{{ _headscale_secrets }}"
+    service_container_reload_method: kill
+
+- name: Open port for stun
+  ansible.posix.firewalld:
+    service: stun
+    state: enabled
+    permanent: true
+    immediate: true