valknar/stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(headscale): add MagicDNS override for pulsenode.pivoine.art

Browse Source 
vpn-only (the ipAllowList middleware pulsenode now uses) checks the
connection's source IP, but being on the tailnet doesn't reroute
traffic to a normal public DNS hostname through the tunnel - Tailscale
only reroutes destinations it actually knows about. pulsenode.pivoine.art
had no such record, so it always resolved publicly for everyone,
tailnet or not, and Traefik never saw a tailnet-range source IP to
allow. Same fix already in place for triggershell.falcon.pivoine.art:
an extra_records override served only over MagicDNS, pointing to the
VPS's own tailnet IP so tailnet clients' connections actually traverse
the tunnel and satisfy the allowlist.
This commit is contained in:
valknar
2026-08-17 16:02:29 +02:00
parent 318f48036d
commit d7ba6ec040
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
headscale/config.yaml
+7 -3
View File
@@ -57,14 +57,18 @@ dns:
- 1.1.1.1 - 1.1.1.1
- 1.0.0.1 - 1.0.0.1
search_domains: [] search_domains: []
# Served only to tailnet clients via MagicDNS: overrides falcon.pivoine.art # Served only to tailnet clients via MagicDNS: overrides these hostnames to
# app hostnames to resolve to the VPS's tailscale IP instead of its public # resolve to the VPS's own tailscale IP (100.64.0.3) instead of its public
# one, so VPN-connected clients route straight over the tunnel and satisfy # one, so VPN-connected clients route straight over the tunnel and satisfy
# Traefik's falcon-vpn-only IP allowlist. # Traefik's vpn-only IP allowlist. Anyone not on the tailnet still gets the
# normal public DNS record and hits the same allowlist from outside it.
extra_records: extra_records:
- name: "triggershell.falcon.pivoine.art" - name: "triggershell.falcon.pivoine.art"
type: "A" type: "A"
value: "100.64.0.3" value: "100.64.0.3"
- name: "pulsenode.pivoine.art"
type: "A"
value: "100.64.0.3"
# TLS is terminated by Traefik; headscale itself serves plain HTTP internally. # TLS is terminated by Traefik; headscale itself serves plain HTTP internally.
tls_letsencrypt_hostname: "" tls_letsencrypt_hostname: ""