1
[Unit]
2
Description=headscale controller
3
After=syslog.target
4
After=network.target
5

6
[Service]
7
Type=simple
8
User=headscale
9
Group=headscale
10
ExecStart=/usr/bin/headscale serve  # 也有可能是 /usr/local/bin/headscale
11
Restart=always
12
RestartSec=5
13

14
# Optional security enhancements
15
NoNewPrivileges=yes
16
PrivateTmp=yes
17
ProtectSystem=strict
18
ProtectHome=yes
19
ReadWritePaths=/var/lib/headscale /var/run/headscale
20
AmbientCapabilities=CAP_NET_BIND_SERVICE
21
RuntimeDirectory=headscale
22

23
[Install]
24
WantedBy=multi-user.target

1
server {
2
    listen 443 ssl;
3
    server_name 域名;
4
    charset utf-8;
5

6
    ssl_certificate /etc/letsencrypt/live/域名/fullchain.pem;
7
    ssl_certificate_key /etc/letsencrypt/live/域名/privkey.pem;
8
    ssl_protocols TLSv1.2 TLSv1.3;
9
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
10
    ssl_prefer_server_ciphers on;
11
    ssl_session_cache shared:SSL:10m;
12
    ssl_session_timeout 5m;
13
    keepalive_timeout 70;
14

15

16
    location / {
17
        proxy_redirect off;
18
        proxy_pass http://127.0.0.1:8080; # port
19
        proxy_http_version 1.1;
20
        proxy_set_header Upgrade $http_upgrade;
21
        proxy_set_header Connection "upgrade";
22
        proxy_set_header Host $host;
23

24
        proxy_set_header X-Real-IP $remote_addr;
25
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
26
    }
27
}

1
server {
2
    listen 8443 ssl;
3
    server_name 域名;
4
    charset utf-8;
5

6
    ssl_certificate /etc/letsencrypt/live/域名/fullchain.pem;
7
    ssl_certificate_key /etc/letsencrypt/live/域名/privkey.pem;
8
    ssl_protocols TLSv1.2 TLSv1.3;
9
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
10
    ssl_prefer_server_ciphers on;
11
    ssl_session_cache shared:SSL:10m;
12
    ssl_session_timeout 5m;
13
    keepalive_timeout 70;
14

15

16
    location / {
17
        proxy_redirect off;
18
        proxy_pass http://127.0.0.1:81; # port
19
        proxy_http_version 1.1;
20
        proxy_set_header Upgrade $http_upgrade;
21
        proxy_set_header Connection "upgrade";
22
        proxy_set_header Host $host;
23

24
        proxy_set_header X-Real-IP $remote_addr;
25
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
26
    }
27
}

1
regions:
2
  900:
3
    regionid: 900
4
    regioncode: awh
5
    regionname: AliWuHan
6
    nodes:
7
      - name: 900a
8
        regionid: 900
9
        hostname: 域名
10
        # ipv4: ip
11
        stunport: 3478
12
        # stunonly: false
13
        derpport: 8443

1
  # Locally available DERP map files encoded in YAML
2
  #
3
  # This option is mostly interesting for people hosting their own DERP servers:
4
  # https://tailscale.com/docs/reference/derp-servers/custom-derp-servers
5
  # https://headscale.net/stable/ref/derp/
6
  #
7
  # paths:
8
  #   - /etc/headscale/derp-example.yaml
9
  paths: [/etc/headscale/derp.yaml]

1
    # 在location /后添加
2
    location /web {
3
      alias /home/mint/web/headscale;
4
      try_files $uri $uri/ index.html;
5
    }

1
# Path to ACL file
2
policy:
3
  path: /etc/headscale/acl.hujson

1
{
2
    // 定义哪些用户/用户组可以给设备打标签
3
    "tagOwners": {
4
        "tag:shared-server": ["mint@"],
5
        "tag:shared-vm": ["mint@"],
6
    },
7

8
    // 定义访问控制规则
9
    "acls": [
10
        {
11
            "action": "accept",
12
            // 访问源可以是网络内的所有普通用户设备，或是特定用户
13
            "src": ["autogroup:member"],
14
            // 允许源设备访问"自己"名下的所有设备的所有端口
15
            "dst": ["autogroup:self:*"]
16
        },
17
        // 精确控制（只开放 5901 端口）
18
        {
19
            "action": "accept",
20
            // 访问源：你想要授权的好友用户（注意：用户名后需要加 @）
21
            "src": ["cyan@"],
22
            // 目的地：你的共享设备 的 5901 端口
23
            "dst": ["tag:shared-server:5901"]
24
        },
25
        {
26
            "action": "accept",
27
            "src": ["mint@"],
28
            "dst": ["tag:shared-server:*"]   // 允许访问所有端口
29
        },
30
        {
31
            "action": "accept",
32
            "src": ["autogroup:member"],
33
            "dst": ["tag:shared-vm:*"]
34
        }
35
    ]
36
}