Skip to content

Conversation

jcstryker
Copy link

@jcstryker jcstryker commented Jun 24, 2025

This PR resolves #55

Alternative Helm chart to the chart provided here https://github.com/nbcloudio/headplane-chart - I have some concerns around best practices and security - feeling it best to start from scratch to also resolve licensing concerns.

This is provided to this project under the MIT licence.

Thank you to
@antoniolago for doing some fantastic work updating that chart from nbcloudio

@definitelynobody for some further enhancements to the nbcloudio chart - I did not adapt anything directly for this first version of the chart but happy to take a look and help bring some of those features in the future


I have tested OIDC Login, Persistence, Admin Login, Database-backed ACLs - I am successfully serving 5-10 devices covering common use cases like exit nodes with this chart in my Homelab.

Notably missing is the tailscale relay feature from the @nbcloudio/@antoniolago/@definitelynobody version of the chart.

I am happy to look into adding that feature in a followup PR once I have time to understand what it does, or someone else can take that enhancement.


example values.yaml used for testing

headplane:
  config:
    url: https://vpn.example.com
    debug: true
    generateCredentials: true
    cookieSecret:
      secretName: vpn-cookie-secret
    oidc:
      enabled: true
      issuerUrl: https://id.example.com
      clientId: foo
      clientSecret:
        secretName: "vpn-oidc-credentials"
      disableApiKeyLogin: true
  persistence:
    enabled: true

headscale:
  config:
    url: https://vpn.example.com
    dns:
      baseDomain: secretnet.example.com
    oidc:
      enabled: true
      issuerUrl: https://id.example.com
      clientId: foo
      clientSecret:
        secretName: "vpn-oidc-credentials"
  persistence:
    enabled: true

extraObjects:
  - apiVersion: gateway.networking.k8s.io/v1
    kind: HTTPRoute
    metadata:
      name: headplane
    spec:
      hostnames:
        - vpn.example.com
      parentRefs:
        - group: gateway.networking.k8s.io
          kind: Gateway
          name: headplane
          namespace: headplane
      rules:
        - backendRefs:
            - group: ""
              kind: Service
              name: headplane
              port: 80
              weight: 1
          matches:
            - path:
                type: PathPrefix
                value: /admin
        - backendRefs:
            - group: ""
              kind: Service
              name: headscale
              port: 80
              weight: 1
          matches:
            - path:
                type: PathPrefix
                value: /

Follow Up PR ideas:

  • Github Action to Publish to OCI repository
  • Add Tailscale Relay feature

@jcstryker jcstryker mentioned this pull request Jun 24, 2025
@definitelynobody
Copy link

For reference I added some stuff on top of @antoniolago's repo here

I only was trying to get things working, use my changes however you would like or not at all :)

jcstryker and others added 11 commits July 4, 2025 10:49
This commit removes the unused PersistentVolumeClaim templates for headplane and headscale components. The templates were left in place but contained only a TODO comment, indicating they were not yet implemented. Removing them cleans up the codebase and prevents confusion about their intended purpose.

The pvc templates were previously defined in the kubernetes/headplane/templates/headplane/pvc.yaml and kubernetes/headplane/templates/headscale/pvc.yaml files but were not actually needed for the current implementation. This change reduces code clutter and improves maintainability by removing dead code.

Signed-off-by: jcstryker <[email protected]>
Signed-off-by: jcstryker <[email protected]>
…scale

This commit introduces the missing PersistentVolumeClaim templates for both headplane and headscale components. The changes implement the full PVC specification with support for:
- Custom annotations and labels
- Configurable access modes
- Storage requests
- Storage class configuration

The templates follow the existing pattern used in the helm chart and are conditionally enabled based on the persistence configuration values. This provides the necessary storage persistence for both services when enabled.

The implementation includes proper templating with Helm syntax to ensure compatibility with the chart's configuration system.

Signed-off-by: jcstryker <[email protected]>
@jcstryker jcstryker marked this pull request as ready for review October 13, 2025 16:53
@jcstryker jcstryker requested a review from tale as a code owner October 13, 2025 16:53
@jcstryker
Copy link
Author

@tale this should be ready for review now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Document (or even move) Helm chart in-tree

2 participants