Ryan Malloy
5abc3c87b2
- Add Groups field to User struct with JSON storage - Include GetGroups() and SetGroups() helper methods - Extract groups from OIDC claims in FromClaim() - Add database migration 202509161200 for groups column - Update config-example.yaml with groups scope - Add comprehensive documentation and testing
103 lines
3.0 KiB
YAML
103 lines
3.0 KiB
YAML
services:
|
|
# Headscale control server
|
|
headscale:
|
|
image: headscale/headscale:latest
|
|
container_name: headscale-server
|
|
volumes:
|
|
- ./headscale-config.yaml:/etc/headscale/config.yaml
|
|
- ./acl.hujson:/etc/headscale/acl.hujson
|
|
- headscale-data:/var/lib/headscale
|
|
ports:
|
|
- "8180:8080" # HTTP API
|
|
- "9090:9090" # Metrics
|
|
- "50443:50443" # gRPC
|
|
command: serve
|
|
restart: unless-stopped
|
|
networks:
|
|
headscale-net:
|
|
ipv4_address: 10.99.0.10
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
start_period: 10s
|
|
|
|
# Tailscale client 1
|
|
tailscale-client1:
|
|
image: tailscale/tailscale:latest
|
|
container_name: tailscale-client1
|
|
hostname: client1
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
environment:
|
|
- TS_STATE_DIR=/var/lib/tailscale
|
|
- TS_EXTRA_ARGS=--login-server=http://headscale:8080
|
|
- TS_HOSTNAME=client1
|
|
- TS_AUTHKEY=${TS_AUTHKEY_CLIENT1:-}
|
|
- TS_ACCEPT_ROUTES=true
|
|
- TS_USERSPACE=false
|
|
volumes:
|
|
- tailscale-client1-state:/var/lib/tailscale
|
|
- /dev/net/tun:/dev/net/tun
|
|
- ./scripts/client-init.sh:/usr/local/bin/client-init.sh:ro
|
|
networks:
|
|
headscale-net:
|
|
ipv4_address: 10.99.0.21
|
|
depends_on:
|
|
- headscale
|
|
restart: unless-stopped
|
|
command: sh -c "tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock --tun=userspace-networking & sleep 5 && /usr/local/bin/client-init.sh client1 && wait"
|
|
|
|
# Tailscale client 2
|
|
tailscale-client2:
|
|
image: tailscale/tailscale:latest
|
|
container_name: tailscale-client2
|
|
hostname: client2
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
environment:
|
|
- TS_STATE_DIR=/var/lib/tailscale
|
|
- TS_EXTRA_ARGS=--login-server=http://headscale:8080
|
|
- TS_HOSTNAME=client2
|
|
- TS_AUTHKEY=${TS_AUTHKEY_CLIENT2:-}
|
|
- TS_ACCEPT_ROUTES=true
|
|
- TS_USERSPACE=false
|
|
volumes:
|
|
- tailscale-client2-state:/var/lib/tailscale
|
|
- /dev/net/tun:/dev/net/tun
|
|
- ./scripts/client-init.sh:/usr/local/bin/client-init.sh:ro
|
|
networks:
|
|
headscale-net:
|
|
ipv4_address: 10.99.0.22
|
|
depends_on:
|
|
- headscale
|
|
restart: unless-stopped
|
|
command: sh -c "tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock --tun=userspace-networking & sleep 5 && /usr/local/bin/client-init.sh client2 && wait"
|
|
|
|
# Optional: A simple web server for testing connectivity
|
|
test-webserver:
|
|
image: nginx:alpine
|
|
container_name: test-webserver
|
|
hostname: webserver
|
|
networks:
|
|
headscale-net:
|
|
ipv4_address: 10.99.0.30
|
|
volumes:
|
|
- ./www:/usr/share/nginx/html:ro
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
headscale-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 10.99.0.0/24
|
|
gateway: 10.99.0.1
|
|
|
|
volumes:
|
|
headscale-data:
|
|
tailscale-client1-state:
|
|
tailscale-client2-state: |