Traefik is joined to both falcon_network and the coolify network, and
Docker masquerades externally-arriving connections through whichever
of the two ends up handling NAT - including genuine tailnet traffic,
which was surfacing as the coolify bridge gateway (172.19.0.1) instead
of the real tailnet source IP. That made vpn-only reject legitimate
requests from falcon and other tailnet clients to pulsenode and
triggershell with a 403, even though they were correctly connecting
over the tunnel. Extend the same trust already given to falcon_network
(172.18.0.0/16) to the coolify network (172.19.0.0/16).
valknar
db5c0250d6