142 lines
4.7 KiB
YAML
142 lines
4.7 KiB
YAML
- name: Deploy headscale-ui with Docker and configure Caddy reverse proxy
|
|
hosts: spacey
|
|
become: yes
|
|
vars_files:
|
|
- ../../infra_vars.yml
|
|
- ../../services_config.yml
|
|
- ../../infra_secrets.yml
|
|
- ./headscale_vars.yml
|
|
vars:
|
|
headscale_subdomain: "{{ subdomains.headscale }}"
|
|
caddy_sites_dir: "{{ caddy_sites_dir }}"
|
|
headscale_domain: "{{ headscale_subdomain }}.{{ root_domain }}"
|
|
headscale_ui_version: "2025.08.23"
|
|
headscale_ui_dir: /opt/headscale-ui
|
|
headscale_ui_http_port: 18080
|
|
headscale_ui_https_port: 18443
|
|
|
|
tasks:
|
|
- name: Check if Docker is installed
|
|
command: docker --version
|
|
register: docker_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Fail if Docker is not installed
|
|
fail:
|
|
msg: "Docker is not installed. Please run the docker_playbook.yml first."
|
|
when: docker_check.rc != 0
|
|
|
|
- name: Ensure Docker service is running
|
|
systemd:
|
|
name: docker
|
|
state: started
|
|
enabled: yes
|
|
|
|
- name: Create headscale-ui directory
|
|
file:
|
|
path: "{{ headscale_ui_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Create docker-compose.yml for headscale-ui
|
|
copy:
|
|
dest: "{{ headscale_ui_dir }}/docker-compose.yml"
|
|
content: |
|
|
version: "3"
|
|
services:
|
|
headscale-ui:
|
|
image: ghcr.io/gurucomputing/headscale-ui:{{ headscale_ui_version }}
|
|
container_name: headscale-ui
|
|
restart: unless-stopped
|
|
ports:
|
|
- "{{ headscale_ui_http_port }}:8080"
|
|
- "{{ headscale_ui_https_port }}:8443"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Deploy headscale-ui container with docker compose
|
|
command: docker compose up -d
|
|
args:
|
|
chdir: "{{ headscale_ui_dir }}"
|
|
register: docker_compose_result
|
|
changed_when: "'Creating' in docker_compose_result.stdout or 'Starting' in docker_compose_result.stdout or docker_compose_result.rc != 0"
|
|
|
|
- name: Wait for headscale-ui to be ready
|
|
uri:
|
|
url: "http://localhost:{{ headscale_ui_http_port }}"
|
|
status_code: [200, 404]
|
|
register: headscale_ui_ready
|
|
until: headscale_ui_ready.status in [200, 404]
|
|
retries: 30
|
|
delay: 2
|
|
ignore_errors: yes
|
|
|
|
- name: Ensure Caddy sites-enabled directory exists
|
|
file:
|
|
path: "{{ caddy_sites_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Ensure Caddyfile includes import directive for sites-enabled
|
|
lineinfile:
|
|
path: /etc/caddy/Caddyfile
|
|
line: 'import sites-enabled/*'
|
|
insertafter: EOF
|
|
state: present
|
|
backup: yes
|
|
|
|
- name: Fail if username is not provided
|
|
fail:
|
|
msg: "headscale_ui_username must be set in infra_secrets.yml"
|
|
when: headscale_ui_username is not defined
|
|
|
|
- name: Fail if neither password nor password hash is provided
|
|
fail:
|
|
msg: "Either headscale_ui_password or headscale_ui_password_hash must be set in infra_secrets.yml"
|
|
when: headscale_ui_password is not defined and headscale_ui_password_hash is not defined
|
|
|
|
- name: Generate bcrypt hash for headscale-ui password
|
|
become: yes
|
|
command: caddy hash-password --plaintext "{{ headscale_ui_password }}"
|
|
register: headscale_ui_password_hash_result
|
|
changed_when: false
|
|
no_log: true
|
|
when: headscale_ui_password is defined and headscale_ui_password_hash is not defined
|
|
|
|
- name: Set headscale-ui password hash from generated value
|
|
set_fact:
|
|
headscale_ui_password_hash: "{{ headscale_ui_password_hash_result.stdout.strip() }}"
|
|
when: headscale_ui_password is defined and headscale_ui_password_hash is not defined
|
|
|
|
- name: Update headscale Caddy config to include headscale-ui /web route with authentication
|
|
become: yes
|
|
copy:
|
|
dest: "{{ caddy_sites_dir }}/headscale.conf"
|
|
content: |
|
|
{{ headscale_domain }} {
|
|
@headscale_ui {
|
|
path /web*
|
|
}
|
|
handle @headscale_ui {
|
|
basicauth {
|
|
{{ headscale_ui_username }} {{ headscale_ui_password_hash }}
|
|
}
|
|
reverse_proxy http://localhost:{{ headscale_ui_http_port }}
|
|
}
|
|
# Headscale API is protected by its own API key authentication
|
|
# All API operations require a valid Bearer token in the Authorization header
|
|
reverse_proxy * http://localhost:{{ headscale_port }}
|
|
}
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Reload Caddy to apply new config
|
|
command: systemctl reload caddy
|
|
|