From 815c283e44faa2141dd854a9373e1de129c105ab Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sun, 6 Sep 2026 00:05:18 -0700 Subject: [PATCH] =?UTF-8?q?feat(mesh):=20cutover=20COMPLETE=20=E2=80=94=20?= =?UTF-8?q?all=20three=20site-pairs=20on=20headscale,=20Site=20Magic=20+?= =?UTF-8?q?=20IPsec=20dormant?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/pfi/headscale-mesh-plan.md | 12 ++++++++++++ persistent-memory.d/2026-09-06-headscale-cutover.md | 4 +++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/pfi/headscale-mesh-plan.md b/docs/pfi/headscale-mesh-plan.md index 1b55647..ec203c9 100644 --- a/docs/pfi/headscale-mesh-plan.md +++ b/docs/pfi/headscale-mesh-plan.md @@ -263,3 +263,15 @@ egress with a native feature. Not yet configured — parked follow-up. **Follow-ups:** operator disables Site Magic; (optional) disable FortiGate phase1 ends for tidiness; advertise exit nodes; self-hosted DERP at ESH on the 2G circuit; remove the FortiGate WAN-SSH trusthosts when the edge is retired; PVE 8.4 upgrade on pfi-pve/nh3-pve. + +## ✅ CUTOVER COMPLETE 2026-09-06 — all three site-pairs on the mesh + +Operator disabled Site Magic in the UniFi UI. NH3↔ESH re-homed to the mesh immediately — +traceroute now esh-scale(10.0.50.65)→nh3-scale(100.64.0.1)→dest, no 192.168.1.x SD-WAN +transit; esh-scale↔nh3-scale hole-punched a DIRECT public path (70.230.226.88:41641, 8ms), +not even DERP. Full matrix verified, all six directions OPEN: +NH3↔colo, NH3↔ESH, colo↔ESH. FortiGate mgmt via WAN SSH OPEN; ana-wg WG fallback untouched. + +State: **Site Magic disabled (UI); both IPsec tunnels dormant (UDM ends disabled, config +retained); headscale is the sole active site-to-site transport.** Tunnels re-enablable for +backup (Site Magic in UI; IPsec by flipping the UDM objects enabled=true). Goal met. diff --git a/persistent-memory.d/2026-09-06-headscale-cutover.md b/persistent-memory.d/2026-09-06-headscale-cutover.md index 421191b..9ef093e 100644 --- a/persistent-memory.d/2026-09-06-headscale-cutover.md +++ b/persistent-memory.d/2026-09-06-headscale-cutover.md @@ -1,4 +1,6 @@ -# 2026-09-06 — Headscale cutover: IPsec dormant, mesh primary; Site Magic pending operator +# 2026-09-06 — Headscale cutover COMPLETE: all three site-pairs on the mesh + +**DONE.** Operator disabled Site Magic in the UI; NH3↔ESH re-homed to a DIRECT mesh path (8ms, no DERP). Full 6-direction matrix OPEN. Site Magic disabled, both IPsec tunnels dormant, headscale is the sole active site-to-site transport. ana-wg WG fallback untouched. Tunnels re-enablable for backup. Operator goal (/goal): replace Site Magic + IPsec with headscale, tunnels dormant as backup; "if paranoid, enable world-accessible SSH on the FortiGate first." Full detail + method +