fix(traefik): trust coolify network in vpn-only allowlist

Traefik is joined to both falcon_network and the coolify network, and
Docker masquerades externally-arriving connections through whichever
of the two ends up handling NAT - including genuine tailnet traffic,
which was surfacing as the coolify bridge gateway (172.19.0.1) instead
of the real tailnet source IP. That made vpn-only reject legitimate
requests from falcon and other tailnet clients to pulsenode and
triggershell with a 403, even though they were correctly connecting
over the tunnel. Extend the same trust already given to falcon_network
(172.18.0.0/16) to the coolify network (172.19.0.0/16).

traefik/dynamic/security.yaml

@@ -45,15 +45,22 @@ http:
         burst: 15
         period: 1s
     # Only let traffic through whose source IP is inside the Tailscale/Headscale
-    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network itself
+    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network/coolify
-    # (172.18.0.0/16) - the latter so containers on our own internal docker
+    # (172.18.0.0/16, 172.19.0.0/16) - the latter two so containers on our own
-    # network (e.g. pulsenode calling this router directly to reach
+    # internal docker networks (e.g. pulsenode calling this router directly to
-    # api@internal) count as trusted the same way a tailnet peer does. Public
+    # reach api@internal) count as trusted the same way a tailnet peer does.
-    # DNS can still resolve these hostnames, but anyone reaching them over the
+    # Traefik is also joined to the coolify network (for routing to
-    # open internet gets a 403.
+    # Coolify-managed containers), and Docker masquerades externally-arriving
+    # connections - including real tailnet traffic - through whichever of
+    # Traefik's networks ends up handling NAT, which can surface as the
+    # coolify bridge gateway (172.19.0.1) instead of the real source IP. So
+    # 172.19.0.0/16 needs the same trust as 172.18.0.0/16 for tailnet clients
+    # to reliably reach vpn-only routes. Public DNS can still resolve these
+    # hostnames, but anyone reaching them over the open internet gets a 403.
     vpn-only:
       ipAllowList:
         sourceRange:
           - "100.64.0.0/10"
           - "fd7a:115c:a1e0::/48"
           - "172.18.0.0/16"
+          - "172.19.0.0/16"