{
  config,
  lib,
  masterDomain,
  ...
}:
let
  cfg = config.os.srv.headscale;
in
{
  options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales";
  config = lib.mkIf cfg.enable {
    services.headscale = {
      enable = true;
      address = "127.0.0.1";
      port = 8080;

      settings = {
        server_url = "https://vpn.${masterDomain}";

        dns = {
          magic_dns = true;
          base_domain = "vpn.internal";
          nameservers = [ "10.255.1.1" ];
        };

        ip_prefixes = [
          "10.254.0.0/16"
        ];
      };
    };

    services.nginx.virtualHosts."vpn.${masterDomain}" = {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:8080";
        proxyWebsockets = true;
      };
    };
  };
}