Exposure: kuberex on a dedicated Headscale #16

New issue

Open

opened 2026-11-02 21:09:37 +00:00 by mikluko · 0 comments

mikluko commented

2026-11-02 21:09:37 +00:00

Owner

Map: #1

Question

Move kuberex's tailnet from Tailscale to a dedicated Headscale in its own namespace headscale on saraksh, with kuberex's tailscale.controlURL pointing at it.

Settled when this was opened:

Headscale is a pinned main build (headscale/headscale:main-d0e10f2): Rex's built-in Tailscale listener needs node HTTPS certificates, which Headscale has only on main (juanfont/headscale#3554), in no release up to v0.29.7. Move to the first release carrying it.
Node certificates through DNS-01, rfc2136 to saraksh's PowerDNS with a TSIG key of its own, headscale; MagicDNS base domain ts.sarak.sh in zone sarak.sh.
Server https://hs.sarak.sh behind Traefik; sign-in through Pocket ID, group admin; Tailscale's DERP map, no embedded DERP; SQLite replicated by litestream to B2 saraksh-litestream/headscale/headscale.
kuberex enrolls with a pre-auth key of my Headscale user, so I stay its owner; its Tailscale-SaaS node state goes.

Resolved when kuberex is on the Headscale tailnet with a certificate and my Mac reaches it there.

Map: #1 ## Question Move kuberex's tailnet from Tailscale to a dedicated Headscale in its own namespace `headscale` on `saraksh`, with kuberex's `tailscale.controlURL` pointing at it. Settled when this was opened: - Headscale is a pinned `main` build (`headscale/headscale:main-d0e10f2`): Rex's built-in Tailscale listener needs node HTTPS certificates, which Headscale has only on `main` (juanfont/headscale#3554), in no release up to v0.29.7. Move to the first release carrying it. - Node certificates through DNS-01, `rfc2136` to saraksh's PowerDNS with a TSIG key of its own, `headscale`; MagicDNS base domain `ts.sarak.sh` in zone `sarak.sh`. - Server `https://hs.sarak.sh` behind Traefik; sign-in through Pocket ID, group `admin`; Tailscale's DERP map, no embedded DERP; SQLite replicated by litestream to B2 `saraksh-litestream/headscale/headscale`. - kuberex enrolls with a pre-auth key of my Headscale user, so I stay its owner; its Tailscale-SaaS node state goes. Resolved when kuberex is on the Headscale tailnet with a certificate and my Mac reaches it there.

mikluko changed title from ~~Exposure: kuberex on a dedicated Headscale in agents~~ to Exposure: kuberex on a dedicated Headscale

2026-11-02 21:09:50 +00:00

mikluko added the

wayfinder:task

label

2026-11-02 21:10:06 +00:00

mikluko self-assigned this

2026-11-02 21:10:07 +00:00

mikluko added a new dependency

2026-11-02 21:10:07 +00:00

#9 End-to-end check from my devices