# Headscale — self-hosted Tailscale control plane
# Coordination endpoint: https://headscale.neuralplatform.ai (Cloudflare tunnel)
# Clients: Tailscale app on Mac/iOS/Android, pointed at custom server
# Subnet router: tailscaled on Legion host, advertises k3s + LAN CIDRs

resource "kubernetes_namespace" "headscale" {
  metadata {
    name = "headscale"
    labels = {
      managed-by = "terraform"
      tier       = "infrastructure"
    }
  }
}

resource "kubernetes_persistent_volume_claim" "headscale_data" {
  metadata {
    name      = "headscale-data"
    namespace = kubernetes_namespace.headscale.metadata[0].name
  }

  # wait_until_bound = false because local-path only provisions on pod schedule
  wait_until_bound = false

  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = {
        storage = "1Gi"
      }
    }
  }
}