From e9b61ad3cdda98fe184f9c87899e5786943b0e1a Mon Sep 17 00:00:00 2001
From: Fizzlepoof <admin@paccoco.com>
Date: Tue, 26 May 2026 01:18:19 +0000
Subject: [PATCH] Fix Headscale pilot policy and healthchecks

---
 headscale/README.md                      | 10 +++++++++-
 headscale/config/headplane/config.yaml   |  2 ++
 headscale/config/headscale/policy.hujson |  6 ++----
 headscale/docker-compose.yaml            |  2 +-
 4 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/headscale/README.md b/headscale/README.md
index c8aff8c..5ce6432 100644
--- a/headscale/README.md
+++ b/headscale/README.md
@@ -28,7 +28,15 @@ Self-hosted Headscale + Headplane pilot stack for replacing the Tailscale free-t
 - Headscale control plane: `http://headscale.home.paccoco.com:8084`
 - Headplane UI: `http://headplane.home.paccoco.com:3005/admin`
 
-These are intentionally LAN/private-DNS endpoints for the pilot. If you later want Traefik/Pangolin exposure, use `examples/traefik-routes.yml` as a starting point instead of changing the pilot shape first.
+These are the intended LAN/private-DNS endpoints for the pilot. If you later want Traefik/Pangolin exposure, use `examples/traefik-routes.yml` as a starting point instead of changing the pilot shape first.
+
+### Current live pilot note
+
+The live PD pilot is currently using direct-IP URLs instead:
+- Headscale: `http://10.5.30.6:8084`
+- Headplane: `http://10.5.30.6:3005/admin`
+
+Reason: the `home.paccoco.com` records for these pilot names have not yet been added in Technitium, and the current Technitium admin flow is 2FA-gated. Once those DNS records exist, flip the live stack back to the hostname-based URLs above.
 
 ## Initial users
 
diff --git a/headscale/config/headplane/config.yaml b/headscale/config/headplane/config.yaml
index 54b8368..4e39482 100644
--- a/headscale/config/headplane/config.yaml
+++ b/headscale/config/headplane/config.yaml
@@ -16,11 +16,13 @@ headscale:
 integration:
   agent:
     enabled: false
+    pre_authkey: ""
   docker:
     enabled: true
     container_label: "me.tale.headplane.target=headscale"
     socket: "unix:///var/run/docker.sock"
   kubernetes:
     enabled: false
+    pod_name: ""
   proc:
     enabled: false
diff --git a/headscale/config/headscale/policy.hujson b/headscale/config/headscale/policy.hujson
index 75c973a..02a23d1 100644
--- a/headscale/config/headscale/policy.hujson
+++ b/headscale/config/headscale/policy.hujson
@@ -20,16 +20,14 @@
       "dst": [
         "tag:infra:*",
         "tag:apps:*",
-        "tag:admin:*",
-        "autogroup:self:*"
+        "tag:admin:*"
       ]
     },
     {
       "action": "accept",
       "src": ["group:vip"],
       "dst": [
-        "tag:apps:*",
-        "autogroup:self:*"
+        "tag:apps:*"
       ]
     }
   ],
diff --git a/headscale/docker-compose.yaml b/headscale/docker-compose.yaml
index 84b80d5..5efd0e3 100644
--- a/headscale/docker-compose.yaml
+++ b/headscale/docker-compose.yaml
@@ -25,7 +25,7 @@ services:
       - /mnt/docker-ssd/docker/appdata/headscale:/var/lib/headscale
       - /mnt/docker-ssd/docker/appdata/headscale/run:/var/run/headscale
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/health >/dev/null 2>&1 || exit 1"]
+      test: ["CMD", "headscale", "version"]
       interval: 30s
       timeout: 10s
       retries: 5