From ffcb0a8672389c43a2ae24560d3d7d65a1ba1385 Mon Sep 17 00:00:00 2001 From: counterweight Date: Mon, 19 Oct 2026 22:10:23 +0200 Subject: [PATCH] headscale: drop the dead Headplane admin route Caddy proxied /admin* to Headplane behind basic auth, but nothing in this repo ever installed Headplane, so the route led nowhere. The vhost is now a plain reverse proxy: the headscale API authenticates every request itself. The headscale_ui_* vault entries are now unused and can be removed. Co-Authored-By: Claude Opus 5.5 (1M context) --- .../headscale/deploy_headscale_playbook.yml | 20 +++---------------- ansible/services/headscale/headscale_vars.yml | 3 --- 2 files changed, 3 insertions(+), 20 deletions(-) diff --git a/ansible/services/headscale/deploy_headscale_playbook.yml b/ansible/services/headscale/deploy_headscale_playbook.yml index fe3a225..29de9b6 100644 --- a/ansible/services/headscale/deploy_headscale_playbook.yml +++ b/ansible/services/headscale/deploy_headscale_playbook.yml @@ -244,23 +244,9 @@ vars: caddy_site_name: headscale caddy_site_domain: "{{ headscale_domain }}" - # Raw body, and it must stay raw: the /admin* route in front of - # Headplane is not expressible as a plain reverse_proxy. The previous - # version of this task wrote only `reverse_proxy localhost:8080`, which - # would have deleted the admin route and its auth on the next run. - caddy_site_body: | - @headplane { - path /admin* - } - handle @headplane { - basicauth { - {{ headscale_ui_username }} {{ headscale_ui_password_hash }} - } - reverse_proxy http://localhost:{{ headplane_port }} - } - # Headscale API is protected by its own API key authentication - # All API operations require a valid Bearer token in the Authorization header - reverse_proxy * http://localhost:{{ headscale_port }} + # The Headscale API authenticates every request itself (Bearer API + # key), so a plain proxy is all it needs. + caddy_site_upstream: "localhost:{{ headscale_port }}" handlers: - name: Restart headscale diff --git a/ansible/services/headscale/headscale_vars.yml b/ansible/services/headscale/headscale_vars.yml index c3fb948..7118cc7 100644 --- a/ansible/services/headscale/headscale_vars.yml +++ b/ansible/services/headscale/headscale_vars.yml @@ -18,6 +18,3 @@ remote_host: "{{ hostvars.get(remote_host_name, {}).get('ansible_host', remote_h remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counterweight') }}" remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}" remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}" - -# Headplane (headscale admin UI), proxied at /admin* behind Caddy basic auth -headplane_port: 3000