headscale-server/docker-compose.yaml at main · rgarrigue/headscale-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
---
services:
  traefik:
    image: traefik:v3
    pull_policy: always
    restart: unless-stopped
    container_name: traefik
    command:
      - --log.level=INFO
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --global.sendAnonymousUsage=false
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.letsencrypt.acme.email=${EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  headscale:
    image: headscale/headscale:latest
    pull_policy: always
    container_name: headscale
    restart: unless-stopped
    command:
      - serve
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
    labels:
      - traefik.enable=true
      - traefik.http.routers.headscale.rule=PathPrefix(`/`) && Host(`${DOMAIN}`)
      - traefik.http.routers.headscale.tls.certresolver=letsencrypt
      - traefik.http.services.headscale.loadbalancer.server.port=8080

  headplane:
    container_name: headplane
    image: ghcr.io/tale/headplane:latest
    restart: unless-stopped
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      DEBUG: true
      HEADSCALE_INTEGRATION: "docker"
      HEADSCALE_CONTAINER: "headscale"
      COOKIE_SECRET: "${COOKIE_SECRET}"
      ROOT_API_KEY: "${ROOT_API_KEY}"
      DISABLE_API_KEY_LOGIN: "true"
      COOKIE_SECURE: "true"
      HOST: "0.0.0.0"
      PORT: "3000"
    labels:
      - traefik.enable=true
      - traefik.http.routers.headplane.rule=PathPrefix(`/web`) && Host(`${DOMAIN}`)
      - traefik.http.middlewares.stripweb.stripprefix.prefixes=/web
      - traefik.http.routers.headplane.middlewares=stripweb@docker
      - traefik.http.routers.headplane.tls.certresolver=letsencrypt
      - traefik.http.services.headplane.loadbalancer.server.port=3000

  # Alternative UI
  # headscale-ui:
  #   image: ghcr.io/gurucomputing/headscale-ui:latest
  #   pull_policy: always
  #   container_name: headscale-ui
  #   restart: unless-stopped
  #   labels:
  #     - traefik.enable=true
  #     - traefik.http.routers.headscale-ui.rule=PathPrefix(`/web`) && Host(`${DOMAIN}`)
  #     - traefik.http.routers.headscale-ui.tls.certresolver=letsencrypt
  #     - traefik.http.services.headscale-ui.loadbalancer.server.port=8080

  # To nmap, curl and such for troubleshooting purpose
  # debug:
  #   image: alpine:latest
  #   command:
  #     - sleep
  #     - infinity