···

       
560
       
560
       
 
       
  config = lib.mkIf cfg.enable {

     

       
561
       
561
       
 
       
    assertions = [

     

       
562
       
562
       
 
       
      {

     

       
563
       
563
       
-
       
        # This is stricter than it needs to be but is exactly what upstream does:

     

       
564
       
564
       
-
       
        # https://github.com/kradalby/headscale/blob/adc084f20f843d7963c999764fa83939668d2d2c/hscontrol/types/config.go#L799

     

       
565
       
565
       
-
       
        assertion =

     

       
566
       
566
       
-
       
          with cfg.settings;

     

       
567
       
567
       
-
       
          dns.use_username_in_magic_dns or false

     

       
568
       
568
       
-
       
          || dns.base_domain == ""

     

       
569
       
569
       
-
       
          || !lib.hasInfix dns.base_domain server_url;

     

       
570
       
570
       
-
       
        message = "server_url cannot contain the base_domain, this will cause the headscale server and embedded DERP to become unreachable from the Tailscale node.";

     

       
571
       
571
       
-
       
      }

     

       
572
       
572
       
-
       
      {

     

       
573
       
563
       
 
       
        assertion = with cfg.settings; dns.magic_dns -> dns.base_domain != "";

     

       
574
       
564
       
 
       
        message = "dns.base_domain must be set when using MagicDNS";

     

       
575
       
565
       
 
       
      }