expiry moved from oidc to node

Reviewed-on: coop-cloud/headscale#10

.env.sample

@@ -25,3 +25,5 @@ ENABLE_DERP=false
 # See https://git.coopcloud.tech/coop-cloud/backup-bot-two
 ENABLE_BACKUPS=true
 
+# The amount of time a node is authenticated, default is set to 7d
+#EXPIRY=0

MAINTENANCE.md

@@ -0,0 +1,35 @@
+# Headscale Recipe Maintenance
+
+All contributions should be made via a pull request. This is to ensure a
+certain quality and consistency, that others can rely on.
+
+## Maintainer Responsibilities
+
+`3wc` is responsible for installing regular updates:
+
+- Patch and minor updates within a week of them being released upstream
+- Major updates within a month of them being released upstream
+
+`ammaratef45` is responsible for responding to pull requests and issues, within a week of them being filed.
+
+`val` is available as backup for both of these tasks.
+
+In order to fulfill these responsibilities a recipe maintainer:
+
+- Has to watch the repository (to get notifications)
+- Needs to make sure Renovate is configured properly
+
+## Pull Requests
+
+A pull request can be merged if it is approved by at least one maintainer. For
+pull requests opened by a maintainer they need to be approved by another
+maintainer. Even though it is okay to merge a pull request with one approval, it
+is always better if all maintainers looked at the pull request and approved it.
+
+## Become a maintainer
+
+Everyone can apply to be a recipe maintainer:
+
+1. Watch the repository to always get updates
+2. Simply add yourself to the list in the [README.md](./README.md), add yourself to whichever things you would like to be (co) responsible for in this document, then open a new pull request with the change.
+3. Once the pull request gets merged you will be added to the [headscale maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/headscale-maintainers).

README.md

@@ -4,8 +4,10 @@
 
 <!-- metadata -->
 
+* **Maintainer**: [@3wc](https://git.coopcloud.tech/3wordchant), [@ammaratef45](https://git.coopcloud.tech/ammaratef45), [@val](https://git.coopcloud.tech/val)
+* **Status**: `stable`
 * **Category**: Apps
-* **Status**: 3
+* **Features**: 3
 * **Image**: [`headscale/headscale`](https://hub.docker.com/r/headscale/headscale), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: Yes
@@ -41,4 +43,4 @@ abra app run yourapp.xyz app -- headscale help
 
 2. The UI runs on `https://yourapp.xyz/web`, the UI is a mere frontend (a static site), so no data is saved on a server, so you will need to set URL and API-Key yourself on every client. Find more about the UI [here](https://github.com/gurucomputing/headscale-ui).
 
-For the usage of headscale itself, check the [offical docs](https://headscale.net/stable/usage/getting-started/).
+For the usage of headscale itself, check the [offical docs](https://headscale.net/stable/usage/getting-started/).

abra.sh

@@ -1,3 +1,3 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export CONFIG_YAML_VERSION=v4
+export CONFIG_YAML_VERSION=v7

compose.yml

@@ -1,13 +1,15 @@
 ---
 services:
   app:
-    image: headscale/headscale:v0.28
+    image: headscale/headscale:v0.29
     networks:
       - proxy
     command: serve
     volumes:
       # - config:/etc/headscale
       - data:/var/lib/headscale
+    environment:
+      EXPIRY: ${EXPIRY:-7d}
     configs:
       - source: config_yaml
         target: /etc/headscale/config.yaml
@@ -20,7 +22,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=0.1.0+v0.28"
+        - "coop-cloud.${STACK_NAME}.version=0.4.1+v0.29"
         # Enable backups: https://docs.coopcloud.tech/maintainers/handbook/#how-do-i-configure-backuprestore
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.path=/var/lib/headscale"
@@ -32,7 +34,7 @@ services:
       start_period: 1m
 
   ui:
-    image: ghcr.io/gurucomputing/headscale-ui:2025.08.23
+    image: ghcr.io/gurucomputing/headscale-ui:2026.03.17
     deploy:
       labels:
         - traefik.enable=true

config.yaml.tmpl

@@ -134,8 +134,45 @@ derp:
 # Disables the automatic check for headscale updates on startup
 disable_check_updates: false
 
-# Time before an inactive ephemeral node is deleted?
+# Node lifecycle configuration.
-ephemeral_node_inactivity_timeout: 30m
+node:
+  # Default key expiry for non-tagged nodes, regardless of registration method
+  # (auth key, CLI, web auth). Tagged nodes are exempt and never expire.
+  #
+  # This is the base default. OIDC can override this via oidc.expiry.
+  # If a client explicitly requests a specific expiry, the client value is used.
+  #
+  # Setting the value to "0" means no default expiry (nodes never expire unless
+  # explicitly expired via `headscale nodes expire`).
+  #
+  # Tailscale SaaS uses 180d; set to a positive duration to match that behaviour.
+  #
+  # Default: 0 (no default expiry)
+  expiry: {{ env "EXPIRY" }}
+
+  ephemeral:
+    # Time before an inactive ephemeral node is deleted.
+    inactivity_timeout: 30m
+
+  # HA subnet router health probing.
+  #
+  # When HA routes exist (2+ nodes advertising the same prefix), headscale
+  # pings each HA node every probe_interval via the Noise channel. If a node
+  # fails to respond within probe_timeout it is marked unhealthy and the
+  # primary role moves to the next healthy node. A node that later responds
+  # is marked healthy again but does NOT reclaim primary (avoids flapping).
+  #
+  # Worst-case detection time is probe_interval + probe_timeout (15s default).
+  # No-op when no HA routes exist. Set probe_interval to 0 to disable.
+  routes:
+    ha:
+      # How often to ping HA subnet routers. Set to 0 to disable probing.
+      # Must be >= 2s when enabled.
+      probe_interval: 10s
+
+      # How long to wait for a ping response before marking a node unhealthy.
+      # Must be >= 1s and less than probe_interval.
+      probe_timeout: 5s
 
 database:
   # Database type. Available options: sqlite, postgres
@@ -345,15 +382,10 @@ oidc:
   # `LoadCredential` straightforward:
   client_secret_path: "/run/secrets/oidc_client_key"
 
-  # The amount of time a node is authenticated with OpenID until it expires
-  # and needs to reauthenticate.
-  # Setting the value to "0" will mean no expiry.
-  expiry: 7d
-
   # Use the expiry from the token received from OpenID when the user logged
   # in. This will typically lead to frequent need to reauthenticate and should
   # only be enabled if you know what you are doing.
-  # Note: enabling this will cause `oidc.expiry` to be ignored.
+  # Note: enabling this will cause `node.expiry` to be ignored for
   use_expiry_from_token: false
 
   # The OIDC scopes to use, defaults to "openid", "profile" and "email".
@@ -410,11 +442,6 @@ logtail:
   # disabled by default. Enabling this will make your clients send logs to Tailscale Inc.
   enabled: false
 
-# Enabling this option makes devices prefer a random port for WireGuard traffic over the
-# default static port 41641. This option is intended as a workaround for some buggy
-# firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.
-randomize_client_port: false
-
 # Taildrop configuration
 # Taildrop is the file sharing feature of Tailscale, allowing nodes to send files to each other.
 # https://tailscale.com/kb/1106/taildrop/

release/0.3.1+v0.28

@@ -0,0 +1 @@
+added EXPIRY env (non-breaking)