chore: publish 0.3.1+v0.28 release

Reviewed-on: #10

.env.sample

@@ -25,6 +25,5 @@ ENABLE_DERP=false
 # See https://git.coopcloud.tech/coop-cloud/backup-bot-two
 ENABLE_BACKUPS=true
 
-## allow cron updater
-#COMPOSE_FILE="$COMPOSE_FILE:compose.dns.yml"
-#DNS_REPO=owner/repo
+# The amount of time a node is authenticated, default is set to 7d
+#EXPIRY=0

MAINTENANCE.md

@@ -0,0 +1,35 @@
+# Headscale Recipe Maintenance
+
+All contributions should be made via a pull request. This is to ensure a
+certain quality and consistency, that others can rely on.
+
+## Maintainer Responsibilities
+
+`3wc` is responsible for installing regular updates:
+
+- Patch and minor updates within a week of them being released upstream
+- Major updates within a month of them being released upstream
+
+`ammaratef45` is responsible for responding to pull requests and issues, within a week of them being filed.
+
+`val` is available as backup for both of these tasks.
+
+In order to fulfill these responsibilities a recipe maintainer:
+
+- Has to watch the repository (to get notifications)
+- Needs to make sure Renovate is configured properly
+
+## Pull Requests
+
+A pull request can be merged if it is approved by at least one maintainer. For
+pull requests opened by a maintainer they need to be approved by another
+maintainer. Even though it is okay to merge a pull request with one approval, it
+is always better if all maintainers looked at the pull request and approved it.
+
+## Become a maintainer
+
+Everyone can apply to be a recipe maintainer:
+
+1. Watch the repository to always get updates
+2. Simply add yourself to the list in the [README.md](./README.md), add yourself to whichever things you would like to be (co) responsible for in this document, then open a new pull request with the change.
+3. Once the pull request gets merged you will be added to the [headscale maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/headscale-maintainers).

README.md

@@ -4,8 +4,10 @@
 
 <!-- metadata -->
 
+* **Maintainer**: [@3wc](https://git.coopcloud.tech/3wordchant), [@ammaratef45](https://git.coopcloud.tech/ammaratef45), [@val](https://git.coopcloud.tech/val)
+* **Status**: `stable`
 * **Category**: Apps
-* **Status**: 3
+* **Features**: 3
 * **Image**: [`headscale/headscale`](https://hub.docker.com/r/headscale/headscale), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: Yes
@@ -22,3 +24,23 @@
 * `abra app deploy <app-name>`
 
 For more, see [`docs.coopcloud.tech`](https://docs.coopcloud.tech).
+
+
+## Getting started using headscale 
+The recipe deploys two containers. 
+
+1. One is headscale itself. Note that it's a "distroless" container, so you can't enter with `bash` or `sh`, but you have to run the commands directly.
+
+> The headscale/headscale Docker container is based on a "distroless" image that does not contain a shell or any other debug tools. If you need to debug your application running in the Docker container, you can use the -debug variant, for example headscale/headscale:x.x.x-debug.
+> 
+> https://headscale.net/0.24.1/setup/install/container/#debugging-headscale-running-in-docker
+
+To run the command line do this:
+
+```bash
+abra app run yourapp.xyz app -- headscale help
+```
+
+2. The UI runs on `https://yourapp.xyz/web`, the UI is a mere frontend (a static site), so no data is saved on a server, so you will need to set URL and API-Key yourself on every client. Find more about the UI [here](https://github.com/gurucomputing/headscale-ui).
+
+For the usage of headscale itself, check the [offical docs](https://headscale.net/stable/usage/getting-started/).

abra.sh

@@ -1,5 +1,3 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export CONFIG_YAML_VERSION=v5
-export EXTRA_RECORDS_VERSION=v1
-export DNS_DOWNLOADER_VERSION=v1
+export CONFIG_YAML_VERSION=v5

compose.dns.yml

@@ -1,24 +0,0 @@
----
-services:
-  cron:
-    image: alpine:3.23.3
-    volumes:
-      - data:/data
-    configs:
-      - source: extra_dns_downloader
-        target: /entrypoint.sh
-    entrypoint: ["/entrypoint.sh"]
-    deploy:
-      mode: replicated
-      replicas: 0
-      labels:
-        - "swarm.cronjob.enable=true"
-        - "swarm.cronjob.schedule=0 * * * *"
-      restart_policy:
-        condition: none
-
-configs:
-  extra_dns_downloader:
-    name: ${STACK_NAME}_dns_downloader_${DNS_DOWNLOADER_VERSION}
-    file: extra-downloader.sh
-    template_driver: golang

compose.yml

@@ -8,11 +8,11 @@ services:
     volumes:
       # - config:/etc/headscale
       - data:/var/lib/headscale
+    environment:
+      EXPIRY: ${EXPIRY:-7d}
     configs:
       - source: config_yaml
         target: /etc/headscale/config.yaml
-      - source: extra_dns_records
-        target: /var/lib/headscale/extra-records.json
     deploy:
       restart_policy:
         condition: on-failure
@@ -22,7 +22,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=0.1.0+v0.28"
+        - "coop-cloud.${STACK_NAME}.version=0.3.1+v0.28"
         # Enable backups: https://docs.coopcloud.tech/maintainers/handbook/#how-do-i-configure-backuprestore
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.path=/var/lib/headscale"
@@ -34,7 +34,7 @@ services:
       start_period: 1m
 
   ui:
-    image: ghcr.io/gurucomputing/headscale-ui:2025.08.23
+    image: ghcr.io/gurucomputing/headscale-ui:2026.03.17
     deploy:
       labels:
         - traefik.enable=true
@@ -45,7 +45,6 @@ services:
     networks:
       - proxy
 
-
 networks:
   proxy:
     external: true
@@ -58,7 +57,3 @@ configs:
     name: ${STACK_NAME}_config_yaml_${CONFIG_YAML_VERSION}
     file: config.yaml.tmpl
     template_driver: golang
-  extra_dns_records:
-    name: ${STACK_NAME}_extra_records_${EXTRA_RECORDS_VERSION}
-    file: extra-records.json
-

config.yaml.tmpl

@@ -308,7 +308,7 @@ dns:
   # Extra DNS records
   # so far only A and AAAA records are supported (on the tailscale side)
   # See: docs/ref/dns.md
-  # extra_records: []
+  extra_records: []
   #   - name: "grafana.myvpn.example.com"
   #     type: "A"
   #     value: "100.64.0.3"
@@ -318,7 +318,7 @@ dns:
   #
   # Alternatively, extra DNS records can be loaded from a JSON file.
   # Headscale processes this file on each change.
-  extra_records_path: /var/lib/headscale/extra-records.json
+  # extra_records_path: /var/lib/headscale/extra-records.json
 
 # Unix socket used for the CLI to connect without authentication
 # Note: for production you will want to set this to something like:
@@ -348,7 +348,7 @@ oidc:
   # The amount of time a node is authenticated with OpenID until it expires
   # and needs to reauthenticate.
   # Setting the value to "0" will mean no expiry.
-  expiry: 7d
+  expiry: {{ env "EXPIRY" }}
 
   # Use the expiry from the token received from OpenID when the user logged
   # in. This will typically lead to frequent need to reauthenticate and should

extra-downloader.sh

@@ -1,6 +0,0 @@
-apk add --no-cache --quiet wget
-apk add --no-cache --quiet curl
-apk add --no-cache --quiet jq
-
-version=$(curl https://git.coopcloud.tech/api/v1/repos/{{ env "DNS_REPO" }}/tags | jq -r '.[0].name')
-wget https://git.coopcloud.tech/{{ env "DNS_REPO" }}/raw/tag/$version/headscale-records.json -O /data/extra-records.json

extra-records.json

@@ -1 +0,0 @@
-[]

release/0.3.1+v0.28

@@ -0,0 +1 @@
+added EXPIRY env (non-breaking)