diff --git a/core/installer/values-tmpl/headscale-user.jsonschema b/core/installer/values-tmpl/headscale-user.jsonschema
new file mode 100644
index 0000000..e4884a6
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-user.jsonschema
@@ -0,0 +1,14 @@
+{
+  "type": "object",
+  "properties": {
+    "Username": { "type": "string" },
+	"PreAuthKey": {
+	  "type": "object",
+	  "properties": {
+	    "Enabled": { "type": "boolean" }
+	  },
+	  "additionalProperties": false
+	}
+  },
+  "additionalProperties": false
+}
diff --git a/core/installer/values-tmpl/headscale-user.md b/core/installer/values-tmpl/headscale-user.md
new file mode 100644
index 0000000..7246082
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-user.md
@@ -0,0 +1 @@
+Creates Headscale user resource
diff --git a/core/installer/values-tmpl/headscale-user.yaml b/core/installer/values-tmpl/headscale-user.yaml
new file mode 100644
index 0000000..0eca8d0
--- /dev/null
+++ b/core/installer/values-tmpl/headscale-user.yaml
@@ -0,0 +1,20 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: user-{{ .Values.Username }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  chart:
+    spec:
+      chart: charts/headscale-user
+      sourceRef:
+        kind: GitRepository
+        name: pcloud
+        namespace: {{ .Global.Id }}
+  interval: 1m0s
+  values:
+    username: {{ .Values.Username }}
+    headscaleApiAddress: http://headscale-api.{{ .Global.Id }}-app-headscale.svc.cluster.local
+    preAuthKey:
+      enabled: {{ .Values.PreAuthKey.Enabled }}
+      secretName: {{ .Values.Username }}-headscale-preauthkey
diff --git a/core/installer/values-tmpl/tailscale-proxy.yaml b/core/installer/values-tmpl/tailscale-proxy.yaml
index 1774f1e..904f850 100644
--- a/core/installer/values-tmpl/tailscale-proxy.yaml
+++ b/core/installer/values-tmpl/tailscale-proxy.yaml
@@ -16,7 +16,7 @@
         namespace: {{ .Global.Id }}
   interval: 1m0s
   values:
-    hostname: {{ .Global.Id }}-{{ .Values.HostnameSuffix }}
+    hostname: {{ .Values.Hostname}}
     apiServer: http://headscale-api.{{ .Global.Id }}-app-headscale.svc.cluster.local
     loginServer: https://headscale.{{ .Global.Domain }} # TODO(gio): take headscale subdomain from configuration
     ipSubnet: {{ .Values.IPSubnet }}