chore: publish 0.4.2+v0.29 release

abra.sh

@@ -1,3 +1,3 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export CONFIG_YAML_VERSION=v7
+export CONFIG_YAML_VERSION=v6

compose.yml

@@ -22,7 +22,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=0.4.1+v0.29"
+        - "coop-cloud.${STACK_NAME}.version=0.4.2+v0.29"
         # Enable backups: https://docs.coopcloud.tech/maintainers/handbook/#how-do-i-configure-backuprestore
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.path=/var/lib/headscale"

config.yaml.tmpl

@@ -134,45 +134,8 @@ derp:
 # Disables the automatic check for headscale updates on startup
 disable_check_updates: false
 
-# Node lifecycle configuration.
-node:
-  # Default key expiry for non-tagged nodes, regardless of registration method
-  # (auth key, CLI, web auth). Tagged nodes are exempt and never expire.
-  #
-  # This is the base default. OIDC can override this via oidc.expiry.
-  # If a client explicitly requests a specific expiry, the client value is used.
-  #
-  # Setting the value to "0" means no default expiry (nodes never expire unless
-  # explicitly expired via `headscale nodes expire`).
-  #
-  # Tailscale SaaS uses 180d; set to a positive duration to match that behaviour.
-  #
-  # Default: 0 (no default expiry)
-  expiry: {{ env "EXPIRY" }}
-
-  ephemeral:
-    # Time before an inactive ephemeral node is deleted.
-    inactivity_timeout: 30m
-
-  # HA subnet router health probing.
-  #
-  # When HA routes exist (2+ nodes advertising the same prefix), headscale
-  # pings each HA node every probe_interval via the Noise channel. If a node
-  # fails to respond within probe_timeout it is marked unhealthy and the
-  # primary role moves to the next healthy node. A node that later responds
-  # is marked healthy again but does NOT reclaim primary (avoids flapping).
-  #
-  # Worst-case detection time is probe_interval + probe_timeout (15s default).
-  # No-op when no HA routes exist. Set probe_interval to 0 to disable.
-  routes:
-    ha:
-      # How often to ping HA subnet routers. Set to 0 to disable probing.
-      # Must be >= 2s when enabled.
-      probe_interval: 10s
-
-      # How long to wait for a ping response before marking a node unhealthy.
-      # Must be >= 1s and less than probe_interval.
-      probe_timeout: 5s
+# Time before an inactive ephemeral node is deleted?
+ephemeral_node_inactivity_timeout: 30m
 
 database:
   # Database type. Available options: sqlite, postgres
@@ -382,10 +345,15 @@ oidc:
   # `LoadCredential` straightforward:
   client_secret_path: "/run/secrets/oidc_client_key"
 
+  # The amount of time a node is authenticated with OpenID until it expires
+  # and needs to reauthenticate.
+  # Setting the value to "0" will mean no expiry.
+  node_expiry: {{ env "EXPIRY" }}
+
   # Use the expiry from the token received from OpenID when the user logged
   # in. This will typically lead to frequent need to reauthenticate and should
   # only be enabled if you know what you are doing.
-  # Note: enabling this will cause `node.expiry` to be ignored for
+  # Note: enabling this will cause `oidc.expiry` to be ignored.
   use_expiry_from_token: false
 
   # The OIDC scopes to use, defaults to "openid", "profile" and "email".