jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(ci): published-port audit allows Headscale's direct control port (8443) #91

Merged
jfraeys merged 1 commit from jfraeys/fix/audit-allow-headscale-direct-port into main 2026-10-13 08:50:31 -04:00
Conversation 0 Commits 1 Files changed 2 +6 -4
jfraeys commented 2026-10-12 23:57:34 -04:00
Owner
Copy link

The new published-port audit (#83) caught its first real item in staging run 557: headscale 8443/tcp is published to all interfaces. That is intended: it is the Cloudflare-independent control port nodes enroll on from anywhere (docs/incidents.md, roles/headscale), so it belongs on the public allowlist next to 80/443/3478-udp.

Also corrects roles/headscale's comment: UFW is not the gate for a Docker-published port (Docker's DNAT admits it regardless; same misconception as the LLDAP exposure), so the rule only documents intent.

This run (557) checked out 019f5c3 (the #83 merge) because Forgejo kept the first push's commit for the pending run, so #84-#90 (post-deploy hardening, timings, vpn DNS) were not exercised yet; the next push run covers them.

🤖 Generated with Claude Code

The new published-port audit (#83) caught its first real item in staging run 557: headscale 8443/tcp is published to all interfaces. That is intended: it is the Cloudflare-independent control port nodes enroll on from anywhere (docs/incidents.md, roles/headscale), so it belongs on the public allowlist next to 80/443/3478-udp. Also corrects roles/headscale's comment: UFW is not the gate for a Docker-published port (Docker's DNAT admits it regardless; same misconception as the LLDAP exposure), so the rule only documents intent. This run (557) checked out 019f5c3 (the #83 merge) because Forgejo kept the first push's commit for the pending run, so #84-#90 (post-deploy hardening, timings, vpn DNS) were not exercised yet; the next push run covers them. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(ci): the published-port audit allows Headscale's direct control port
All checks were successful
Lint / lint (pull_request) Successful in 2m58s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
133210b66e
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!91
No description provided.