From 184200299d80b94a833380b5509271cf19ee38f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= <valknar@pivoine.art>
Date: Sun, 16 Aug 2026 16:32:21 +0200
Subject: [PATCH] feat(traefik): route *.falcon.pivoine.art to apps on falcon
 over Tailscale

Falcon (home machine) stays off the public internet; the VPS Traefik
terminates TLS/ACME as usual and forwards to falcon's tailnet IP.
---
 traefik/dynamic/falcon.yaml | 38 +++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 traefik/dynamic/falcon.yaml

diff --git a/traefik/dynamic/falcon.yaml b/traefik/dynamic/falcon.yaml
new file mode 100644
index 0000000..fb8763a
--- /dev/null
+++ b/traefik/dynamic/falcon.yaml
@@ -0,0 +1,38 @@
+# Routes for apps running on the local machine "falcon", reached over the
+# Tailscale/Headscale mesh (falcon's tailnet IP: 100.64.0.1). DNS for
+# *.falcon.pivoine.art points here (the VPS), which terminates TLS and
+# forwards over the tunnel — falcon itself is never exposed directly.
+#
+# To add another app: duplicate the <name>-web / <name>-web-secure routers
+# and the service block below, swap the hostname and backend port.
+
+http:
+  middlewares:
+    triggershell-redirect-web-secure:
+      redirectScheme:
+        scheme: https
+
+  routers:
+    triggershell-web:
+      rule: "Host(`triggershell.falcon.pivoine.art`)"
+      entrypoints:
+        - web
+      middlewares:
+        - triggershell-redirect-web-secure
+      service: triggershell
+
+    triggershell-web-secure:
+      rule: "Host(`triggershell.falcon.pivoine.art`)"
+      entrypoints:
+        - web-secure
+      tls:
+        certResolver: resolver
+      middlewares:
+        - security-headers@file
+      service: triggershell
+
+  services:
+    triggershell:
+      loadBalancer:
+        servers:
+          - url: "http://100.64.0.1:4173"