Publish privacy-safe Headscale deployment examples

headscale/config/acl.hujson.example

@@ -0,0 +1,7 @@
+{
+  // Permissive starter policy. Replace it with least-privilege rules.
+  "acls": [
+    { "action": "accept", "src": ["*"], "dst": ["*:*"] }
+  ],
+  "ssh": []
+}

headscale/config/config.yaml.example

@@ -0,0 +1,89 @@
+server_url: https://headscale.example.com
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+
+private_key_path: /var/lib/headscale/private.key
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: headscale
+    region_name: Headscale Embedded DERP
+    verify_clients: true
+    stun_listen_addr: 0.0.0.0:3478
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    # Replace this documentation-only address with the server's public IPv4.
+    ipv4: 203.0.113.10
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: false
+
+disable_check_updates: false
+node:
+  expiry: 0
+  ephemeral:
+    inactivity_timeout: 1h
+
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+
+# TLS is terminated by Traefik.
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+
+dns:
+  magic_dns: true
+  base_domain: dns.example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 8.8.8.8
+
+policy:
+  mode: file
+  path: /etc/headscale/acl.hujson
+
+log:
+  level: info
+  format: text
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false
+taildrop:
+  enabled: true
+
+# Optional OIDC example. Uncomment only in the ignored config.yaml file.
+# oidc:
+#   only_start_if_oidc_is_available: false
+#   issuer: https://auth.example.com/application/o/headscale/
+#   client_id: REPLACE_WITH_OIDC_CLIENT_ID
+#   client_secret: REPLACE_WITH_OIDC_CLIENT_SECRET
+#   scope: [openid, profile, email, groups]
+#   allowed_groups: [headscale-users]
+#   pkce:
+#     enabled: true
+#     method: S256