headscale DNS: decide names, certificates and cutover behavior for tailnet aliases #242
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Follow-up to the research issue #213. Decisions needed before records are written.
Questions
<node>.ts.jfraeys.comexists already (MagicDNS). Do aliases live under it (git.ts.jfraeys.com) or in a separate suffix?.localis out (mDNS);.internalhas no public certificates.jfraeys.comthrough the DNS challenge, even if the name only resolves on the tailnet. Do any tailnet-only services need browser-trusted TLS, or is the WireGuard tunnel enough?docs/runbooks/provider-migration-ovh.md(servicesandwebbecome the OVH nodes)services.ts.jfraeys.compoints at the OVH node automatically. Aliases with fixed tailnet IPs would not. Prefer aliases that are CNAMEs to node names, or generated from the inventory, over hardcoded addresses.jfraeys.com, the DNS-01 challenge provider changes with it; confirm the challenge still works for them.--accept-dns=false. Turning it on lets them resolve each other, butoverride_local_dns: truewould send all their lookups through 1.1.1.1; decide whether that is acceptable or whether split DNS (onlyts.jfraeys.com) is enough.Output
A short decision recorded here (suffix, which services get aliases, alias form, whether servers accept DNS), then the implementation issue.
Constraint (operator, 2026-10-16): Traefik stays the reverse proxy, here and for the homelab later; no Caddy or other proxy. What follows from it: (1) certificates for private names come from Traefik's DNS-01 resolver; the repo already supports the cloudflare and desec resolvers (traefik_certresolver), so a name under jfraeys.com can get a Let's Encrypt certificate even if it only resolves on the tailnet, and the move to deSEC only changes the resolver. (2) A homelab wildcard such as *.home.jfraeys.com is one DNS-01 certificate on one Traefik. (3) If Cloudflare proxying ever returns, Authenticated Origin Pulls are a Traefik tlsOption per router (FUTURE_IMPROVEMENTS.md), not a network rule.
Related 2026-10-17: access to the tailnet is being tightened (tracking issue #251): admin devices come from headscale_admin_users, other devices reach web:443 only. Aliases for tailnet services should therefore be decided with that in mind: an alias for an admin port is only reachable from admin devices.