diff --git a/modules/nixos/clicks/services/headscale/README.md b/modules/nixos/clicks/services/headscale/README.md
new file mode 100644
index 0000000..fd5cc1a
--- /dev/null
+++ b/modules/nixos/clicks/services/headscale/README.md
@@ -0,0 +1,78 @@
+<!--
+SPDX-FileCopyrightText: 2024 Clicks Codes
+
+SPDX-License-Identifier: GPL-3.0-only
+-->
+
+# Clicks Headscale
+
+Our module provides much more basic options than the NixOS headscale module, but we believe this saves you some of the
+hassle of configuring it.
+
+```nix
+clicks.services.headscale = {
+  enable = true;
+  url = "clicks.domains";
+};
+```
+
+The `url` is both the address you'll use to access your headscale server, as well as the base address that devices are
+suffixed with (e.g. a device called `albatross` owned by `minion` would become `albatross.minion.<url>`)
+
+---
+
+```nix
+clicks.services.headscale = {
+  addr = "0.0.0.0";
+  port = 80;
+};
+```
+
+By default, we host on port 80 without using SSL. We expect you to host a reverse proxy server, such as caddy or nginx
+to remedy this. To that end, your base URL *must* be accessible only over https.
+
+If you keep the default `0.0.0.0` address, we'll also open the port you set.
+
+These defaults will change when we have an nginx module, as the headscale module will automatically create a route.
+
+---
+
+```nix
+clicks.services.headscale = {
+  oidc = {
+    enable = true;
+    issuer = "https://login.clicks.codes/realms/master";
+    allowed_groups = [ "/clicks" ];
+    client_id = "headscale";
+    client_secret_path = config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.a1d1.json}".paths.oidc_client_secret;
+  };
+};
+```
+
+If you have an OIDC server, we strongly recommend using it. It allows you to automatically create users and provision
+devices rather than needing to use the command line to do so.
+
+If you're using keycloak and want to use `allowed_groups`, you'll need to create a group membership mapper with the
+name `groups`. If you set "full group path" to enabled in Keycloak, you'll also need to prefix the group with a leading
+`/`. (We recommend you do this, as not doing it will mean that other groups could be unintentionally matched, for example
+`admins` would match `/clicks/admins` and `/transplace/admins`)
+
+The secret specified in your `client_secret_path` must be readable by the `headscale` group.
+
+---
+
+```nix
+clicks.services.headscale = {
+  database_password_path = config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.a1d1.json}".paths.database_password;
+  noise_private_key_path = config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.a1d1.json}".paths.noise_private_key;
+  private_key_path = config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.a1d1.json}".paths.private_key;
+}
+```
+
+Finally, we have a few more secrets: the database_password_path, the noise_private_key_path, and the private_key_path.
+
+The "noise private key" and "private key" are generated by tailscale at launch if you don't specify them.
+
+The database password need not match an existing database; the headscale module automatically provisions the database using the Clicks Postgres module.
+
+All of these secrets must be readable by the `headscale` group.
diff --git a/modules/nixos/clicks/services/headscale/default.nix b/modules/nixos/clicks/services/headscale/default.nix
new file mode 100644
index 0000000..84be617
--- /dev/null
+++ b/modules/nixos/clicks/services/headscale/default.nix
@@ -0,0 +1,118 @@
+# SPDX-FileCopyrightText: 2024 Clicks Codes
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+{ lib, config, ... }:
+let
+  cfg = config.clicks.services.headscale;
+in
+{
+  options.clicks.services.headscale = {
+    enable = lib.mkEnableOption "The headscale control server for tailscale";
+    url = lib.mkOption {
+      type = lib.types.str;
+      description = "The url users should connect to to register a new device";
+    };
+    addr = lib.mkOption {
+      type = lib.types.str;
+      description = "Where to host headscale";
+      default = "0.0.0.0";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      description = "Port to host headscale on";
+      default = 80;
+    };
+    oidc = {
+      enable = lib.mkEnableOption "Enable OIDC";
+      issuer = lib.mkOption {
+        type = lib.types.str;
+        description = "Issuer URL for your OIDC provider";
+      };
+      allowed_groups = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.str);
+        description = "List of groups to allow authentication from";
+      };
+      client_id = lib.mkOption {
+        type = lib.types.str;
+        description = "Client ID";
+        default = "headscale";
+      };
+      client_secret_path = lib.mkOption {
+        type = lib.types.str;
+        description = "Client secret file path";
+      };
+    };
+    database_password_path = lib.mkOption {
+      type = lib.types.str;
+      description = "Database password file path";
+    };
+    noise_private_key_path = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = "Noise private key file path";
+      default = null;
+    };
+    private_key_path = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = "Headscale private key file path";
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    clicks = {
+      services.postgres.enable = true;
+      services.postgres.databases.headscale = cfg.database_password_path;
+      services.postgres.secretRequiredGroups = [ "headscale" ];
+    };
+
+    services.headscale = {
+      enable = true;
+
+      address = cfg.addr;
+      port = cfg.port;
+
+      settings.db_type = "postgres";
+      settings.db_port = config.services.postgresql.settings.port;
+      settings.db_user = "headscale";
+      settings.db_password_file = cfg.database_password_path;
+      settings.db_name = "headscale";
+      settings.db_host = lib.clicks.constants.hosts.standard;
+
+      settings.server_url = "https://${cfg.url}";
+
+      settings.ip_prefixes = "100.64.0.0/10";
+
+      settings.noise.private_key_path = lib.mkIf (
+        cfg.noise_private_key_path != null
+      ) cfg.noise_private_key_path;
+      settings.private_key_path = lib.mkIf (cfg.private_key_path != null) cfg.private_key_path;
+
+      settings.dns_config = {
+        nameservers = [
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
+        override_local_dns = true;
+        base_domain = cfg.url;
+      };
+
+      settings.oidc = lib.mkIf cfg.oidc.enable {
+        only_start_if_oidc_is_available = true;
+
+        issuer = cfg.oidc.issuer;
+
+        client_id = cfg.oidc.client_id;
+        client_secret_path = cfg.oidc.client_secret_path;
+
+        allowed_groups = lib.mkIf (cfg.oidc.allowed_groups != null) cfg.oidc.allowed_groups;
+        strip_email_domain = true;
+      };
+    };
+
+    systemd.services.headscale.requires = [ "postgresql.service" ];
+    systemd.services.headscale.after = [ "postgresql.service" ];
+
+    networking.firewall.allowedTCPPorts = lib.mkIf (cfg.addr == "0.0.0.0") [ cfg.port ];
+  };
+}
diff --git a/systems/x86_64-linux/a1d1/default.nix b/systems/x86_64-linux/a1d1/default.nix
index cd71bbf..11e6f04 100644
--- a/systems/x86_64-linux/a1d1/default.nix
+++ b/systems/x86_64-linux/a1d1/default.nix
@@ -3,7 +3,13 @@
 #
 # SPDX-License-Identifier: GPL-3.0-only
 
-{ pkgs, modulesPath, ... }:
+{
+  pkgs,
+  modulesPath,
+  lib,
+  config,
+  ...
+}:
 {
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
@@ -26,6 +32,23 @@
 
     services = {
       ssh.enable = true;
+      headscale = {
+        enable = true;
+        url = "clicks.domains";
+        oidc = {
+          enable = true;
+          issuer = "https://login.clicks.codes/realms/master";
+          allowed_groups = [ "/clicks" ];
+          client_secret_path =
+            config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.json}".paths.oidc_client_secret;
+        };
+        database_password_path =
+          config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.json}".paths.database_password;
+        noise_private_key_path =
+          config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.json}".paths.noise_private_key;
+        private_key_path =
+          config.clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.json}".paths.private_key;
+      };
     };
 
     storage = {
@@ -73,4 +96,16 @@
   networking.useDHCP = true;
 
   system.stateVersion = "24.05";
+
+  clicks.secrets."${lib.clicks.secrets.name ./headscale.sops.json}" = {
+    file = ./headscale.sops.json;
+    group = "headscale";
+    keys = [
+      "oidc_client_secret"
+      "database_password"
+      "noise_private_key"
+      "private_key"
+    ];
+    neededForUsers = false;
+  };
 }
diff --git a/systems/x86_64-linux/a1d1/headscale.sops.json b/systems/x86_64-linux/a1d1/headscale.sops.json
new file mode 100644
index 0000000..881718b
--- /dev/null
+++ b/systems/x86_64-linux/a1d1/headscale.sops.json
@@ -0,0 +1,39 @@
+{
+	"oidc_client_secret": "ENC[AES256_GCM,data:du4NPJBtH/x/vgybMf7RgLQqt0GdLfG27IFv20bvxQM=,iv:LW2fCg2cR8bB5DNLYW7wxgTYJM9ox0BHlQVRDYF07T4=,tag:v8nh7QkC86rQNpEc3Y9Wlw==,type:str]",
+	"private_key": "ENC[AES256_GCM,data:qfg5g4YC6fZ4jEROcbnXXxWfyuVbZK7ZFOzPJRHY3uTkmlReXPYVnlUlrPSappak/TkPvpKr5gfu8IWB9TVZ385Eg77Gzs3f,iv:CQRfNWdXwVcAETgQ7LWGVoZJ2YF/9X8r8yHP8OhKXf0=,tag:Yg3AYEEjbvOD8JvKhRURJg==,type:str]",
+	"noise_private_key": "ENC[AES256_GCM,data:8tMPzIRwgO8YR0RoRne6Difn1F/p3GRHAsRWtcxP3EEo6l10TkCrfVu9H+PirRp4X813QAR8Awb2raXsPULh/Ks0AV2zD3KI,iv:r6JXp0pI7rFbihtVZNgbHgcKooA2/ejSsCrfFBPYzaA=,tag:inccJyxd+ZP/D4gwr8RFFg==,type:str]",
+	"database_password": "ENC[AES256_GCM,data:3bucm72144uHrkKzBQShV78smdM=,iv:BKP8HlH1J6iF+oL8iiyFfK4oaEMJZB7AtCXhuHfJNfk=,tag:IJRzlNAcFbv0ztGl2XHVDw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": null,
+		"lastmodified": "2024-06-08T22:46:01Z",
+		"mac": "ENC[AES256_GCM,data:jAH8yiFPnfu8uW6rPnE5KBjD0S8/64TUxh0lfgQ9t6bXYCbdc3iEY6f9O4Ytc+IAh6lxyHQPuHMtBbKHOLL1P1wc492rSaLlbgTe5lItmoAMqT0hyTDv42rY2X/pmj7jXyEvCqNw2c7bMMpv3MF70mwW+G517bTNptn7GQpG0u4=,iv:M35BmeazOqhnB36CDTLsna0cuNra+l7zD+JOonMkLrg=,tag:shyZ6vDIpftOJwl5xf+0rw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2024-06-08T19:13:02Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhF4D6MHlIv4I/7ASAQdAApSEfHKLoIJg1WEUq3ZT0BrEUXp/53Oxg2pIOxEuDDgw\n7eKpufVyBr+0wxpMwYy/+g96i7k/5Degd5guwRraW5ToIZ9hC7Z61HTyjydbIfq1\n0lwBy8hlAEk4fwcsAxK0l5Xz+dQhF4Te7oRbERyzzygNYnfYr/ozpKK7aJSRx3FG\nuMgTs0DjyczKuv4LOAVyzLRaeRV1JFaAlEvXQ/DIc8OZvGyqTNEZ9YPeoA1m+A==\n=99Na\n-----END PGP MESSAGE-----",
+				"fp": "BC82DF237610AE9113EB075900E944BFBE99ADB5"
+			},
+			{
+				"created_at": "2024-06-08T19:13:02Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DxpBiwsu2o5wSAQdArUJbHBn3ldJS71e6Gfup7NawEvziU4tZQpPsCVLCjFww\neKakVSlHipeoNAqtMYKKzYK94kWPvk/4/8001oLyP89hO2k+3Nys42ARD8Pcnr6n\n0lwBw9WCRVqGUd0s09LDnnwqdAAVvYTw0duyaOqt8jsdj63B0b7TedbMgjYg8H4p\nD42iwa21FcnVD1+h5MYAXgyQrI/F8zK005e0Cp+ZYNyPafVg6DT4qhaysllzaQ==\n=Wcg5\n-----END PGP MESSAGE-----",
+				"fp": "76E0B09A741C4089522111E5F27E3E5922772E7A"
+			},
+			{
+				"created_at": "2024-06-08T19:13:02Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA9bzf+GUl7kkARAAlgpNcSOKCxpK442mG1c/L+P4lT1wZ+XlR6oYlTX0U1/M\n1a08upxNiYsTHbCV82PpEvAYTIydY8fgS16mUQWcvXXEu/3vgT66Kb5yw5AzZPjG\n8OFM9EgFImGMxUpr67qUJ4IgiofRTtTvtcVBgFAmK471nI//MZpwoUtQTrrVuAQa\nLuUCFtjb4d1/lHieeXFTsH0LFk25gyQAByTJ5iJVVOerNFHt7DY5Wa2m9cJL/6Xb\nrK8AFrjdendd9MKWo7TRdSiQyDYF10ZBe0vungTK7Yemy8RzYcHdz8fDHJvwS8pB\nrDl+VzgJwxnxXrIcbfrSQp7OTRiRT0ANCdF+qspmrqShUuDsCwPIusWJDxBPm7ab\ntiBmsLszakPk6LtYCc7cNyiBJOhLuR1tB7VEO5Ti2AIP5x5HHW86YbE6Nlzgamsa\nRMpPrINCNd0gP4TDkSmJdUA3yqS+GRqt/e0IECIfw9/rTI2X4hcBK8yFG2M6+YAs\no7cIQSmOWWJnfKrapKUZbSiTLdEXTxkGCrNIMrzGu6bLJvg3+qVF+cfaGXdqvwwc\n1pnYf/WRMHwO4DnZ8NUD4Pa7R/C40oB3ejbgcb9dXyt385WvKXQ6c95Winj6j9U7\n/AqT036CcEE0nqu9j4MY5/sCuTeZOODptrRLRbzeCFUruJ3RJACokhaU+R9dh0nS\nXAF76H99O1zYauHDjnVZUSPvkEZhaO+qvcJrK6cRDlWCSnP0e/uNH5jW1mMJeX0Z\n5g7WMFVVozjIvHySwIacUkDqIoibFK2Y2RI2TJ0vZeOXvKUhU6TWkaSlOM1Z\n=GX8j\n-----END PGP MESSAGE-----",
+				"fp": "8F50789F12AC6E6206EA870CE5E1C2D43B0E4AB3"
+			},
+			{
+				"created_at": "2024-06-08T19:13:02Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAw8Caq2TdS1qAQ/8DBFRc7DDXOUcZsfWVCaxNI78i6xvwzyDcHfuHyb+X8jO\nX0ITghV1JpWVpSpDKqLH+bRpzVyLnZkEDg5nixDYvLCmDz3Mnnsmw7YLf6tsKmog\nQ3lK9bKSECjoO/EW7CzczUj4YUCfUCP2vwANVLb+T94wL9NN+KL4F8tWVRJjb88M\nxTAZzVa8Fq21HXSFxZz8HiFNczxO018e6mqdH/a+46UMviO5PbjhYCj2ysGXPkoZ\nrIVMVnosNBtk2I8rsrtSMcNihutX9dLhaKCGcl/D85ZProXTdHa0BpXX+ZZvh0gX\nR63XfrNtzpRBwRYwFbR1AZP3bu05j+yewWJKIUrHEWU0ADbHUg6x2Goja2eTSBls\nETZRHgenAKke/8WyK7bDEqjKgeZZN6/QVgy8/kvxAT+hui2M/IzfSkQK64wiN5pR\nFOrkLckqgiwTlu6tlxwdAZNE/OYh/KRi+rjKMUVdMtAO4DY9Q/wWnwOMlNP5us4i\nkyUEuGQW2jpeDG++IuMTUHEu07ei7NlZXTpvRUIUh4upMQsow/mFqIec0co922Ba\n9eD9PkPN0a5r8RXRKvRBaDZTD533bDApqFXHeSDBE7M4GgywTD6fixRnrXh49HLo\nxUtdtAJRHeYsLfEuJFtoSFfjQ2IIB32bv2FSyo/Cky9gkVYxHcfkRlWRiUr8mDbS\nVgHrkYm0b3o+437gMXR23sp4qf2OyrhtxhaO9KN5fT36nqlAhg6i5l5k0SP19OsT\nBWPD3HqB81LHe0JKoBXPhH0+bnXJhQeYfmly9tfd1Ha0+EAbzSnp\n=H/it\n-----END PGP MESSAGE-----",
+				"fp": "67c66d58ac73fd744c2b49720f026aad93752d6a"
+			}
+		],
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
\ No newline at end of file
diff --git a/systems/x86_64-linux/a1d1/headscale.sops.json.license b/systems/x86_64-linux/a1d1/headscale.sops.json.license
new file mode 100644
index 0000000..bda0f14
--- /dev/null
+++ b/systems/x86_64-linux/a1d1/headscale.sops.json.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2024 Clicks Codes
+
+SPDX-License-Identifier: GPL-3.0-only