diff --git a/docs/Nix.md b/docs/Nix.md index 44bcc0e..38334a0 100644 --- a/docs/Nix.md +++ b/docs/Nix.md @@ -165,43 +165,39 @@ The Headplane NixOS module provides the following options under `services.headpl # Configure the Headplane server application settings = { server = { - # host = "0.0.0.0"; # Default: bind to all interfaces - # port = 3000; # Default port + # host = "127.0.0.1"; + # port = 3000; cookie_secret_path = config.sops.secrets.headplane_cookie_secret.path; - # cookie_secret = "your-32-character-secret"; # Alternative to cookie_secret_path cookie_secure = true; agent = { enabled = false; - # authkey = "your-agent-authkey"; # Alternative to authkey_path # authkey_path = config.sops.secrets.headplane_server_agent_authkey.path; - # ttl = 180000; # Default: 3 minutes in milliseconds - # cache_path = "/var/lib/headplane/agent_cache.json"; # Default cache location + # ttl = 180000; # milliseconds + # cache_path = "/var/lib/headplane/agent_cache.json"; }; }; headscale = { - # url = "http://127.0.0.1:8080"; # Default Headscale URL + # url = "http://127.0.0.1:8080"; config_path = headscaleConfig; # Use the generated config file - # config_strict = true; # Default: strict config validation + # config_strict = true; # tls_cert = "your-tls-cert"; # Alternative to tls_cert_path # tls_cert_path = config.sops.secrets.headplane_tls_cert.path; # tls_key = "your-tls-key"; # Alternative to tls_key_path # tls_key_path = config.sops.secrets.headplane_tls_key.path; }; - integration.proc.enabled = true; - oidc = { - # issuer = ""; # Default: empty - # client_id = ""; # Default: empty - client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path; + # issuer = ""; + # client_id = ""; + # client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path; # client_secret = "your_oidc_client_secret"; # Alternative to client_secret_path - # disable_api_key_login = false; # Default: allow API key login - # token_endpoint_auth_method = "client_secret_post"; # Default auth method - headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path; + # disable_api_key_login = false; + # token_endpoint_auth_method = "client_secret_post"; + # headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path; # headscale_api_key = "your_headscale_api_key"; # Alternative to headscale_api_key_path - redirect_uri = "https://headscale.example.com/admin/oidc/callback"; + # redirect_uri = ""; }; }; }; diff --git a/nix/module.nix b/nix/module.nix index d0b81d6..8680677 100644 --- a/nix/module.nix +++ b/nix/module.nix @@ -50,9 +50,9 @@ in { options = { host = lib.mkOption { type = lib.types.str; - default = "0.0.0.0"; + default = "127.0.0.1"; description = "The host address to bind to."; - example = "127.0.0.1"; + example = "0.0.0.0"; }; port = lib.mkOption { @@ -67,7 +67,6 @@ in { description = '' Path to a file containing the cookie secret. The secret must be exactly 32 characters long. - Can be used instead of cookie_secret. ''; example = "config.sops.secrets.headplane_cookie.path"; }; @@ -90,7 +89,6 @@ in { default = null; description = '' Path to a file containing the agent auth key. - Can be used instead of authkey. ''; example = "config.sops.secrets.agent_authkey.path"; }; @@ -137,7 +135,6 @@ in { default = null; description = '' Path to a file containing the TLS certificate. - Can be used instead of tls_cert. ''; example = "config.sops.secrets.tls_cert.path"; }; @@ -147,7 +144,6 @@ in { default = null; description = '' Path to a file containing the TLS private key. - Can be used instead of tls_key. ''; example = "config.sops.secrets.tls_key.path"; }; @@ -213,7 +209,7 @@ in { type = lib.types.str; default = ""; description = "URL to OpenID issuer."; - example = "https://authentik.parawell.cloud/application/o/test-headscale/"; + example = "https://provider.example.com/issuer-url"; }; client_id = lib.mkOption { @@ -228,7 +224,6 @@ in { default = null; description = '' Path to a file containing the OIDC client secret. - Can be used instead of client_secret. ''; example = "config.sops.secrets.oidc_client_secret.path"; }; @@ -253,13 +248,13 @@ in { default = null; description = '' Path to a file containing the Headscale API key. - Can be used instead of headscale_api_key. ''; example = "config.sops.secrets.headscale_api_key.path"; }; redirect_uri = lib.mkOption { type = lib.types.str; + default = ""; description = '' This should point to your publicly accessible URL for your Headplane instance with /admin/oidc/callback.