From 026b683c72528ee4187409005a8e482df8685875 Mon Sep 17 00:00:00 2001
From: Joseph Price <git@joe.pricey.uk>
Date: Mon, 23 Feb 2026 20:57:22 +0000
Subject: [PATCH 1/2] 0.6.2-beta.5 config updates in Nix

---
 nix/options.nix | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/nix/options.nix b/nix/options.nix
index 80cc7b2..5b12268 100644
--- a/nix/options.nix
+++ b/nix/options.nix
@@ -44,6 +44,13 @@ in {
                   description = "The port to listen on.";
                 };
 
+                base_url = mkOption {
+                  type = types.str;
+                  default = "http://localhost:3000";
+                  description = "The base URL for Headplane, not including the dashboard prefix (/admin) portion";
+                  example = "http://localhost:3000";
+                };
+
                 cookie_secret_path = mkOption {
                   type = types.nullOr types.path;
                   default = null;
@@ -93,6 +100,13 @@ in {
                   '';
                   example = "/var/lib/headplane";
                 };
+
+                info_secret = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "Secret is optional and allows access to certain debug endpoints";
+                  example = "config.sops.secrets.info_secret.path";
+                };
               };
             };
             default = {};
@@ -308,16 +322,6 @@ in {
                   example = "config.sops.secrets.headscale_api_key.path";
                 };
 
-                redirect_uri = mkOption {
-                  type = types.str;
-                  default = "";
-                  description = ''
-                    This should point to your publicly accessible URL
-                    for your Headplane instance with /admin/oidc/callback.
-                  '';
-                  example = "https://headscale.example.com/admin/oidc/callback";
-                };
-
                 user_storage_file = mkOption {
                   type = types.path;
                   default = "/var/lib/headplane/users.json";
@@ -326,6 +330,12 @@ in {
                   '';
                   example = "/var/lib/headplane/users.json";
                 };
+
+                use_pkce = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = "Whether to use PKCE when authenticating users.";
+                };
               };
             };
             default = {};

From c60a47b968bf01e699c591e84edbe87b33e2b0a7 Mon Sep 17 00:00:00 2001
From: Joseph Price <joe@pricey.uk>
Date: Mon, 23 Feb 2026 23:08:43 +0000
Subject: [PATCH 2/2] Missing oidc options

---
 nix/options.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/nix/options.nix b/nix/options.nix
index 5b12268..20ee37c 100644
--- a/nix/options.nix
+++ b/nix/options.nix
@@ -281,6 +281,27 @@ in {
                   example = "https://provider.example.com/issuer-url";
                 };
 
+                authorization_endpoint = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "Optionally override authorization_endpoint";
+                  example = "https://provider.example.com/authorization_endpoint";
+                };
+
+                token_endpoint = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "Optionally override token_endpoint";
+                  example = "https://provider.example.com/token_endpoint";
+                };
+
+                userinfo_endpoint = mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = "Optionally override userinfo_endpoint";
+                  example = "https://provider.example.com/userinfo_endpoint";
+                };
+
                 client_id = mkOption {
                   type = types.str;
                   default = "";