Changelog

• The docs now live at northplane.sageware.io, built from main. Links in the interface, the README and config.example.yaml point there instead of headplane.net.

• DNS records are only read from and written to the file in Headscale's dns.extra_records_path. Records listed inline under dns.extra_records show as read-only, so move them into the file to keep editing them.
• The proc and kubernetes integrations now restart Headscale instead of reloading it, so Headscale needs a supervisor that brings it back: systemd with Restart=always, which Headscale's own unit and the NixOS module already set, or the kubelet.
• Enabling more than one integration now turns them all off, with an error in the log. Keep one.
• After signing in with single sign-on, only owners, admins and IT admins can pick which Headscale user their account links to. Everyone else links automatically or is linked from the Users page.
• Builds no longer read __INTERNAL_PREFIX. If a build used it to serve Headplane somewhere other than /admin, set server.base_path to that path instead.

• Headplane is now called Northplane. The name changes in the interface, the docs and the README. Nothing operators configure changes: the HEADPLANE_* environment variables, the config file keys, the container image and the /admin path all keep working.
• The interface is built on shadcn/ui. Buttons, inputs, menus, dialogs, tabs, tables and notices share shadcn's look in light and dark mode, with Northplane's colors.
• The navigation bar shows which Headscale server Northplane is managing, from headscale.public_url (or headscale.url when that isn't set), next to the Northplane name.
• Headplane can be served under a path other than /admin by setting server.base_path, without building it from source.#637
• Headplane has a new color palette built from its logo: warm greys, black primary buttons, and a muted blue that marks links, focus, and the current page. Dark mode now separates the page, menus, and dialogs by shade so overlays stand out, and secondary text is easier to read in both themes.#651
• Dialogs can now be closed by clicking outside them, except the ones that confirm a destructive action like removing a machine.
• The navigation bar is slimmer, and on small screens the pages now live in a menu instead of a second row of tabs.
• The navigation bar stays at the top while you scroll. With a mouse or trackpad, the page scrollbar is now a thin overlay that fades in while scrolling, so pages no longer shift sideways when they become long enough to scroll.
• The machines list is easier to scan: each machine shows its status next to its name, its tags and badges on one line, and both of its addresses. Badges only use color when something needs attention, like an expired key, a key expiring within a week, or routes waiting for approval. Click an address to copy it.#654
• With the Headplane agent enabled, the machines list marks clients running an older Tailscale release than the latest stable one. Headplane checks pkgs.tailscale.com for the latest version once a day in the background.
• The machine page uses the same layout as DNS and Settings, with its details split into Routing, Machine, Addresses, and Connectivity sections instead of boxed cards. Addresses, domains, and the node key copy when clicked.
• The Users page matches the new machines list: each user shows their avatar, email, and groups on one line, along with when their machines were last seen. Add user now sits in the page header, and users whose profile picture fails to load get an initial instead of a broken image.
• The DNS page is reorganized: the tailnet name, Magic DNS, and the local DNS override sit together under General, and each section has its heading and add button in a column beside its list. Split DNS nameservers now sit in the same list as global ones, marked with the domain they answer for, and nameservers can be reordered the same way as search domains.
• Settings has a sidebar for Auth keys, Sign-in restrictions, and Agent instead of a page of links, and /settings opens auth keys directly. Auth keys are listed in a table, newest first, with filters like the machines list. Sign-in restrictions and the agent status use the same layout as the DNS page.
• The agent page shows more of what the agent is doing: how many times in a row a sync has failed, how often it syncs, when its process started, its own machine and Tailscale version, and which machines were missing from the last sync and how old their details are.
• The sign-in page is redesigned: the form sits on one side and an animated tailnet on the other, with machines coming and going and passing packets between them. Single sign-on sits above the API key field, sign-in errors are shorter and appear under the field, and the signed-out and single sign-on error pages share the same layout.
• Accounts that sign in with single sign-on keep trying to link to a matching Headscale user (same subject or email) after sign-in, not only during it. With single sign-on set up on Headscale too, an account links by itself once its first device signs in.
• Only admins can pick which Headscale user their account links to, on a page shown once after signing in that they can skip. Previously anyone signing in for the first time could claim any unlinked Headscale user, and with it that user's machines and auth keys wherever their role allowed. Everyone else is linked automatically or by an admin from the Users page.
• People without dashboard access get a new home page that walks through installing Tailscale and connecting it to this network, and shows whether their account is linked yet. It updates live, so it notices as soon as their first device signs in.
• Error pages are redesigned. Inside the app, an error keeps the navigation bar and explains what went wrong in a sentence, with raw details tucked under Details and a Try again button where retrying can help. Errors that stop the app from loading, and unknown addresses, use the sign-in layout.
• The routes dialog and the lists in the tags, groups, auth key, and policy rule dialogs use the same rows as the DNS and Settings pages, with a Remove button on each entry instead of an X.
• Pre-auth keys are called auth keys everywhere in Headplane, matching Tailscale. Generate Pre-auth Key in the Add machine menu is now Create auth key.
• Browser SSH's username prompt, offline machine page, and error pages use the sign-in layout, with shorter error messages that link straight to the matching troubleshooting section.
• Open pages notice within a few seconds when Headscale goes down or comes back, and update on their own. The "Can't reach Headscale" banner and error pages clear without a reload.
• When the Headscale configuration is writable but no integration is set up to restart Headscale, the DNS and sign-in restrictions pages now say that changes only take effect once Headscale restarts.
• The Rules tab on the Access Control page can now edit grants and auto approvers. Grants set ports and protocols separately from the destination, can route traffic through tagged subnet routers or exit nodes with via, and keep app capabilities as written. Grants need Headscale 0.29 or newer. Auto approvers cover both subnet routes and exit nodes.
• The Access Control file editor now formats HuJSON, preserves comments while formatting, and shows syntax errors before an invalid policy can be saved.

• Saving from the Rules or Tags & Groups tabs no longer drops the comma from text like ,} or ,] inside a policy value.
• Live updates work again right after signing in. Previously the machines list and other pages only refreshed on their own after a full page reload.
• Changes to DNS settings and sign-in restrictions now actually apply with the proc and kubernetes integrations. Both sent SIGHUP, which only makes Headscale reload its ACL policy. They now stop Headscale with SIGTERM and wait for systemd or Kubernetes to restart it, so Headscale needs a supervisor that restarts it.
• If Headscale doesn't come back after a change, Headplane now shows an error instead of reporting success.
• Enabling two integrations at once is now caught at startup. Previously Headplane only refused when all three were on, and otherwise silently picked Docker.
• The cookie that tracked SSO state was not signed. It is now signed with server.cookie_secret and cleared once SSO succeeds.#659
• Profile pictures from OIDC now correctly update on each sign-in. If the provider stops sending pictures, Headplane removes the picture instead of leaving a potentially broken image behind.
• Browser SSH correctly handles full-screen programs like btop and htop where it may have previously rendered layouts incorrectly.
• A machine's page now requires permission to view machines, like the machines list. Previously anyone signed in could open it by its address.
• The auth keys page only shows people with self-service keys (like auditors and viewers) their own keys. Previously it sent every user's keys to anyone signed in, in full on Headscale 0.27, even when the page itself said they had no access. Self-service users also can no longer create tag-only keys or expire someone else's key by submitting the form directly.
• Syncing the agent now requires permission to view machines, like the agent page itself. Previously anyone signed in could trigger a sync.
• Enabling key expiry on a machine no longer signs it out on the spot. Its key now expires in 180 days, matching Tailscale. On Headscale 0.29, where machines added with an auth key start with key expiry off, this affected every machine the first time expiry was turned on.
• Signing in ignores spaces and line breaks pasted around an API key. A key with stray characters inside it is reported as invalid instead of "Couldn't reach Headscale."
• Errors on the machine page and in Settings no longer replace the whole app with an error message. The navigation bar and the Settings sidebar stay so you can move on.
• The agent page loads while Headscale is unreachable, showing the agent's sync status without the machine details.
• An unexpected error during a background agent sync no longer crashes Headplane.
• Fixed the error page crashing on errors that bundle several failures together.
• The logo in the navigation bar now follows the theme picked in Headplane instead of the system theme.
• Fields with an error keep their red border while focused instead of turning blue.
• Browser SSH no longer connects as a Headscale user that's already linked to someone else's account just because the email matches. An unlinked account now links the same way it does everywhere else first.
• The agent no longer creates a new auth key everytime it starts, which caused duplicate machines to be registered on Headscale 0.28.
  • The agent now reuses its existing key and will delete leftover machines on Headscale if it detects a duplicate.
  • Restart resiliency and crash recovery have been improved. There is now a 20 second heartbeat to catch an unresponsive agent.
  • Headplane now rejects an agent work directory it can't write to.
• If the agent's machine is deleted while Headplane is stopped, the agent registers again on the next start instead of waiting for a login that never comes.
• Creating or renaming a user to a name that's already taken now says so, instead of showing a database error from Headscale.
• Linking an account to a Headscale user that no longer exists now shows an error instead of saving a broken link.
• Changing the owner's role or transferring ownership to yourself now explains why it can't be done, instead of asking to try again.
• Removing the last global nameserver while local DNS is overridden, or turning the override on without a global nameserver, no longer saves a config Headscale refuses to start with. Headplane now explains what to change first.
• Removing or reordering a nameserver, search domain or DNS record that changed in another tab now says so, instead of restarting Headscale for nothing.
• Turning off key expiry on Headscale 0.27 or 0.28 no longer signs the machine out. Headplane now explains that this needs Headscale 0.29 or newer.
• Acting on a machine that was deleted elsewhere now says the machine no longer exists.
• The ACL page no longer shows an empty, editable policy when Headscale can't load it. With Headscale's default file-mode configuration it now shows the policy as read-only, and other errors are reported instead of offering to overwrite the policy.
• Browser SSH shows why a session couldn't open, such as SSH rules that don't allow the chosen user, instead of a spinner that never ends. A session that stalls while connecting now gives up after 30 seconds.
• Browser SSH works with SSH rules that use the check action on Headscale 0.29. The page links to the sign-in Headscale asks for, and the session opens once it's done.#591
• Browser SSH no longer opens a second SSH session right after the first one connects.
• Browser SSH no longer says it isn't available when Headplane can't reach its own public address, as happens behind some reverse proxies. The page checks for its files when it loads them instead.

• Single sign-on stays off until server.base_url is set to Headplane's public URL.
• Proxy rules that rewrite the Origin header, added as a workaround for 0.8.0, can be removed.

• Fixed several broken actions (such as creating auth keys) that began failing with "Bad Request" or "Unexpected Server Error" after Headplane 0.8.0 when sitting behind a reverse proxy that terminates TLS. If you added a proxy rule rewriting the Origin header as a workaround, it's safe to remove.#657#658
• Fixed a bug where the Add nameserver dialog would not show the Restrict to domain switch in the correct state when closing and reopening the dialog after adding or canceling a split DNS nameserver.#635
• Single sign-on no longer fails with "Unexpected Server Error" when server.base_url is missing. Headplane now logs a warning at startup and turns off single sign-on until server.base_url is set to Headplane's public URL.#585
• Logs now explain why a request to Headscale failed, such as Headscale being unreachable or rejecting the API key, instead of printing [object Object]. This covers signing in with an API key, linking an account after single sign-on, and agent syncs.#587#600
• Deleting a Headscale user that's linked to a Headplane account now unlinks the account. Previously the account kept pointing at the deleted user, showed its raw single sign-on ID instead of a name, and wasn't marked as Not linked.#625

• Building from source needs Go 1.27.1 or newer.

• Added a structured editor to the Access Control page with Rules and Tags & Groups tabs for editing acls, ssh, hosts, groups, and tagOwners without touching HuJSON. Sources and destinations are suggested from the groups, tags, hosts, and users in your tailnet. Nothing is applied until you press Save, and the file editor is still there for everything else. Editing through the structured editor drops comments from the policy, and Headplane warns you when that would happen.#607#608
• The Users page now shows which policy groups each user belongs to, and Edit groups in the row menu lets you change them (requires the write_policy permission).
• The machine tag dialog now flags tags that are missing from tagOwners, since Headscale accepts them but they never match any rule.
• Added config.oidc.jwks_endpoint to allow manually setting the JWKs keyset for OIDC.#620
• Docker images now publish floating minor version tags (e.g., 0.8) that always point to the latest patch release, so you can pin to a minor version in your docker-compose.yml.

• The footer now stacks on narrow screens instead of forcing the whole page to scroll sideways on phones.#648
• User pickers across Headplane, including the pre-auth key, new machine, change owner, and machine filter menus, are now sorted alphabetically to match the Users page.#622
• Long dropdown menus, such as the user and tag filters on the Machines page, now scroll instead of running off the screen.#621
• DNS records added from the UI now have leading and trailing whitespace trimmed from their name and value, which previously produced records that silently never resolved.#647
• Fixed being signed straight back in a few seconds after logging out when oidc.disable_api_key_login is enabled. The logged-out page now stays put across reloads and has a Sign in again button.#642
• Fixed the Authentication Restrictions link disappearing from Settings after a restart while signed in with an existing session.#645
• Fixed copying code, attributes, and machine addresses over plain HTTP, and added feedback when copying fails.#597
• Updated NPM & Go dependencies to fix vulnerabilities.
• Fixed the Native installation documentation as it was outdated and missing steps.#633

• Rebuilt the Browser SSH module to use Tailscale's tsconnect, which should result in fewer bugs and better compatibility with future Tailscale releases.
• Added integration.agent.tailscale_netns, an agent-only opt-out from Tailscale's routing-loop socket handling for deployments where its fallback pins the agent's Headscale connection to the wrong interface. Existing behavior remains enabled by default.
• Added a Disable/Enable key expiry action to the machine menu. Headscale does not keep the toggle state apart from the expiry date, so re-enabling expiry marks the node expired as of that moment.#554
• Headplane now supports Docker API version 1.24+ (Engine 1.12+, including Podman's Docker-compatible socket).
• Usernames are now validated before a user is created or renamed, so Headplane rejects names that Headscale accepts but ACL policy can never match.#502

• Fixed untagged Headscale builds being read as version 0.0.0. The per-commit main-* and development images report a Go pseudo-version from /version, which is now treated as an unknown version instead of an ancient one.#590
• Fixed the Browser SSH WASM module not building under Nix.#588
• Fixed server.data_path, headscale.config_path, headscale.dns_records_path and headscale.tls_cert_path being silently lowercased, which pointed Headplane at a different location for any path containing a capital letter.#612
• Fixed the Headplane agent falling back to an interactive Tailscale login. The agent now starts with a pre-auth-key, preserves its existing state across restarts, and auto-approves itself when Headscale requires manual approval.#582
• Fixed creating pre-auth keys with an expiry of 1000 days or more. The number input submitted its locale-formatted value (365,000, 365 000, 365.000), which either failed with a 500 or silently created a key with a truncated expiry. The raw value is now submitted and the server rejects malformed expiries with a 400.#596

• Headplane needs Headscale 0.27.0 or newer.
• The agent needs Headscale 0.28 and headscale.api_key, and creates its own pre-auth key. Remove integration.agent.pre_authkey and integration.agent.cache_path.
• oidc.headscale_api_key is now headscale.api_key. The old option still works, but is deprecated.
• Logs are JSON, one object per line. Update anything that parses them.
• Accounts are linked to Headscale users. Single sign-on accounts link by subject or email when they sign in. Accounts that don't match need linking by hand before they can create their own auth keys or use Browser SSH.

• Switched to structured JSON logging.#279
• Added suggestions to pick existing tags to the machine tag dialog.#560
• Headplane correctly handles dns.extra_records_path from the Headscale configuration.#543
• Fixed Headscale PostgreSQL config validation so pass is not required when password_file is supplied.#528
• Fixed Browser SSH's WASM DERP probe to account for custom DERP ports.#552
• Fixed Browser SSH pre-auth key handling by increasing the temporary key expiry window and showing key creation errors in the UI.#565
• Fixed machine rename submission by validating names before sending the rename request.#564
• Fixed OIDC token exchange fallback when retrying with client_secret_basic.#493
• Added support for proxy authentication via server.proxy_auth.#353
• Added automatic role assignment for new OIDC users via oidc.default_role and IdP-provided role claims via oidc.role_claim.#352
• Fixed the DNS page crashing when Headscale has no Split DNS nameservers configured.#570
• User lists now show Headscale display names while preserving usernames as secondary text.#571
• Fixed the Register Machine Key dialog so it accepts registration URLs and full hskey-authreq-... registration keys.#579
• Fixed assigning ACL tags to tag-only (no-user) nodes from the UI. The "Add" and "Remove" tag buttons in the tag dialog lacked type="button", so clicking them submitted the form before the local state update was applied and Headscale received the unchanged tag list. Tag modifications now reach Headscale as intended.#574

• oidc.redirect_uri is replaced by server.base_url. Headplane logs the value to use when it finds the old option.
• PKCE is opt-in. If the identity provider requires it, set oidc.use_pkce: true.
• Environment variables are always read, so remove HEADPLANE_LOAD_ENV_OVERRIDES. .env files are no longer loaded.
• Remove oidc.strict_validation. It has no effect.

• Added support for Headscale 0.28.0 including all API and data model changes.
• Added search and sortable columns to the machines list page.#351
• Added support for Headscale 0.27.0 and 0.27.1
• Bundle all node_modules aside from native ones to reduce bundle and container size.#331
• Allow conditionally compiling the SSH WASM integration when building.#337
• Implemented the ability to customize the build with a custom script (see ./build.sh --help for more information).
• Attempt to warn against misconfigured cookie settings on the login page.
• Made server.cookie_max_age and server.cookie_domain configurable.#348
• Re-worked the configuration loading system with several enhancements:
  • It is now possible to skip a configuration file and only use environment variables.#150
  • Secret path loading has been reworked from the ground up to be more reliable.#334
  • Added better testing and validation for configuration loading
• Re-worked the OIDC integration to adhere to the correct standards and surface more errors to the user.
  • Deprecated oidc.redirect_uri and automated callback URL detection in favor of setting server.base_url correctly.
  • Explicitly added oidc.use_pkce to correctly determine PKCE configuration.
  • oidc.token_endpoint_auth_method is now optional and will attempt to be auto-detected, defaulting to client_secret_basic if unavailable.#410
  • Added oidc.enabled config option to explicitly control OIDC availability.#463
• Removed several unnecessarily verbose or spammy log messages.
• Updated the minimum Docker API used to support the latest Docker versions.#370
• Enhanced the node tag dialog to show a dropdown of assignable tags.#362
• Fixed an issue where the website favicon would not load correctly.#323
• Correctly handle invalid ACL policy inserts on Headscale 0.27+.#383
• Prevent a machine from changing its owner to itself.#373
• Added an /admin/api/info route that can expose sensitive information if server.info_secret is set in the configuration.#324
• Correctly apply Gravatar profile pictures on the user page if applicable.#405
• Machine key registration no longer works if the key isn't 24 characters long.#415
• Fixed some mobile CSS issues across the application.#401
• Added a Docker healthcheck to the container.#411
• Strengthened the validation for the /proc integration to correctly discover the Headscale PID.
• Added lazy retry logic for OIDC providers if they initially fail to respond.#423
• Fixed API key login on Headscale 0.28.0-beta.1+.#429
• Fixed an issue that prevented the pre-auth-key UI from being usable on Headscale 0.28 and later.
• Added support for creating tag-only pre-auth keys on Headscale 0.28+.#465
• Pre-auth keys are now listed without a user filter on Headscale 0.28+, with a fallback to per-user fetching on older versions.#466
• Fixed handling of tag-only nodes that have no user on Headscale 0.28+.#467
• Adapted to the removal of Node Ownership Change in Headscale 0.28.#436
• Fixed pre-auth keys not showing for OIDC users without a username.#470
• Fixed truncated pre-auth key display with longer Headscale 0.28 bcrypt tokens.#435
• Fixed Nix systemd service to use user-specified package.#454
• Version displayed in the UI is now derived from git tags and build args instead of package.json, fixing incorrect versions shown on beta and nightly builds.
• Improved the no-access user page on the UI.#469

• Headplane keeps a database, hp_persist.db, in server.data_path. The directory has to be persistent and writable, such as a Docker volume. Existing users migrate on their own.
• The Docker image has no shell. For debugging, use the matching -shell tag, such as ghcr.io/tale/headplane:0.6.1-shell.

• Headplane now supports connecting to machines via SSH in the web browser.
  • This is an experimental feature and requires the integration.agent section to be set up in the config file.
  • This is built on top of a Go binary that runs in WebAssembly, using Xterm.js for the terminal interface.
• Begin using a new SQLite database file in /var/lib/headplane/hp_persist.db.
  • The database is created automatically if it does not exist.
  • It currently stores SSH connection details and HostInfo for the agent.
  • User information is automatically migrated from the previous database.
• The docker container now runs in a distroless image.#255
  • A debug version of the container that runs as root and has a shell is available as ghcr.io/tale/headplane:<version>-shell.
• Removing a Split DNS record will no longer make the split domain unresolvable by clients.#231
• Reintroduce the toggle for overriding local DNS settings in the Headscale config.#236
• Prefer cross-compiling in the Dockerfile to speed up builds while still supporting multiple architectures.
• Add a build attestation to validate SLSA provenance for the Docker image.
• Implement more accurate guessing on the PID with the /proc integration.#219
• Usernames will now correctly fall back to emails if not provided.#257
• Configuration loading via paths is now supported for sensitive values#283
  • Options like server.cookie_secret_path can override server.cookie_secret
  • Environment variables are interpolatable into these paths
  • See the full reference in the docs
• The nix overlay build is fixed for the SSH module#282
• Switch our build processes to use TypeScript Go and Rolldown Vite for better build and type-check performance.
• Cookies are now encrypted JWTs, preserving API key secrets (GHSA-wrqq-v7qw-r5w7)
• OIDC profile pictures are now available from Gravatar by setting oidc.profile_picture_source to gravatar.#232
• OIDC now allows passing many custom parameters:
  • oidc.authorization_endpoint, oidc.token_endpoint, and oidc.userinfo_endpoint can be overridden to support non-standard providers or scenarios without discovery.#117
  • oidc.scope can be set to specify custom scopes (defaults to openid email profile).
  • oidc.extra_params can be set to pass arbitrary query parameters to the authorization endpoint.#197

• Headplane needs Headscale 0.26.0 or newer.

• Headplane 0.6.0 now requires Headscale 0.26.0 or newer.

  • Breaking API changes with routes and pre auth keys are now supported.#204
  • Older versions of Headscale will not work with Headplane.

• OIDC authorization restrictions can now be controlled from the settings UI.#102

  • The required permission role for this is IT Admin or Admin/Owner and require the Headscale configuration.
  • Changes made will modify the oidc.allowed_{domains,groups,users} fields in the Headscale config file.

• The Pre-Auth keys page has been fully reworked.#179#143

• The Headplane agent is now available as an integration.#65

  • The agent runs as an embedded process alongside the Headplane server and reports host information and system metrics.
  • Refer to the integrations.agent section of the config file for more information and how to enable it.

• Requests to /admin will now be redirected to /admin/ to prevent issues with the React Router (works with custom prefixes, closes #173).

• The Login page has been simplified and separately reports errors versus incorrect API keys.#186

• The machine actions backend has been reworked to better handle errors and provide more information to the user.#185

• Machine tags now show states when waiting for subnet or exit node approval and when expiry is disabled.

• Expiry status on the UI was incorrectly showing as never due to changes in the Headscale API.

• Added validation for machine renaming to prevent invalid submissions.#192

• Unmanaged (non-OIDC) users cannot have a role assigned to them so the menu option was disabled.

• Support Docker container discovery through labels.#194

• AAAA records are now supported on the DNS page.#189

• Add support for dns.extra_records_path in the Headscale config.#144

• Tighten proc integration logic by checking for the headscale serve command.#195

• Strip newlines in the OIDC client_secret_path file if provided.#199

• Single sign-on accounts get roles. New accounts start as members with no dashboard access, and the first person to sign in becomes the owner, so sign in right after upgrading to claim the owner account.

IMPORTANTCopy Anchor Link

PLEASE update to this ASAP if you were using Google OIDC. This is because previously ANY accounts have admin access to your Tailnet if they discover the URL that Headplane is being hosted on. This new change enforces that new logins by default are not given any permissions. You will need to re-login to Headplane to generate an owner account and prevent unauthorized access.

Implemented proper authentication methods for OIDC. This is a large update and copies the permission system from Tailscale. Permissions are not automatically derived from OIDC, but they can be configured via the UI. Additionally, certain roles give certain capabilities, limiting access to parts of the dashboard. By default, new users will have a member role which forbids access to the UI. If there are no users, the first user will be given an owner role which cannot be removed.

Changes:

• Switched the internal server to use hono for better performance.
• Fixed an issue that caused dialogs to randomly refocus every 3 seconds.
• Headplane will not send API requests when the tab is not focused.
• Continue loosening the configuration requirements for Headscale (part of an ongoing effort).
• Unknown values in the Headplane config no longer cause a crash.
• Fixed an issue that caused copied commands to have a random space (fixes #161)

• Settings moved from environment variables to a config file. Start from config.example.yaml. Settings that used to be shared with Headscale, such as public_url and oidc, are now separate.

• Completely redesigned the UI from the ground up for accessibility and performance.
• Switched to a config-file setup (this introduces breaking changes, see config.example.yaml for the new format).
• If the config is read-only, the options are still visible, just disabled (fixes #48)
• Added support for Headscale 0.25.0 (this drops support for any older versions).
• Fixed issues where renaming, deleting, and changing node owners via users was not possible (fixes #91)
• Operations now have significantly less moving parts and better error handling.
• Updated to pnpm 10 and Node.js 22.
• Settings that were previously shared like public_url or oidc are now separate within Headplane/Headscale. This is a rather large breaking change but fixes cases where a user may choose to utilize Headscale OIDC for Tailscale but not for the Headplane UI.
• Deprecate the latest tag in Docker for explicit versioning and edge for nightly builds.