Ryan Malloy
09b1bae157
Rewrite the dashboard, machines, users, dns, and settings pages as thin
Astro shells that mount a matching React island (Dashboard, MachinesPage,
UsersPage, DnsPage, SettingsPage) built on the shadcn-ui component
library. Alpine.js templates in those pages are replaced wholesale;
Alpine still ships as the runtime for the ACL editor's dependencies.
- src/components/ui/*: shadcn primitives (button, card, tabs, select,
dropdown-menu, avatar, badge, input, switch, separator)
- src/components/{dashboard,dns,machines,settings,users}/*: page-level
React shells that consume server props from the Astro parent
- src/components/shell/AppShell.tsx: shared chrome (nav, user menu)
- src/lib/utils.ts: shadcn's cn() helper
- src/lib/auth/session-manager.ts: pluggable SessionStore interface with
Redis (via REDIS_URL) or in-memory backends; both honor absolute
expiration via TTL. In-memory logs a warning that sessions vanish on
restart.
- src/lib/auth/oidc-client.ts, oidc-state.ts: shrink OIDC handlers now
that PKCE + nonce state travels in a signed JWT cookie
- src/pages/api/auth/*: match the simplified handlers
- src/styles/global.css, tailwind.config.mjs, tsconfig.json: shadcn
design tokens and the '@/*' path alias
- docker-compose.local.yml: local dev tweaks
- package.json, pnpm-lock.yaml: shadcn + Radix + ioredis + zod
|
||
|---|---|---|
| .github | ||
| .zed | ||
| authentik-blueprints | ||
| cmd | ||
| docs | ||
| drizzle | ||
| examples | ||
| internal | ||
| nix | ||
| patches | ||
| public | ||
| remote-access | ||
| src | ||
| tests | ||
| .dockerignore | ||
| .gitignore | ||
| .npmrc | ||
| .tool-versions | ||
| agent.Dockerfile | ||
| ALPINE_ASTRO_TRANSFORMATION.md | ||
| astro.config.mjs | ||
| AUTHENTIK_HEADY_ARCHITECTURE.md | ||
| AUTHENTIK_SETUP_GUIDE.md | ||
| BETTER_ROLE_MAPPING_CONFIG.yaml | ||
| biome.json | ||
| Caddyfile | ||
| CHANGELOG.md | ||
| compose.yaml | ||
| config.example.yaml | ||
| CONFIGURABLE_ROLE_MAPPING_SOLUTION.md | ||
| DEBUGGING_ANALYSIS_REPORT.md | ||
| docker-compose.local.yml | ||
| Dockerfile | ||
| Dockerfile.dev | ||
| drizzle.config.ts | ||
| flake.lock | ||
| flake.nix | ||
| go.mod | ||
| go.sum | ||
| GUACAMOLE_REMOTE_ACCESS_DESIGN.md | ||
| headplane-security-assessment.md | ||
| HEADY_MANIFESTO.md | ||
| IMPROVEMENTS_DEMO.md | ||
| lefthook.yml | ||
| LICENSE | ||
| mise.toml | ||
| OIDC_IMPROVEMENTS_SUMMARY.md | ||
| package.json | ||
| pnpm-lock.yaml | ||
| PR_DRAFT_OIDC_ROLE_MAPPING.md | ||
| README.md | ||
| role-mapping-examples.yaml | ||
| SMART_IMPROVEMENTS.md | ||
| tailwind.config.mjs | ||
| TESTING_PLAN.md | ||
| tsconfig.json | ||
| vitest.config.ts | ||
| WASM_SSH_REMOVAL.md | ||
| wrangler.toml | ||
🤠 Heady
Strategic VPN management for Headscale that's actually awesome to use!
Headscale is the de-facto self-hosted version of Tailscale, a popular Wireguard based VPN service. By default, it does not ship with a web UI, which is where Heady comes in.
Heady is strategic VPN management that prioritizes security, thoughtful design, and awesome user experience. Unlike feature-heavy alternatives, Heady focuses on doing the important things incredibly well.
🎯 What Makes Heady Different
Security-First Design: Every feature is evaluated for security impact first
Convention Over Configuration: Smart defaults that just work for 90% of setups
Quality Over Quantity: Fewer features, done awesomely well
Community-Driven: Built for real users, not corporate feature checklists
✨ Awesome Features
- Smart Machine Management: Intuitive node administration with clear status and controls
- Intelligent ACL Configuration: Visual access control with tagging support
- Revolutionary OIDC Integration: Zero-config role mapping that just works with any identity provider
- DNS Made Simple: Easy MagicDNS setup and custom record management
- Thoughtful Configuration: Headscale settings that make sense
🚀 Getting Started
Heady runs as a web application alongside your Headscale server. Quick setup with smart defaults gets you running fast.
Quick Start (Docker - Recommended)
# Coming soon - simplified Docker deployment
🔧 Zero-Config OIDC Setup
Heady's revolutionary OIDC system works with any identity provider out of the box:
oidc:
issuer: "https://your-provider.com"
client_id: "your-client-id"
client_secret: "your-secret"
# That's it! Role mapping, scopes, and redirect URIs are auto-configured
Want custom roles? Easy:
HEADPLANE_ADMIN_GROUPS="admin,managers"
HEADPLANE_OWNER_GROUPS="ceo,founders"
📖 Documentation & Community
- 📋 OIDC Setup Guide - Zero-config authentication
- 🏗️ Architecture Design - Security-first remote access
- 🤠 Heady Manifesto - Our philosophy and values
- 🔧 Configuration Examples - Smart defaults you can customize
🎯 Deployment Options
Heady v1.0 features a unified architecture with all awesome features available in every deployment:
-
Standard Deployment
Quick deployment with smart defaults. All features available, with optional integrations configured as needed.
-
Advanced Integration
Enable Docker, Kubernetes, or native process integration for automatic DNS management and configuration updates.
Versioning
Headplane uses semantic versioning for its releases (since v0.6.0).
Pre-release builds are available under the next tag and get updated when a new release
PR is opened and actively in testing.
Contributing
Headplane is an open-source project and contributions are welcome! If you have any suggestions, bug reports, or feature requests, please open an issue. Also refer to the contributor guidelines for more info.
Copyright (c) 2025 Aarnav Tale