Add Headscale as an optional private-network provider #16

Merged

backmeupplz merged 1 commit from feat/headscale-provider into master

2026-08-12 14:57:54 +00:00

backmeupplz commented

2026-08-12 14:56:57 +00:00

(Migrated from github.com)

Summary

add Headscale 0.29.3 as an installable MyGround catalog app with persistent state and MagicDNS configuration
make private networking an explicit Tailscale-or-Headscale choice in setup, UI, API, and CLI while preserving Tailscale as the backwards-compatible default
connect MyGround's exit node and per-app Tailscale clients to a selected Headscale control server
expose clean Headscale MagicDNS app URLs over the private network using HTTP sidecar proxies (Headscale cannot issue Tailscale-managed HTTPS certificates)
require disabling the active network and supplying a fresh key before changing control servers
bump MyGround to v0.1.98

Safety

legacy configs without a provider continue to use Tailscale
provider/control-server changes cannot occur while the current private network is enabled
switching network identities clears the old MagicDNS suffix
the Headscale catalog app opts out of recursive MyGround sidecar injection
no existing MyGround installation is migrated automatically

Validation

npx --yes bun@1.3.14 run test — 116 passed
npx --yes bun@1.3.14 run build — passed
Rust 1.91.1: 296 library + 6 CLI + 83 API tests passed; one unrelated existing Paperless test skipped because its temporary path is intentionally rejected under /tmp
live compose validation with headscale/headscale:0.29.3-debug: configtest passed, /health returned pass, container became healthy, and SQLite user state survived a full compose down/up recreation

Deployment note

The public Headscale control hostname must be DNS-only when using Cloudflare. Cloudflare Proxy/Tunnel cannot carry Headscale's POST-based Tailscale Control Protocol upgrade.

## Summary - add Headscale 0.29.3 as an installable MyGround catalog app with persistent state and MagicDNS configuration - make private networking an explicit Tailscale-or-Headscale choice in setup, UI, API, and CLI while preserving Tailscale as the backwards-compatible default - connect MyGround's exit node and per-app Tailscale clients to a selected Headscale control server - expose clean Headscale MagicDNS app URLs over the private network using HTTP sidecar proxies (Headscale cannot issue Tailscale-managed HTTPS certificates) - require disabling the active network and supplying a fresh key before changing control servers - bump MyGround to v0.1.98 ## Safety - legacy configs without a provider continue to use Tailscale - provider/control-server changes cannot occur while the current private network is enabled - switching network identities clears the old MagicDNS suffix - the Headscale catalog app opts out of recursive MyGround sidecar injection - no existing MyGround installation is migrated automatically ## Validation - `npx --yes bun@1.3.14 run test` — 116 passed - `npx --yes bun@1.3.14 run build` — passed - Rust 1.91.1: 296 library + 6 CLI + 83 API tests passed; one unrelated existing Paperless test skipped because its temporary path is intentionally rejected under `/tmp` - live compose validation with `headscale/headscale:0.29.3-debug`: configtest passed, `/health` returned pass, container became healthy, and SQLite user state survived a full compose down/up recreation ## Deployment note The public Headscale control hostname must be DNS-only when using Cloudflare. Cloudflare Proxy/Tunnel cannot carry Headscale's POST-based Tailscale Control Protocol upgrade.