From 13a041b1746da698ea4e1ad5994c42a817403170 Mon Sep 17 00:00:00 2001
From: Andrey Albershteyn <aalbersh@kernel.org>
Date: Mon, 21 Jul 2025 14:08:52 +0200
Subject: [PATCH] headscale: support PKCE verifier

The headscale 0.24.0 introduced support for PKCE verifier. Add options
to set these parameters in the config.
---
 .../modules/services/networking/headscale.nix | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/nixos/modules/services/networking/headscale.nix b/nixos/modules/services/networking/headscale.nix
index 33336ebdd119..4291eae7f4f8 100644
--- a/nixos/modules/services/networking/headscale.nix
+++ b/nixos/modules/services/networking/headscale.nix
@@ -406,6 +406,31 @@ in
                 '';
                 example = [ "alice@example.com" ];
               };
+
+              pkce = {
+                enabled = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = ''
+                    Enable or disable PKCE (Proof Key for Code Exchange) support.
+                    PKCE adds an additional layer of security to the OAuth 2.0
+                    authorization code flow by preventing authorization code
+                    interception attacks
+                    See https://datatracker.ietf.org/doc/html/rfc7636
+                  '';
+                  example = true;
+                };
+
+                method = lib.mkOption {
+                  type = lib.types.str;
+                  default = "S256";
+                  description = ''
+                    PKCE method to use:
+                      - plain: Use plain code verifier
+                      - S256: Use SHA256 hashed code verifier (default, recommended)
+                  '';
+                };
+              };
             };
 
             tls_letsencrypt_hostname = lib.mkOption {