admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: node inventory for the two-host fleet; demo-hp on the tailnet

Browse Source 
New documentation/operations/nodes.md: HP t740 hardware, disks (SanDisk system
SSD 182195804614; Toshiba 1TB NVMe 58BS11AFT8MQ PRESENT AND UNENROLLED, still
NTFS, do not touch), the five-NIC map and the trap that cost the first install,
and the access path - no SSH key is baked, auth is the hub-vaulted G1
break-glass password.

tailscale.md gains demo-hp, the operator-lab-exception warning so a future
product-shape audit does not conclude the product ships tailscale, and the
--accept-dns evidence: the join omitted the flag, MagicDNS rewrote
/etc/resolv.conf, and it was reverted. Harmless at the vacation site, would
have bitten silently at home where split-horizon matters.

OPEN: key expiry still enabled on demo-hp (2027-01-17) - needs an admin-console
toggle or an API token; a pre-auth key cannot do it.
This commit is contained in:
authentik Default Admin
2026-07-21 18:51:05 +02:00
parent 460cc73bad
commit 8ec45f3b42
3 changed files with 158 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/operations/tailscale.md
+37 -2
View File
@@ -1,4 +1,4 @@
# Tailscale — location-independent access to felhom-pve (the N100)
# Tailscale — location-independent access to the demo nodes (N100 + HP t740)
> Added 2026-07-19. Goal: the demo Proxmox host (N100, `felhom-pve`) can be taken to a different
> LAN (e.g. a vacation home) and stay reachable from DooPlex, while its own dependencies keep
@@ -10,6 +10,7 @@
|---|---|---|---|---|
| DooPlex (192.168.0.180) | `dooplex` | `100.107.87.53` | **subnet router** advertising `192.168.0.0/24`; expiry disabled | **k3s pod** `admin-system/tailscale` (`hostNetwork`, GitOps/ArgoCD) — 157 d old, predates this task |
| N100 (192.168.0.162) | `felhom-pve` | `100.70.170.35` | its own node; expiry disabled | **host package** `tailscale` (Debian trixie apt repo), `tailscaled.service` |
| HP t740 (`demo-hp-bb76ea`) | `demo-hp` | `100.76.96.79` | its own node; **expiry NOT yet disabled — see below** | **host package** `tailscale` 1.98.9 (Debian trixie apt repo), `tailscaled.service`, added 2026-07-21 |
Tailnet: `nagyfenyvesi.viktor@gmail.com` (Tailscale Free). Both nodes run v1.98.x.
@@ -18,11 +19,45 @@ the **direct LAN path** when both boxes are home (measured: `pong … via 192.16
and falls back to the tunnel / a DERP relay when the N100 is remote. `felhom-pve-lan` →
`192.168.0.162` is the explicit LAN-only fallback.
## This is an OPERATOR-LAB EXCEPTION, not product shape
**Real customer boxes never get tailscale.** Customer operator-access is the WireGuard tunnel plus
the H1 OOB path, full stop. Tailscale exists on `felhom-pve` and `demo-hp` only because those two are
lab machines that live on LANs the operator does not control.
`demo-hp` is the confusing one: it is **customer-shaped** — a normal appliance install, a real
customer record, a real guest, a real day-0 — with tailscale bolted on afterwards by hand. A future
product-shape audit that finds it there must not conclude the product ships it. See
`operations/nodes.md`.
## demo-hp joined 2026-07-21
`tailscale up --authkey=file:… --hostname=demo-hp --accept-routes=false`, then
`tailscale set --accept-dns=false` (see the hard rule below — it was needed, and why is worth
reading). Auth was a pre-auth key, passed as `--authkey=file:<path>` and shredded immediately so it
never appeared in the box's process list. Verified from DooPlex: `ping` ~40 ms, direct SSH with no
ProxyJump, and the path is **direct** (`37.191.56.193:45127`), not a DERP relay.
**OPEN: key expiry is still enabled on `demo-hp`** (expires `2027-01-17`), unlike the other two
nodes which have it disabled. Disabling it is a per-device **admin-console toggle** (Machines →
demo-hp → Disable key expiry) or an API call with a `tskey-api-…` token; a `tskey-auth-…` pre-auth
key cannot do it (verified: the API returns 401). Until it is toggled the node will drop off the
tailnet on that date and need re-authentication.
## Hard rule: `--accept-dns=false` on the host node
The N100's `tailscaled` runs with **`--accept-dns=false`** (`CorpDNS:false`). MagicDNS must never
rewrite `/etc/resolv.conf`: the box relies on pi-hole (`192.168.0.250`) for split-horizon
(`gitea.dooplex.hu` → `192.168.0.180`). Verified byte-identical after `tailscale up`. (DooPlex's
(`gitea.dooplex.hu` → `192.168.0.180`). Verified byte-identical after `tailscale up`.
**On `demo-hp` this rule was broken and then fixed, which is the useful part of the story.** The join
omitted `--accept-dns=false`, and MagicDNS promptly rewrote `/etc/resolv.conf` to
`nameserver 100.100.100.100` — exactly what this rule forbids. Nothing broke *at the vacation site*,
because there is no pi-hole there and both `gitea.dooplex.hu` and `hub.felhom.eu` resolve publicly
anyway; the damage would have appeared silently **when the box comes home**, where split-horizon is
what makes `gitea.dooplex.hu` → `192.168.0.180` local. `tailscale set --accept-dns=false` restored
`nameserver 192.168.0.1` immediately, with the tailnet and the agent unaffected. **Pass
`--accept-dns=false` at join time on any host node; do not rely on noticing afterwards.** (DooPlex's
containerised node runs `TS_ACCEPT_DNS=true`, but because it is a pod with its own mount namespace
that only rewrites the *container's* resolv.conf — the DooPlex host resolv.conf is untouched.)