# Run this command on YOUR machine (not the VPS)
docker run --rm headscale/headscale:latest headscale version
headscale v0.23.0  ← you should see a version here

# If you see a version → Docker is ready, let's continue.
# Otherwise:
# "docker: command not found"           → install Docker Desktop
# "Cannot connect to the Docker daemon" → start Docker Desktop

# Your private network at the end of the tutorial

Your VPS (e.g.: 89.145.x.x)         Your local machine
┌─────────────────────────┐       ┌──────────────────────┐
│  Headscale : 100.64.0.1 │◄──────│  Client : 100.64.0.2 │
│  Port 443 (public HTTPS)│  VPN  │  No open ports       │
│  Port 51820 (WireGuard) │  ───► │  Outbound connection │
└─────────────────────────┘       └──────────────────────┘
         ↑
    Internet visible
    to anyone

# Lance cette commande sur TA machine (pas le VPS)
docker run --rm headscale/headscale:latest headscale version
headscale v0.23.0  ← tu dois voir une version ici

# Si tu vois une version → Docker est prêt, on continue.
# Sinon :
# "docker: command not found"           → installe Docker Desktop
# "Cannot connect to the Docker daemon" → démarre Docker Desktop

# Ton réseau privé à la fin du tutoriel

Ton VPS (ex: 89.145.x.x)          Ta machine locale
┌─────────────────────────┐       ┌──────────────────────┐
│  Headscale : 100.64.0.1 │◄──────│  Client : 100.64.0.2 │
│  Port 443 (HTTPS public)│  VPN  │  Aucun port ouvert   │
│  Port 51820 (WireGuard) │  ───► │  Connexion sortante  │
└─────────────────────────┘       └──────────────────────┘
         ↑
    Internet visible
    par n'importe qui

# How a device joins the network:

1. The device generates a key pair (private + public)
2. It authenticates on Headscale with a pre-auth key
3. Headscale assigns it a private IP (e.g.: 100.64.0.2)
4. Headscale distributes the public key to other devices
5. Devices connect directly peer-to-peer

# Result: each device knows the keys of the others
# Exchanges are direct, Headscale does not see the traffic

# Comment un appareil rejoint le réseau :

1. L'appareil génère une paire de clés (privée + publique)
2. Il s'authentifie sur Headscale avec une "pre-auth key"
3. Headscale lui attribue une IP privée (ex: 100.64.0.2)
4. Headscale distribue la clé publique aux autres appareils
5. Les appareils se connectent directement en pair-à-pair

# Résultat : chaque appareil connaît les clés des autres
# Les échanges sont directs, Headscale ne voit pas le trafic

# Initial connection to your VPS (replace with your IP)
ssh root@203.0.113.42

# Update the system first
apt update && apt upgrade -y

# Create a non-root user (replace "umbra" with your name)
adduser umbra
usermod -aG sudo umbra

# Copy your SSH key to the new user
rsync --archive --chown=umbra:umbra ~/.ssh /home/umbra

# Edit SSH configuration
sudo nano /etc/ssh/sshd_config

# Modify these 4 parameters:
Port                    50222   # Non-standard port (avoids 99% of bots)
PermitRootLogin         no      # Never root directly
PasswordAuthentication  no      # Keys only
PubkeyAuthentication    yes

# Restart SSH, KEEP your current session open!
sudo systemctl restart sshd

# Test in a SECOND terminal BEFORE closing the first
ssh -p 50222 umbra@203.0.113.42
# If it works → you can close the first terminal

# Official Docker installation method
curl -fsSL https://get.docker.com | sh

# Add your user to the docker group (avoids sudo every time)
sudo usermod -aG docker umbra
newgrp docker

# Verify
docker --version
Docker version 26.x.x ← expected result

# Connexion initiale à ton VPS (remplace par ton IP)
ssh root@203.0.113.42

# Mettre à jour le système en premier
apt update && apt upgrade -y

# Créer un utilisateur non-root (remplace "umbra" par ton nom)
adduser umbra
usermod -aG sudo umbra

# Copier ta clé SSH vers le nouvel utilisateur
rsync --archive --chown=umbra:umbra ~/.ssh /home/umbra

# Éditer la configuration SSH
sudo nano /etc/ssh/sshd_config

# Modifier ces 4 paramètres :
Port                    50222   # Port non-standard (évite 99% des bots)
PermitRootLogin         no      # Jamais root directement
PasswordAuthentication  no      # Clés uniquement
PubkeyAuthentication    yes

# Redémarrer SSH, GARDE ta session actuelle ouverte !
sudo systemctl restart sshd

# Test dans un SECOND terminal AVANT de fermer le premier
ssh -p 50222 umbra@203.0.113.42
# Si ça marche → tu peux fermer le premier terminal

# Méthode officielle Docker (script d'installation)
curl -fsSL https://get.docker.com | sh

# Ajouter ton utilisateur au groupe docker (évite sudo à chaque fois)
sudo usermod -aG docker umbra
newgrp docker

# Vérification
docker --version
Docker version 26.x.x ← résultat attendu

# Create the file structure for Headscale
mkdir -p /opt/headscale/{config,data}
cd /opt/headscale

version: "3.9"
services:
  headscale:
    image:   headscale/headscale:latest
    restart: unless-stopped
    volumes:
      - ./config:/etc/headscale   # YAML config
      - ./data:/var/lib/headscale  # SQLite database
    ports:
      - "443:8080"              # Public HTTPS
      - "51820:51820/udp"       # WireGuard UDP
    command: headscale serve

# /opt/headscale/config/config.yaml
# Replace vpn.yourdomain.io with your domain

server_url: https://vpn.yourdomain.io
listen_addr: 0.0.0.0:8080
ip_prefixes:
  - 100.64.0.0/10

database:
  type: sqlite
  sqlite:
    path: /var/lib/headscale/db.sqlite

tls_letsencrypt_hostname: vpn.yourdomain.io
tls_letsencrypt_cache_dir: /var/lib/headscale/cache

# Launch Headscale
docker compose up -d

# Verify the service responds
curl https://vpn.yourdomain.io/health
{"status":"pass"}  ← expected result

# Create a namespace (a "virtual network")
docker exec headscale headscale namespaces create mynetwork

# Generate a pre-auth key (valid 24h)
docker exec headscale headscale preauthkeys create \
  --namespace mynetwork --expiration 24h
# Output: mkey:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Copy this key, you need it in chapter 05

# Créer la structure de fichiers pour Headscale
mkdir -p /opt/headscale/{config,data}
cd /opt/headscale

version: "3.9"
services:
  headscale:
    image:   headscale/headscale:latest
    restart: unless-stopped
    volumes:
      - ./config:/etc/headscale   # Config YAML
      - ./data:/var/lib/headscale  # Base de données SQLite
    ports:
      - "443:8080"              # HTTPS public
      - "51820:51820/udp"       # WireGuard UDP
    command: headscale serve

# /opt/headscale/config/config.yaml
# Remplace vpn.tondomaine.io par ton domaine

server_url: https://vpn.tondomaine.io
listen_addr: 0.0.0.0:8080
ip_prefixes:
  - 100.64.0.0/10

database:
  type: sqlite
  sqlite:
    path: /var/lib/headscale/db.sqlite

tls_letsencrypt_hostname: vpn.tondomaine.io
tls_letsencrypt_cache_dir: /var/lib/headscale/cache

# Lancer Headscale
docker compose up -d

# Vérifier que le service répond
curl https://vpn.tondomaine.io/health
{"status":"pass"}  ← résultat attendu

# Créer un namespace (un "réseau virtuel")
docker exec headscale headscale namespaces create monreseau

# Générer une clé de pré-authentification (valide 24h)
docker exec headscale headscale preauthkeys create \
  --namespace monreseau --expiration 24h
# Output : mkey:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Copie cette clé, tu en as besoin au chapitre 05

# Install Tailscale (Headscale-compatible client)
curl -fsSL https://tailscale.com/install.sh | sh

# Connect to Headscale server (replace the values)
sudo tailscale up \
  --login-server=https://vpn.yourdomain.io \
  --authkey=mkey:xxxx \
  --hostname=my-laptop

# Expected result: Success.

# Installer Tailscale (client compatible Headscale)
curl -fsSL https://tailscale.com/install.sh | sh

# Connecter au serveur Headscale (remplace les valeurs)
sudo tailscale up \
  --login-server=https://vpn.tondomaine.io \
  --authkey=mkey:xxxx \
  --hostname=mon-laptop

# Résultat attendu : Success.
# Some peers are advertising routes but never sent traffic.

# On the VPS, see connected clients
docker exec headscale headscale nodes list
ID  │ Hostname    │ VPN IP      │ Online
1   │ my-laptop   │ 100.64.0.2  │  ✓

# From your local machine, ping the VPS via VPN
ping 100.64.0.1 -c 4
64 bytes from 100.64.0.1: time=12.4 ms  ← expected result

# DNS leak test (critical!)
curl https://dnsleaktest.com/test.json | python3 -m json.tool
# The DNS server must match your hosting provider, NOT your ISP

# List nodes with their IDs
docker exec headscale headscale nodes list

# Delete node with ID 3 (example)
docker exec headscale headscale nodes delete --identifier 3
# The device loses access immediately

# Sur le VPS, voir les clients connectés
docker exec headscale headscale nodes list
ID  │ Hostname    │ IP VPN      │ Online
1   │ mon-laptop  │ 100.64.0.2  │  ✓

# Depuis ta machine locale, ping le VPS via VPN
ping 100.64.0.1 -c 4
64 bytes from 100.64.0.1: time=12.4 ms  ← résultat attendu

# Test de fuite DNS (critique !)
curl https://dnsleaktest.com/test.json | python3 -m json.tool
# Le serveur DNS doit correspondre à ton hébergeur, PAS à ta box FAI

# Lister les nœuds avec leurs IDs
docker exec headscale headscale nodes list

# Supprimer le nœud avec l'ID 3 (exemple)
docker exec headscale headscale nodes delete --identifier 3
# L'appareil perd l'accès immédiatement