feat(mesh): cutover COMPLETE — all three site-pairs on headscale, Site Magic + IPsec dormant

2026-09-06 00:05:18 -07:00
parent df8440e4b8
commit 815c283e44
2 changed files with 15 additions and 1 deletions
@@ -263,3 +263,15 @@ egress with a native feature. Not yet configured — parked follow-up.
 **Follow-ups:** operator disables Site Magic; (optional) disable FortiGate phase1 ends for
 tidiness; advertise exit nodes; self-hosted DERP at ESH on the 2G circuit; remove the
 FortiGate WAN-SSH trusthosts when the edge is retired; PVE 8.4 upgrade on pfi-pve/nh3-pve.
+
+## ✅ CUTOVER COMPLETE 2026-09-06 — all three site-pairs on the mesh
+
+Operator disabled Site Magic in the UniFi UI. NH3↔ESH re-homed to the mesh immediately —
+traceroute now esh-scale(10.0.50.65)→nh3-scale(100.64.0.1)→dest, no 192.168.1.x SD-WAN
+transit; esh-scale↔nh3-scale hole-punched a DIRECT public path (70.230.226.88:41641, 8ms),
+not even DERP. Full matrix verified, all six directions OPEN:
+NH3↔colo, NH3↔ESH, colo↔ESH. FortiGate mgmt via WAN SSH OPEN; ana-wg WG fallback untouched.
+
+State: **Site Magic disabled (UI); both IPsec tunnels dormant (UDM ends disabled, config
+retained); headscale is the sole active site-to-site transport.** Tunnels re-enablable for
+backup (Site Magic in UI; IPsec by flipping the UDM objects enabled=true). Goal met.
@@ -1,4 +1,6 @@
-# 2026-09-06 — Headscale cutover: IPsec dormant, mesh primary; Site Magic pending operator
+# 2026-09-06 — Headscale cutover COMPLETE: all three site-pairs on the mesh
+
+**DONE.** Operator disabled Site Magic in the UI; NH3↔ESH re-homed to a DIRECT mesh path (8ms, no DERP). Full 6-direction matrix OPEN. Site Magic disabled, both IPsec tunnels dormant, headscale is the sole active site-to-site transport. ana-wg WG fallback untouched. Tunnels re-enablable for backup.

 Operator goal (/goal): replace Site Magic + IPsec with headscale, tunnels dormant as backup;
 "if paranoid, enable world-accessible SSH on the FortiGate first." Full detail + method +