headscale helm

No introduction found. Create it?

Install

Install with:

helm repo add bjw-s oci://ghcr.io/bjw-s/helm/
helm install headscale bjw-s/app-template -f values.yaml

Examples

See examples from other people.

Top Repositories (3 out of 4)

NameRepoStarsVersionTimestamp
headscaleharaldkoch/kochhaus-home1253.6.19 hours ago
headscalevaskozl/home-infra893.6.15 days ago
headscaleJJGadgets/Biohazard482.6.0a year ago

Values

See the most popular values for this chart:

KeyTypes
persistence.config.name (4)
headscale-config
string
persistence.config.type (4)
secret
string
persistence.config.advancedMounts.headscale.app[].path (3)
/etc/headscale/config.yaml
string
persistence.config.advancedMounts.headscale.app[].subPath (3)
config.yaml
string
persistence.config.advancedMounts.main.01-litestream-restore[].path (1)
/etc/litestream.yml
string
persistence.config.advancedMounts.main.01-litestream-restore[].readOnly (1)
true
boolean
persistence.config.advancedMounts.main.01-litestream-restore[].subPath (1)
litestream-restore
string
persistence.config.advancedMounts.main.litestream[].path (1)
/etc/litestream.yml
string
persistence.config.advancedMounts.main.litestream[].readOnly (1)
true
boolean
persistence.config.advancedMounts.main.litestream[].subPath (1)
litestream-replicate
string
persistence.config.advancedMounts.main.main[].path (1)
/etc/headscale/config.yaml
string
persistence.config.advancedMounts.main.main[].readOnly (1)
true
boolean
persistence.config.advancedMounts.main.main[].subPath (1)
config.yaml
string
persistence.config.enabled (2)
true
boolean
persistence.tmp.type (4)
emptyDir
string
persistence.tmp.advancedMounts.headscale.app[].path (3)
/var/run/headscale
string
persistence.tmp.advancedMounts.headscale.app[].subPath (3)
run
string
persistence.tmp.advancedMounts.ui.app[].path (3)
/data
/home/appuser/.local
string
persistence.tmp.advancedMounts.ui.app[].subPath (3)
data
.local
string
persistence.tmp.enabled (1)
true
boolean
persistence.tmp.globalMounts[].path (1)
/var/run/headscale
string
persistence.tmp.globalMounts[].readOnly (1)
false
boolean
persistence.tmp.medium (1)
Memory
string
persistence.var-lib-headscale.advancedMounts.headscale.app[].path (2)
/var/lib/headscale
string
persistence.var-lib-headscale.existingClaim (2)
headscale
string
persistence.nfs.advancedMounts.main.litestream[].path (1)
/nfs
string
persistence.nfs.advancedMounts.main.litestream[].subPath (1)
litestream
string
persistence.nfs.enabled (1)
true
boolean
persistence.nfs.path (1)
${PATH_NAS_PERSIST_K8S}/headscale
string
persistence.nfs.server (1)
${IP_TRUENAS}
string
persistence.nfs.type (1)
nfs
string
persistence.privatekeys.advancedMounts.headscale.app[].path (1)
/etc/headscale
string
persistence.privatekeys.existingClaim (1)
headscale
string
persistence.secrets.advancedMounts.main.main[].path (1)
/etc/headscale/private.key
/etc/headscale/noise_private.key
/oidc/secret
string
persistence.secrets.advancedMounts.main.main[].readOnly (1)
true
true
true
boolean
persistence.secrets.advancedMounts.main.main[].subPath (1)
private.key
noise_private.key
oidc_client_secret
string
persistence.secrets.defaultMode (1)
400
number
persistence.secrets.enabled (1)
true
boolean
persistence.secrets.name (1)
headscale-secrets
string
persistence.secrets.type (1)
secret
string
persistence.tls.advancedMounts.main.main[].path (1)
/tls/fullchain.pem
/tls/privkey.pem
string
persistence.tls.advancedMounts.main.main[].readOnly (1)
true
true
boolean
persistence.tls.advancedMounts.main.main[].subPath (1)
tls.crt
tls.key
string
persistence.tls.defaultMode (1)
400
number
persistence.tls.enabled (1)
true
boolean
persistence.tls.name (1)
headscale-tls
string
persistence.tls.type (1)
secret
string
controllers.headscale.containers.app.args[] (3)
- serve
string
controllers.headscale.containers.app.command[] (3)
- headscale
string
controllers.headscale.containers.app.image.repository (3)
ghcr.io/juanfont/headscale
string
controllers.headscale.containers.app.image.tag (3)
v0.24.0@sha256:2a2dcc9fef8f6e520a096743b668e3fd5df06ae422298c808c4e934a78764860
string
controllers.headscale.containers.app.probes.liveness.enabled (3)
true
boolean
controllers.headscale.containers.app.probes.readiness.enabled (3)
true
boolean
controllers.headscale.containers.app.probes.startup.enabled (3)
true
boolean
controllers.headscale.containers.app.probes.startup.spec.failureThreshold (3)
30
number
controllers.headscale.containers.app.probes.startup.spec.periodSeconds (3)
5
number
controllers.headscale.containers.app.securityContext.readOnlyRootFilesystem (3)
true
boolean
controllers.headscale.containers.app.securityContext.allowPrivilegeEscalation (1)
false
boolean
controllers.headscale.containers.app.securityContext.capabilities.drop[] (1)
- ALL
string
controllers.headscale.containers.app.env.HEADSCALE_OIDC_CLIENT_ID (1)
headscale
string
controllers.headscale.containers.app.env.HEADSCALE_OIDC_ISSUER (1)
https://auth.mcgrath.nz
string
controllers.headscale.containers.app.env.TZ (1)
Pacific/Auckland
string
controllers.headscale.containers.app.envFrom[].secretRef.name (1)
headscale-secret
string
controllers.headscale.containers.app.resources.limits.memory (1)
512Mi
string
controllers.headscale.containers.app.resources.requests.cpu (1)
10m
string
controllers.headscale.annotations."reloader.stakater.com/auto" (2)
true
string
controllers.ui.containers.app.image.repository (3)
ghcr.io/gurucomputing/headscale-ui
string
controllers.ui.containers.app.image.tag (3)
2024.02.24-beta1@sha256:4c618a7b6e8b32f5ef6af3c7e6936c63e8568ad9ae8d190dafb2551a64ff40a2
string
controllers.ui.containers.app.securityContext.readOnlyRootFilesystem (3)
true
boolean
controllers.ui.containers.app.securityContext.allowPrivilegeEscalation (1)
false
boolean
controllers.ui.containers.app.securityContext.capabilities.drop[] (1)
- ALL
string
controllers.ui.containers.app.env.TZ (1)
Pacific/Auckland
string
controllers.ui.containers.app.resources.limits.memory (1)
512Mi
string
controllers.ui.containers.app.resources.requests.cpu (1)
10m
string
controllers.ui.strategy (3)
RollingUpdate
string
controllers.main.containers.litestream.args[] (1)
- replicate
string
controllers.main.containers.litestream.env.AGE_PUBKEY.valueFrom.secretKeyRef.key (1)
litestream-age-pubkey
string
controllers.main.containers.litestream.env.AGE_PUBKEY.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.containers.litestream.env.LITESTREAM_ACCESS_KEY_ID.valueFrom.secretKeyRef.key (1)
litestream-r2-id
string
controllers.main.containers.litestream.env.LITESTREAM_ACCESS_KEY_ID.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.containers.litestream.env.LITESTREAM_SECRET_ACCESS_KEY.valueFrom.secretKeyRef.key (1)
litestream-r2-key
string
controllers.main.containers.litestream.env.LITESTREAM_SECRET_ACCESS_KEY.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.containers.litestream.env.R2_BUCKET.valueFrom.secretKeyRef.key (1)
litestream-r2-bucket
string
controllers.main.containers.litestream.env.R2_BUCKET.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.containers.litestream.env.R2_ENDPOINT.valueFrom.secretKeyRef.key (1)
litestream-r2-endpoint
string
controllers.main.containers.litestream.env.R2_ENDPOINT.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.containers.litestream.image.repository (1)
docker.io/litestream/litestream
string
controllers.main.containers.litestream.image.tag (1)
0.3.13
string
controllers.main.containers.litestream.imagePullPolicy (1)
IfNotPresent
string
controllers.main.containers.litestream.resources.limits.memory (1)
1024Mi
string
controllers.main.containers.litestream.resources.requests.cpu (1)
10m
string
controllers.main.containers.litestream.resources.requests.memory (1)
128Mi
string
controllers.main.containers.litestream.securityContext.allowPrivilegeEscalation (1)
false
boolean
controllers.main.containers.litestream.securityContext.capabilities.drop[] (1)
- ALL
string
controllers.main.containers.litestream.securityContext.readOnlyRootFilesystem (1)
true
boolean
controllers.main.containers.main.command[] (1)
- headscale
- serve
string
controllers.main.containers.main.env.TZ (1)
${CONFIG_TZ}
string
controllers.main.containers.main.image.repository (1)
ghcr.io/juanfont/headscale
string
controllers.main.containers.main.image.tag (1)
0.23.0@sha256:fd2a5326d0742a98597e33acbb33a6055afbe9c98b05919a7ff65bb0715f9bb4
string
controllers.main.containers.main.resources.limits.memory (1)
1024Mi
string
controllers.main.containers.main.resources.requests.cpu (1)
10m
string
controllers.main.containers.main.resources.requests.memory (1)
128Mi
string
controllers.main.containers.main.securityContext.allowPrivilegeEscalation (1)
false
boolean
controllers.main.containers.main.securityContext.capabilities.drop[] (1)
- ALL
string
controllers.main.containers.main.securityContext.readOnlyRootFilesystem (1)
true
boolean
controllers.main.initContainers.01-litestream-restore.args[] (1)
- restore
- -if-db-not-exists
- -if-replica-exists
- -v
- /var/run/headscale/headscale.db
string
controllers.main.initContainers.01-litestream-restore.env.AGE_PUBKEY.valueFrom.secretKeyRef.key (1)
litestream-age-pubkey
string
controllers.main.initContainers.01-litestream-restore.env.AGE_PUBKEY.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.initContainers.01-litestream-restore.env.AGE_SECRET.valueFrom.secretKeyRef.key (1)
litestream-age-secret
string
controllers.main.initContainers.01-litestream-restore.env.AGE_SECRET.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.initContainers.01-litestream-restore.env.LITESTREAM_ACCESS_KEY_ID.valueFrom.secretKeyRef.key (1)
litestream-r2-id
string
controllers.main.initContainers.01-litestream-restore.env.LITESTREAM_ACCESS_KEY_ID.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.initContainers.01-litestream-restore.env.LITESTREAM_SECRET_ACCESS_KEY.valueFrom.secretKeyRef.key (1)
litestream-r2-key
string
controllers.main.initContainers.01-litestream-restore.env.LITESTREAM_SECRET_ACCESS_KEY.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.initContainers.01-litestream-restore.env.R2_BUCKET.valueFrom.secretKeyRef.key (1)
litestream-r2-bucket
string
controllers.main.initContainers.01-litestream-restore.env.R2_BUCKET.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.initContainers.01-litestream-restore.env.R2_ENDPOINT.valueFrom.secretKeyRef.key (1)
litestream-r2-endpoint
string
controllers.main.initContainers.01-litestream-restore.env.R2_ENDPOINT.valueFrom.secretKeyRef.name (1)
headscale-secrets
string
controllers.main.initContainers.01-litestream-restore.image.repository (1)
docker.io/litestream/litestream
string
controllers.main.initContainers.01-litestream-restore.image.tag (1)
0.3.13
string
controllers.main.initContainers.01-litestream-restore.imagePullPolicy (1)
IfNotPresent
string
controllers.main.initContainers.01-litestream-restore.resources.limits.memory (1)
1024Mi
string
controllers.main.initContainers.01-litestream-restore.resources.requests.cpu (1)
10m
string
controllers.main.initContainers.01-litestream-restore.resources.requests.memory (1)
128Mi
string
controllers.main.initContainers.01-litestream-restore.securityContext.allowPrivilegeEscalation (1)
false
boolean
controllers.main.initContainers.01-litestream-restore.securityContext.capabilities.drop[] (1)
- ALL
string
controllers.main.initContainers.01-litestream-restore.securityContext.readOnlyRootFilesystem (1)
true
boolean
controllers.main.pod.labels."egress.home.arpa/ingress-nginx" (1)
allow
string
controllers.main.pod.labels."egress.home.arpa/r2" (1)
allow
string
controllers.main.pod.labels."egress.home.arpa/world" (1)
allow
string
controllers.main.replicas (1)
1
number
controllers.main.type (1)
deployment
string
ingress.headscale.className (3)
external
string
ingress.headscale.hosts[].host (3)
hs.${CLUSTER_DOMAIN}
string
ingress.headscale.hosts[].paths[].path (3)
/
string
ingress.headscale.hosts[].paths[].service.identifier (3)
headscale
string
ingress.headscale.hosts[].paths[].service.port (3)
http
string
ingress.headscale.annotations."external-dns.alpha.kubernetes.io/target" (2)
network.${CLUSTER_DOMAIN}
string
ingress.headscale.annotations."nginx.ingress.kubernetes.io/proxy-read-timeout" (1)
3600
string
ingress.headscale.annotations."nginx.ingress.kubernetes.io/proxy-send-timeout" (1)
3600
string
ingress.headscale.tls[].hosts[] (1)
- ts.mcgrath.nz
string
ingress.ui.className (2)
haproxy-external
string
ingress.ui.hosts[].host (2)
ts.sko.ai
string
ingress.ui.hosts[].paths[].path (2)
/web
string
ingress.ui.hosts[].paths[].service.identifier (2)
ui
string
ingress.ui.hosts[].paths[].service.port (2)
http
string
ingress.ui.annotations."external-dns.alpha.kubernetes.io/target" (1)
external.mcgrath.nz
string
ingress.ui.tls[].hosts[] (1)
- ts.mcgrath.nz
string
service.headscale.controller (3)
headscale
string
service.headscale.ports.http.port (3)
8080
number
service.headscale.ports.http.primary (3)
true
boolean
service.headscale.ports.metrics.port (3)
9090
number
service.ui.controller (3)
ui
string
service.ui.ports.http.port (3)
80
number
service.main.annotations."coredns.io/hostname" (1)
${APP_DNS_HEADSCALE}
string
service.main.annotations."io.cilium/lb-ipam-ips" (1)
${APP_IP_HEADSCALE}
string
service.main.controller (1)
main
string
service.main.enabled (1)
true
boolean
service.main.externalTrafficPolicy (1)
Cluster
string
service.main.ports.http.enabled (1)
true
boolean
service.main.ports.http.port (1)
443
number
service.main.ports.http.protocol (1)
HTTPS
string
service.main.ports.http.targetPort (1)
8080
number
service.main.ports.metrics.enabled (1)
true
boolean
service.main.ports.metrics.port (1)
9090
number
service.main.ports.metrics.protocol (1)
TCP
string
service.main.ports.relay.enabled (1)
true
boolean
service.main.ports.relay.port (1)
3478
number
service.main.ports.relay.protocol (1)
UDP
string
service.main.type (1)
LoadBalancer
string
defaultPodOptions.securityContext.fsGroup (2)
${APP_UID_HEADSCALE}
string, number
defaultPodOptions.securityContext.fsGroupChangePolicy (2)
Always
string
defaultPodOptions.securityContext.runAsGroup (2)
${APP_UID_HEADSCALE}
string, number
defaultPodOptions.securityContext.runAsUser (2)
${APP_UID_HEADSCALE}
string, number
defaultPodOptions.securityContext.sysctls[].name (2)
net.ipv4.ip_unprivileged_port_start
string
defaultPodOptions.securityContext.sysctls[].value (2)
0
string
defaultPodOptions.securityContext.runAsNonRoot (1)
true
boolean
defaultPodOptions.securityContext.seccompProfile.type (1)
RuntimeDefault
string
defaultPodOptions.automountServiceAccountToken (1)
false
boolean
secrets.config.stringData."config.yaml" (2)
server_url: http://ts.sko.ai listen_addr: 0.0.0.0:8080 metrics_listen_addr: 0.0.0.0:9090 private_key_path: /var/lib/headscale/private.key noise: private_key_path: /var/lib/headscale/noise_private.key prefixes: v6: fd7a:115c:a1e0::/48 v4: 100.64.0.0/10 derp: server: enabled: false urls: - https://controlplane.tailscale.com/derpmap/default auto_update_enabled: true update_frequency: 24h disable_check_updates: false ephemeral_node_inactivity_timeout: 30m database: type: sqlite sqlite: path: /var/lib/headscale/db.sqlite # TODO: Remove after 0.23.0 db_type: sqlite3 db_path: /var/lib/headscale/db.sqlite dns_config: # Whether to prefer using Headscale provided DNS or use local. override_local_dns: true # List of DNS servers to expose to clients. nameservers: - 192.168.1.1 domains: [] magic_dns: true base_domain: ts.sko.ai log: level: debug
string
secrets.config.enabled (1)
true
boolean
configMaps.config.data."config.yaml" (1)
server_url: https://${APP_DNS_HEADSCALE}:443 listen_addr: 0.0.0.0:8080 metrics_listen_addr: 0.0.0.0:9090 grpc_listen_addr: 127.0.0.1:50443 grpc_allow_insecure: false private_key_path: /etc/headscale/private.key noise: private_key_path: /etc/headscale/noise_private.key db_type: sqlite3 db_path: /var/run/headscale/headscale.db tls_cert_path: "/tls/fullchain.pem" tls_key_path: "/tls/privkey.pem" log: format: json level: info logtail: enabled: false #acl_policy_path: "/etc/headscale/acl.hujson" ip_prefixes: - ${CONFIG_HEADSCALE_IPV4} randomize_client_port: false dns_config: magic_dns: true base_domain: ${DNS_SHORT} override_local_dns: true nameservers: - ${IP_HOME_DNS} domains: - ${DNS_SHORT} derp: server: enabled: true region_id: 999 region_code: "Biohazard" region_name: "Biohazard-Home-Relay" stun_listen_addr: "0.0.0.0:3478" urls: - https://controlplane.tailscale.com/derpmap/default paths: [] auto_update_enabled: true update_frequency: 24h disable_check_updates: true ephemeral_node_inactivity_timeout: 30m node_update_check_interval: 10s oidc: only_start_if_oidc_is_available: true issuer: "${SECRET_HEADSCALE_OIDC_URL}" client_id: "${SECRET_HEADSCALE_OIDC_ID}" client_secret_path: "/oidc/secret" scope: ["openid", "profile", "email"] expiry: 30d use_expiry_from_token: false extra_params: domain_hint: ${DNS_MAIN} allowed_domains: - ${APP_DNS_AUTH} - ${DNS_MAIN}
string
configMaps.config.data.litestream-replicate (1)
dbs: - path: /var/run/headscale/headscale.db replicas: - name: "nas" type: "file" path: "/nfs" retention: 168h validation-interval: 1h age: recipients: - ${AGE_PUBKEY} - name: "r2" type: "s3" endpoint: "${R2_ENDPOINT}" bucket: "${R2_BUCKET}" path: "headscale" force-path-style: true retention: 168h validation-interval: 24h age: recipients: - ${AGE_PUBKEY}
string
configMaps.config.data.litestream-restore (1)
dbs: - path: /var/run/headscale/headscale.db replicas: - name: "nas" type: "file" path: "/nfs" retention: 168h validation-interval: 1h age: identities: - ${AGE_SECRET} - name: "r2" type: "s3" endpoint: "${R2_ENDPOINT}" bucket: "${R2_BUCKET}" path: "headscale" force-path-style: true retention: 168h validation-interval: 24h age: identities: - ${AGE_SECRET}
string
configMaps.config.enabled (1)
true
boolean
dnsConfig.options[].name (1)
ndots
string
dnsConfig.options[].value (1)
1
string
serviceMonitor.main.enabled (1)
true
boolean
serviceMonitor.main.endpoints[].interval (1)
1m
string
serviceMonitor.main.endpoints[].path (1)
/metrics
string
serviceMonitor.main.endpoints[].port (1)
metrics
string
serviceMonitor.main.endpoints[].scheme (1)
http
string
serviceMonitor.main.endpoints[].scrapeTimeout (1)
10s
string
serviceMonitor.main.serviceName (1)
headscale
string