Caddyfile

{
        # ZeroSSL account
        acme_ca https://acme.zerossl.com/v2/DV90
        email YOUR_EMAIL
}

# Dashboard
https://dashboard.HEADSCALE_BASE_DOMAIN {
        header {
                Access-Control-Allow-Origin https://dashboard.HEADSCALE_BASE_DOMAIN
		Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE"
	        Access-Control-Allow-Headers *
                Strict-Transport-Security "max-age=31536000;"
                X-XSS-Protection "1; mode=block"
                X-Frame-Options "SAMEORIGIN"
                X-Robots-Tag "none"
                -Server
        }
        reverse_proxy http://headscale-ui
}

# API
https://api.HEADSCALE_BASE_DOMAIN {
@hs-options {
		host api.HEADSCALE_BASE_DOMAIN
		method OPTIONS
	}
	@hs-other {
		host api.HEADSCALE_BASE_DOMAIN
	}
	handle @hs-options {
		header {
			Access-Control-Allow-Origin https://dashboard.HEADSCALE_BASE_DOMAIN
			Access-Control-Allow-Headers *
			Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE"
		}
		respond 204
	}
	handle @hs-other {
		reverse_proxy http://headscale:8080 {
			header_down Access-Control-Allow-Origin https://dashboard.HEADSCALE_BASE_DOMAIN
			header_down Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE"
			header_down Access-Control-Allow-Headers *
		}
	}
}