---
argument_specs:
  main:
    description: "Sets up a headscale container"
    options:
      headscale_domain:
        description: Domain headscale should be available at
        type: str
        required: true
      headscale_magicdns_base_domain:
        description: Base domain for magic dns hostnames
        type: str
        required: true
      headscale_policy:
        description:
          - Headscale policy configuration.
          - See https://headscale.net/stable/ref/acls/
          - This role's support for acls is currently quite limited. Waiting for headscale to release grants support.
        type: dict
        required: true
        options:
          groups:
            description: >-
              Groups of users. Formatted as dict where dict key is group name and
              value is a list of users in the group.
            type: dict
            required: false
          hosts:
            description: Mapping of host names to ip addresses
            type: dict
            required: false
          tagOwners:
            description: Mapping of tags to lists of their owners
            type: dict
            required: false
          acls:
            description: List of acls
            type: list
            required: true
            elements: dict
            options:
              action:
                description: ACL action
                type: str
                required: true
                choices:
                  - accept
                  - check
              src:
                description: >-
                  A list of sources, formatted as prefix:name:ports,
                  where prefix is the type of object, like tag: or group:,
                  name is the object name and ports is a comma separated list of ports or *
                type: list
                required: true
                elements: str
              dst:
                description: A list of destinations. Same format as sources.
                type: list
                required: true
                elements: str
              proto:
                description: Protocol
                type: str
                required: false
                choices:
                  - tcp
                  - udp
                  - icmp

      headscale_oidc_issuer_url:
        description: OIDC issuer url. Leave unset to not use OIDC.
        type: str
        required: false
        default: ""
      headscale_oidc_client_id:
        description: OIDC client id. Required if OIDC issuer is set.
        type: str
        required: false
        default: ""
      headscale_oidc_client_secret:
        description: OIDC client secret. Required if OIDC issuer is set.
        type: str
        required: false
        default: ""