---
# vim:ft=yaml
# {{ ansible_managed }}

listen_addr: 0.0.0.0:8080
server_url: https://{{ headscale_domain }}

noise:
  private_key_path: /var/lib/headscale/noise_private.key

prefixes:
  v4: 100.64.0.0/10
  v6: fd7a:115c:a1e0::/48

  allocation: sequential

derp:
  server:
    enabled: true
    region_id: 999
    region_code: "headscale"
    region_name: "Headscale embedded DERP"
    verify_clients: true
    stun_listen_addr: "0.0.0.0:3478"
    private_key_path: /var/lib/headscale/derp_server_private.key

  urls: []

database:
  type: sqlite
  sqlite:
    path: /var/lib/headscale/db.sqlite

policy:
  mode: file
  path: /etc/headscale/policy.hujson

dns:
  magic_dns: true
  base_domain: {{ headscale_magicdns_base_domain }}
  nameservers:
    global:
      - https://dns.quad9.net/dns-query

logtail:
  enabled: false

{% if headscale_oidc_issuer_url | length > 0 %}
oidc:
  only_start_if_oidc_is_available: false
  issuer: {{ headscale_oidc_issuer_url }}
  client_id: "{{ headscale_oidc_client_id }}"
  client_secret_path: /run/secrets/oidc-client-secret
  pkce:
    enabled: true
{% endif %}