# Headscale config for LLMHosts Hive Mode (Phase 3)
# Format matches Headscale v0.22.3: https://github.com/juanfont/headscale/blob/v0.22.3/config-example.yaml

server_url: http://127.0.0.1:8080
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 0.0.0.0:9090
grpc_listen_addr: 0.0.0.0:50443
grpc_allow_insecure: false

# Legacy private key (required)
private_key_path: /var/lib/headscale/private.key

# Noise protocol (TS2021)
noise:
  private_key_path: /var/lib/headscale/noise_private.key

# IP allocation (v0.22 uses ip_prefixes list)
ip_prefixes:
  - fd7a:115c:a1e0::/48
  - 100.64.0.0/10

derp:
  server:
    enabled: false
  urls:
    - https://controlplane.tailscale.com/derpmap/default
  paths: []
  auto_update_enabled: true
  update_frequency: 24h

disable_check_updates: true
ephemeral_node_inactivity_timeout: 30m
node_update_check_interval: 10s

# SQLite (v0.22 flat keys)
db_type: sqlite3
db_path: /var/lib/headscale/db.sqlite

# TLS
acme_url: https://acme-v02.api.letsencrypt.org/directory
acme_email: ""
tls_letsencrypt_hostname: ""
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
tls_letsencrypt_challenge_type: HTTP-01
tls_letsencrypt_listen: ":http"
tls_cert_path: ""
tls_key_path: ""

log:
  level: info
  format: text

# ACLs (v0.22 single path)
acl_policy_path: /etc/headscale/acls.hujson

# DNS (v0.22 dns_config)
dns_config:
  override_local_dns: true
  nameservers:
    - 1.1.1.1
    - 1.0.0.1
  restricted_nameservers: {}
  domains: []
  magic_dns: true
  base_domain: hive.llmhosts.local

unix_socket: /var/run/headscale/headscale.sock
unix_socket_permission: "0770"

logtail:
  enabled: false

randomize_client_port: false
