From db5c0250d640b1e83d7ac9f6e097781ffc8b0396 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= Date: Sun, 30 Aug 2026 10:23:26 +0000 Subject: [PATCH] fix(traefik): trust coolify network in vpn-only allowlist Traefik is joined to both falcon_network and the coolify network, and Docker masquerades externally-arriving connections through whichever of the two ends up handling NAT - including genuine tailnet traffic, which was surfacing as the coolify bridge gateway (172.19.0.1) instead of the real tailnet source IP. That made vpn-only reject legitimate requests from falcon and other tailnet clients to pulsenode and triggershell with a 403, even though they were correctly connecting over the tunnel. Extend the same trust already given to falcon_network (172.18.0.0/16) to the coolify network (172.19.0.0/16). --- traefik/dynamic/security.yaml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/traefik/dynamic/security.yaml b/traefik/dynamic/security.yaml index dbf65bf..e973067 100644 --- a/traefik/dynamic/security.yaml +++ b/traefik/dynamic/security.yaml @@ -45,15 +45,22 @@ http: burst: 15 period: 1s # Only let traffic through whose source IP is inside the Tailscale/Headscale - # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network itself - # (172.18.0.0/16) - the latter so containers on our own internal docker - # network (e.g. pulsenode calling this router directly to reach - # api@internal) count as trusted the same way a tailnet peer does. Public - # DNS can still resolve these hostnames, but anyone reaching them over the - # open internet gets a 403. + # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network/coolify + # (172.18.0.0/16, 172.19.0.0/16) - the latter two so containers on our own + # internal docker networks (e.g. pulsenode calling this router directly to + # reach api@internal) count as trusted the same way a tailnet peer does. + # Traefik is also joined to the coolify network (for routing to + # Coolify-managed containers), and Docker masquerades externally-arriving + # connections - including real tailnet traffic - through whichever of + # Traefik's networks ends up handling NAT, which can surface as the + # coolify bridge gateway (172.19.0.1) instead of the real source IP. So + # 172.19.0.0/16 needs the same trust as 172.18.0.0/16 for tailnet clients + # to reliably reach vpn-only routes. Public DNS can still resolve these + # hostnames, but anyone reaching them over the open internet gets a 403. vpn-only: ipAllowList: sourceRange: - "100.64.0.0/10" - "fd7a:115c:a1e0::/48" - "172.18.0.0/16" + - "172.19.0.0/16"