vpn-only (the ipAllowList middleware pulsenode now uses) checks the
connection's source IP, but being on the tailnet doesn't reroute
traffic to a normal public DNS hostname through the tunnel - Tailscale
only reroutes destinations it actually knows about. pulsenode.pivoine.art
had no such record, so it always resolved publicly for everyone,
tailnet or not, and Traefik never saw a tailnet-range source IP to
allow. Same fix already in place for triggershell.falcon.pivoine.art:
an extra_records override served only over MagicDNS, pointing to the
VPS's own tailnet IP so tailnet clients' connections actually traverse
the tunnel and satisfy the allowlist.
valknar
d7ba6ec040