7 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	36f5ebdf86	feat(tailscale-router): serve ts.net DNS forward zone for LAN hosts ... FreeIPA (the new authoritative DNS) cannot reach 100.100.100.100 (Tailscale's internal MagicDNS resolver) directly because the DC is not a Tailscale node. The tailscale-router IS a Tailscale node and can reach 100.100.100.100 via tailscale0, so it now runs a dnsmasq instance on its LAN interface that forwards all ts.net queries to Tailscale's resolver. After deploying this host, configure FreeIPA with: kinit admin ipa dnsforwardzone-add ts.net \ --forwarder=192.168.2.222 \ --forward-policy=only This replaces Pi-hole's conditional forwarder for ts.net and restores resolution of Tailscale MagicDNS names (e.g. raspberrypi.tail13f623.ts.net) for all LAN hosts using FreeIPA as their DNS server. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ	2026-07-27 19:20:12 +10:00
beatzaplenty	18cd9c2342	Merge pull request 'feat(beszel): add beszel agent to tailscale-router' (#72) from worktree-beszel-tailscale-router into main ... Reviewed-on: #72	2026-07-26 01:08:29 +00:00
beatzaplentyandClaude Sonnet 4.6	997918e2f7	feat(beszel): add beszel agent to tailscale-router ... Wires beszel-agent into all tailscale-router variants (lxc/linode/proxmox) by importing enable-agent.nix in the build type and host-token.nix in the host file. Adds the sops creation rule for secrets/tailscale-router.yaml (all three platform variants as recipients). The secrets file must be created manually before deploying — see instructions in PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 11:07:51 +10:00
beatzaplentyandClaude Sonnet 4.6	e9b225d2d6	fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post ... extraCommands runs after nixos-nat-post is deleted but before it is re-created, so -A nixos-nat-post silently fails every time. POSTROUTING is a built-in chain that always exists; target it directly instead. The -C idempotency check prevents duplicate rules on firewall reloads. Drop networking.nat.enable -- it was only needed for the sub-chain that turned out to be the wrong target. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 10:00:47 +10:00
beatzaplentyandClaude Sonnet 4.6	781b1d324e	fix(tailscale-router): actually insert MASQUERADE rule via extraCommands ... networking.nat.externalInterface without internalInterfaces creates the nixos-nat-post chain but inserts no MASQUERADE rule into it — confirmed by inspecting the live firewall-start script on the deployed host. Add the rule explicitly via firewall.extraCommands targeting nixos-nat-post, scoped to LAN source traffic (vars.lanCidr) going out tailscale0. extraStopCommands removes it on firewall stop. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 09:54:33 +10:00
beatzaplentyandClaude Sonnet 4.6	cda2132d6a	fix(tailscale-router): masquerade LAN traffic into Tailscale ... Without SNAT on tailscale0, Tailscale drops forwarded packets from LAN source IPs (192.168.2.x) because they are not recognised Tailscale addresses. With networking.nat.externalInterface = "tailscale0", all traffic leaving through the Tailscale tunnel is masqueraded to the router's own Tailscale IP (100.x.x.x), making it indistinguishable from locally-originated traffic. Conntrack handles the return path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 09:45:07 +10:00
beatzaplentyandClaude Sonnet 4.6	c844ccc4e3	fix(tailscale): rename tailscale-subnet-router → tailscale-router everywhere ... Complete the rename so all identifiers match networking.hostName: - flake.nix: attribute names and buildType strings (linode/proxmox/lxc-tailscale-subnet-router → *-tailscale-router) - modules/build-types/tailscale-subnet-router.nix → tailscale-router.nix - .sops.yaml: anchor and alias names (age keys unchanged, no re-encrypt needed) - host-keys/: local gitignored key files renamed (not committed) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 16:33:03 +10:00