docs: solidify DOCKER_SOCK and ROOT_API_KEY usage

app/utils/config/headplane.ts

@@ -25,7 +25,8 @@ export interface HeadplaneContext {
 	}
 
 	docker?: {
-		sock: string
+		url: string
+		sock: boolean
 		container: string
 	}
 
@@ -163,19 +164,48 @@ async function checkAcl(config?: HeadscaleConfig) {
 }
 
 async function checkDocker() {
-	const path = process.env.DOCKER_SOCK ?? '/var/run/docker.sock'
+	const path = process.env.DOCKER_SOCK ?? 'unix:///var/run/docker.sock'
+
+	let url: URL | undefined
 	try {
-		await access(path, constants.R_OK)
+		url = new URL(path)
 	} catch {
 		return
 	}
 
+	// The API is available as an HTTP endpoint
+	if (url.protocol === 'tcp:') {
+		url.protocol = 'http:'
+	}
+
+	// Check if the socket is accessible
+	if (url.protocol === 'unix:') {
+		try {
+			await access(path, constants.R_OK)
+		} catch {
+			return
+		}
+	}
+
+	if (url.protocol === 'http:') {
+		try {
+			await fetch(new URL('/v1.30/version', url).href)
+		} catch {
+			return
+		}
+	}
+
+	if (url.protocol !== 'http:' && url.protocol !== 'unix:') {
+		return
+	}
+
 	if (!process.env.HEADSCALE_CONTAINER) {
 		return
 	}
 
 	return {
-		sock: path,
+		url: url.href,
+		sock: url.protocol === 'unix:',
 		container: process.env.HEADSCALE_CONTAINER,
 	}
 }

app/utils/docker.ts

@@ -1,5 +1,3 @@
-/* eslint-disable no-await-in-loop */
-/* eslint-disable no-constant-condition */
 import { setTimeout } from 'node:timers/promises'
 
 import { Client } from 'undici'
@@ -13,9 +11,12 @@ export async function sighupHeadscale() {
 		return
 	}
 
-	const client = new Client('http://localhost', {
-		socketPath: context.docker.sock,
-	})
+	// Supports the DOCKER_SOCK environment variable
+	const client = context.docker.sock
+		? new Client('http://localhost', {
+			socketPath: context.docker.url,
+		})
+		: new Client(context.docker.url)
 
 	const response = await client.request({
 		method: 'POST',
@@ -33,9 +34,12 @@ export async function restartHeadscale() {
 		return
 	}
 
-	const client = new Client('http://localhost', {
-		socketPath: context.docker.sock,
-	})
+	// Supports the DOCKER_SOCK environment variable
+	const client = context.docker.sock
+		? new Client('http://localhost', {
+			socketPath: context.docker.url,
+		})
+		: new Client(context.docker.url)
 
 	const response = await client.request({
 		method: 'POST',
@@ -48,14 +52,15 @@ export async function restartHeadscale() {
 
 	// Wait for Headscale to restart before continuing
 	let attempts = 0
+	// eslint-disable-next-line
 	while (true) {
 		try {
-			// Acceptable blank because API_KEY is not required
-			await pull('v1/apikey', process.env.API_KEY ?? '')
+			// Acceptable blank because ROOT_API_KEY is not required
+			await pull('v1/apikey', context.oidc?.rootKey ?? '')
 			return
 		} catch (error) {
 			// This means the server is up but the API key is invalid
-			// This can happen if the user only uses API_KEY via cookies
+			// This can happen if the user only uses ROOT_API_KEY via cookies
 			if (error instanceof HeadscaleError && error.status === 401) {
 				break
 			}

app/utils/oidc.ts

@@ -151,8 +151,7 @@ export async function finishOidc(oidc: OidcConfig, req: Request) {
 
 	const keyResponse = await post<{ apiKey: string }>(
 		'v1/apikey',
-		// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-		process.env.API_KEY!,
+		oidc.rootKey,
 		{
 			expiration: expDate,
 		},