apiVersion: v1
kind: ConfigMap
metadata:
  name: headscale-config
  namespace: headscale
data:
  config.yaml: |
    server_url: https://vpn.neuralplatform.ai
    listen_addr: 0.0.0.0:8080
    grpc_listen_addr: 0.0.0.0:50443
    grpc_allow_insecure: true
    private_key_path: /data/private.key
    noise:
      private_key_path: /data/noise_private.key
    prefixes:
      v4: 100.64.0.0/10
    database:
      type: sqlite
      sqlite:
        path: /data/headscale.db
    log:
      level: info
    dns:
      magic_dns: true
      base_domain: ts.neuralplatform.ai
      nameservers:
        global:
          - 192.168.8.148
          - 1.1.1.1
    derp:
      server:
        enabled: false
      urls:
        - https://controlplane.tailscale.com/derpmap/default
      auto_update_enabled: true
      update_frequency: 24h
    disable_check_updates: true
    ephemeral_node_inactivity_timeout: 30m
    node_update_check_interval: 10s
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: headscale
  namespace: headscale
  labels:
    app: headscale
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: headscale
  template:
    metadata:
      labels:
        app: headscale
    spec:
      containers:
        - name: headscale
          image: headscale/headscale:0.23
          command: ["headscale", "serve"]
          ports:
            - name: http
              containerPort: 8080
            - name: grpc
              containerPort: 50443
          volumeMounts:
            - name: data
              mountPath: /data
            - name: config
              mountPath: /etc/headscale/config.yaml
              subPath: config.yaml
          resources:
            requests:
              memory: 64Mi
              cpu: 50m
            limits:
              memory: 256Mi
              cpu: 200m
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: headscale-data
        - name: config
          configMap:
            name: headscale-config
---
apiVersion: v1
kind: Service
metadata:
  name: headscale
  namespace: headscale
spec:
  selector:
    app: headscale
  ports:
    - name: http
      port: 8080
      targetPort: 8080
    - name: grpc
      port: 50443
      targetPort: 50443
  type: ClusterIP
---
# Traefik ingress — direct TLS, bypasses Cloudflare proxy so WebSocket
# upgrades (required by Tailscale TS2021) pass through unmodified.
# DNS: vpn.neuralplatform.ai A 72.204.75.49 (DNS-only, not proxied)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: headscale
  namespace: headscale
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - vpn.neuralplatform.ai
      secretName: headscale-tls
  rules:
    - host: vpn.neuralplatform.ai
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: headscale
                port:
                  number: 8080