---
- name: Headscale service
  ansible.builtin.import_role:
    name: service
  vars:
    service_name: headscale
    service_container_image: docker.io/headscale/headscale:stable
    service_container_command: serve
    service_container_mounts:
      - type: volume
        source: data
        destination: /var/lib/headscale
      - type: template
        source: config.yaml.j2
        destination: /etc/headscale/config.yaml
      - type: template
        source: policy.hujson.j2
        destination: /etc/headscale/policy.hujson
        template_validate_command: headscale policy check --file /etc/headscale/policy.hujson
    service_container_http_port: 8080
    service_domains:
      - "{{ headscale_domain }}"
    service_container_publish_ports:
      - name: stun
        container_port: 3478
        protocol: udp
        host_port: 3478
    service_container_secrets: "{{ _headscale_secrets }}"
    service_container_reload_method: kill

- name: Open port for stun
  ansible.posix.firewalld:
    service: stun
    state: enabled
    permanent: true
    immediate: true