Tony0410
345853108d
- systems/skills-index.md: Regenerated from live skill tree (340 skills in 73 categories) - raw/stocktake/freshness-20260921.txt: Freshness audit — 67 stale pages (≥21d), 5 fresh, 7 no-date - infrastructure/tailscale.md: Verified against live tailscale serve status, reordered routes to match current state, updated verified_on to 2026-09-21
81 lines
3.0 KiB
Markdown
81 lines
3.0 KiB
Markdown
---
|
|
title: Tailscale
|
|
type: infrastructure
|
|
status: active
|
|
created: 2026-07-26
|
|
updated: 2026-09-21
|
|
verified_on: 2026-09-21
|
|
confidence: high
|
|
tags: [tailscale, vpn, networking, infrastructure]
|
|
---
|
|
|
|
# Tailscale
|
|
|
|
## Purpose
|
|
WireGuard-based mesh VPN connecting all homelab hosts and providing HTTPS access via Tailscale Serve.
|
|
|
|
## Domain
|
|
- **Tailnet:** `kangaroo-eel.ts.net`
|
|
- **Primary node:** CT460 (`hermes.kangaroo-eel.ts.net`)
|
|
- **Runtipi node:** CT201 (`runtipi.kangaroo-eel.ts.net`)
|
|
|
|
## CT460 Serve Routes
|
|
| Path | Target | Notes |
|
|
|---|---|---|
|
|
| `/` | `http://127.0.0.1:9119` | Hermes WebUI |
|
|
| `/ui` | `http://127.0.0.1:5175/` | Hermes UI (Vite) |
|
|
| `/jobs` | `http://127.0.0.1:9099` | Jobs Dashboard |
|
|
| `/wiki` | `http://100.118.5.51:9120` | Agent Estate Wiki (Quartz) |
|
|
| `/ignis` | `http://127.0.0.1:8080` | Ignis (browser-native Obsidian) |
|
|
| `/webui` | `http://127.0.0.1:8787/` | Hermes WebUI (Standalone) |
|
|
| `/gitea` | `http://100.82.100.128:3000` | Gitea |
|
|
| `/desktop` | `http://127.0.0.1:6081` | CUA noVNC |
|
|
| `/vnc-camofox` | `http://127.0.0.1:6080` | Camofox VNC |
|
|
| `/synergy-prep` | `http://127.0.0.1:9123/` | Synergy prep |
|
|
| `/agent-estate` | `http://127.0.0.1:8769/agent-estate-role-dashboard.html` | Role dashboard |
|
|
| `/evening-grid.html` | `http://127.0.0.1:9099/evening-grid.html` | Evening grid |
|
|
|
|
## CT460 Funnel Routes
|
|
| Port | Target | Notes |
|
|
|---|---|---|
|
|
| `:8443/webhook` | `http://127.0.0.1:8085/webhook` | Public webhook Funnel |
|
|
|
|
## CT201 Serve Routes
|
|
| Path | Target | Notes |
|
|
|---|---|---|
|
|
| `:8443` | `http://localhost:8082` | Homepage dashboard |
|
|
| `/steel` | `http://127.0.0.1:5173` | Steel Browser UI |
|
|
| `/steel-api` | `http://127.0.0.1:3000` | Steel Browser API (path prefix not stripped — use direct IP for API calls) |
|
|
|
|
## Atomic Restore Script
|
|
`/home/hermes/.hermes/scripts/tailscale-serve-apply.sh` — Rebuilds the complete CT460 route table, including tailnet Serve on `:443` and public Funnel on `:8443`.
|
|
|
|
`tailscale serve reset` clears Funnel state as well as Serve state. The atomic script therefore restores `/webhook` after rebuilding the 443 routes. Do not use the older Serve-only restore path for complete recovery.
|
|
|
|
## Key Commands
|
|
```bash
|
|
# Check routes
|
|
tailscale serve status
|
|
|
|
# Rebuild routes (CT460)
|
|
/home/hermes/.hermes/scripts/tailscale-serve-apply.sh --dry-run
|
|
/home/hermes/.hermes/scripts/tailscale-serve-apply.sh
|
|
|
|
# Add route
|
|
tailscale serve --set-path /jobs http://127.0.0.1:9099
|
|
|
|
# Remove route
|
|
tailscale serve --set-path /jobs off
|
|
```
|
|
|
|
## Notes
|
|
- Port 443 occupied by Traefik on CT201 — Tailscale uses port 8443 there
|
|
- CT460 has no conflict — Tailscale uses 443 directly
|
|
- Routes must be re-added in order (restore script handles this)
|
|
- After every rebuild, verify that `tailscale serve status` contains both the `:443` Serve routes and the `:8443/webhook` Funnel route.
|
|
|
|
## Related
|
|
- [[infrastructure/domains-and-tunnels]] — Full DNS and tunnel inventory
|
|
- [[systems/homepage-dashboard]] — Homepage on CT201 via Tailscale
|
|
- [[runbooks/job-radar]] — Dashboard incident and route verification
|