From d7ba6ec040dbca8f58a49f28c849cebd4683d8b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= Date: Mon, 17 Aug 2026 16:02:29 +0200 Subject: [PATCH] fix(headscale): add MagicDNS override for pulsenode.pivoine.art vpn-only (the ipAllowList middleware pulsenode now uses) checks the connection's source IP, but being on the tailnet doesn't reroute traffic to a normal public DNS hostname through the tunnel - Tailscale only reroutes destinations it actually knows about. pulsenode.pivoine.art had no such record, so it always resolved publicly for everyone, tailnet or not, and Traefik never saw a tailnet-range source IP to allow. Same fix already in place for triggershell.falcon.pivoine.art: an extra_records override served only over MagicDNS, pointing to the VPS's own tailnet IP so tailnet clients' connections actually traverse the tunnel and satisfy the allowlist. --- headscale/config.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/headscale/config.yaml b/headscale/config.yaml index 31d0b76..7cbbbe9 100644 --- a/headscale/config.yaml +++ b/headscale/config.yaml @@ -57,14 +57,18 @@ dns: - 1.1.1.1 - 1.0.0.1 search_domains: [] - # Served only to tailnet clients via MagicDNS: overrides falcon.pivoine.art - # app hostnames to resolve to the VPS's tailscale IP instead of its public + # Served only to tailnet clients via MagicDNS: overrides these hostnames to + # resolve to the VPS's own tailscale IP (100.64.0.3) instead of its public # one, so VPN-connected clients route straight over the tunnel and satisfy - # Traefik's falcon-vpn-only IP allowlist. + # Traefik's vpn-only IP allowlist. Anyone not on the tailnet still gets the + # normal public DNS record and hits the same allowlist from outside it. extra_records: - name: "triggershell.falcon.pivoine.art" type: "A" value: "100.64.0.3" + - name: "pulsenode.pivoine.art" + type: "A" + value: "100.64.0.3" # TLS is terminated by Traefik; headscale itself serves plain HTTP internally. tls_letsencrypt_hostname: ""