vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(mesh): cutover COMPLETE — all three site-pairs on headscale, Site Magic + IPsec dormant

Browse Source
This commit is contained in:
vh
2026-09-06 00:05:18 -07:00
parent df8440e4b8
commit 815c283e44
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pfi/headscale-mesh-plan.md
+12
View File
@@ -263,3 +263,15 @@ egress with a native feature. Not yet configured — parked follow-up.
**Follow-ups:** operator disables Site Magic; (optional) disable FortiGate phase1 ends for
tidiness; advertise exit nodes; self-hosted DERP at ESH on the 2G circuit; remove the
FortiGate WAN-SSH trusthosts when the edge is retired; PVE 8.4 upgrade on pfi-pve/nh3-pve.
## ✅ CUTOVER COMPLETE 2026-09-06 — all three site-pairs on the mesh
Operator disabled Site Magic in the UniFi UI. NH3↔ESH re-homed to the mesh immediately —
traceroute now esh-scale(10.0.50.65)→nh3-scale(100.64.0.1)→dest, no 192.168.1.x SD-WAN
transit; esh-scale↔nh3-scale hole-punched a DIRECT public path (70.230.226.88:41641, 8ms),
not even DERP. Full matrix verified, all six directions OPEN:
NH3↔colo, NH3↔ESH, colo↔ESH. FortiGate mgmt via WAN SSH OPEN; ana-wg WG fallback untouched.
State: **Site Magic disabled (UI); both IPsec tunnels dormant (UDM ends disabled, config
retained); headscale is the sole active site-to-site transport.** Tunnels re-enablable for
backup (Site Magic in UI; IPsec by flipping the UDM objects enabled=true). Goal met.