Fix Headscale pilot policy and healthchecks

headscale/README.md

@@ -28,7 +28,15 @@ Self-hosted Headscale + Headplane pilot stack for replacing the Tailscale free-t
 - Headscale control plane: `http://headscale.home.paccoco.com:8084`
 - Headplane UI: `http://headplane.home.paccoco.com:3005/admin`
 
-These are intentionally LAN/private-DNS endpoints for the pilot. If you later want Traefik/Pangolin exposure, use `examples/traefik-routes.yml` as a starting point instead of changing the pilot shape first.
+These are the intended LAN/private-DNS endpoints for the pilot. If you later want Traefik/Pangolin exposure, use `examples/traefik-routes.yml` as a starting point instead of changing the pilot shape first.
+
+### Current live pilot note
+
+The live PD pilot is currently using direct-IP URLs instead:
+- Headscale: `http://10.5.30.6:8084`
+- Headplane: `http://10.5.30.6:3005/admin`
+
+Reason: the `home.paccoco.com` records for these pilot names have not yet been added in Technitium, and the current Technitium admin flow is 2FA-gated. Once those DNS records exist, flip the live stack back to the hostname-based URLs above.
 
 ## Initial users
 

headscale/config/headplane/config.yaml

@@ -16,11 +16,13 @@ headscale:
 integration:
   agent:
     enabled: false
+    pre_authkey: ""
   docker:
     enabled: true
     container_label: "me.tale.headplane.target=headscale"
     socket: "unix:///var/run/docker.sock"
   kubernetes:
     enabled: false
+    pod_name: ""
   proc:
     enabled: false

headscale/config/headscale/policy.hujson

@@ -20,16 +20,14 @@
       "dst": [
         "tag:infra:*",
         "tag:apps:*",
-        "tag:admin:*",
-        "autogroup:self:*"
+        "tag:admin:*"
       ]
     },
     {
       "action": "accept",
       "src": ["group:vip"],
       "dst": [
-        "tag:apps:*",
-        "autogroup:self:*"
+        "tag:apps:*"
       ]
     }
   ],

headscale/docker-compose.yaml

@@ -25,7 +25,7 @@ services:
       - /mnt/docker-ssd/docker/appdata/headscale:/var/lib/headscale
       - /mnt/docker-ssd/docker/appdata/headscale/run:/var/run/headscale
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/health >/dev/null 2>&1 || exit 1"]
+      test: ["CMD", "headscale", "version"]
       interval: 30s
       timeout: 10s
       retries: 5