Settings

Settings holds the things you touch rarely but need to trust completely. It’s grouped into three categories - Identity (how the console connects and who can sign in), Access (who’s in it and what they can enrol), and System (diagnostics, the optional agent, backups).

Identity

Connection is where Headtower’s own Headscale URL and API key live - usually set once from Compose and rarely touched again.

Authentication is the on/off switch for sign-in: operator mode (no sign-in) or single sign-on. Identity providers is where the providers themselves live - any number of OIDC providers can be enabled at once, each its own button on the login page.

Access

Members lists every account that can sign in and the role it holds - owner, admin, operator, or viewer - with protection against locking out the last owner.

Pre-auth keys let a device join the tailnet without an interactive login - the basis for automated and headless enrollment. Create keys (reusable or single-use, ephemeral or persistent, pre-tagged), see each key’s state and expiry at a glance, and revoke a key the moment it should no longer enrol anything.

API keys are how tooling - including Headtower itself - authenticates to Headscale’s API. Secrets are shown once, at creation, and never again.

System

Diagnostics confirms Headtower can reach Headscale and reports what it found - the control plane it’s pointed at, the version it’s talking to, and any mismatch worth knowing about.

Agent controls the optional Go sidecar: enable/disable, its URL, its SSH secret, and a live health readout.

Database exports the whole local Headtower database (accounts, sessions, roles, identity providers, audit log) as a single downloadable backup.

Trust, not chrome

Settings is intentionally organized, not decorated. Every control here changes who or what can reach the network, or tells you whether the console is seeing the truth - exactly the kind of surface that should be calm and unambiguous.