vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(mesh): advertise exit nodes at all three sites (SNAT re-enabled); usage + tradeoff documented

Browse Source
This commit is contained in:
vh
2026-09-06 00:09:43 -07:00
parent 815c283e44
commit b846a7c870
2 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
persistent-memory.d/2026-09-06-headscale-cutover.md
+9
View File
@@ -22,3 +22,12 @@ follow-ups in `docs/pfi/headscale-mesh-plan.md` § CUTOVER EXECUTED. Headlines:
back. See [[incident_crowdsec_cgnat_false_ban]] (same day) and the plan doc.
- Dormancy = disabled+retained (flip UDM object back to enabled=true to restore); NO auto
failover wired. Bonus: exit nodes → free multi-location egress proxy (parked).
## Exit nodes (2026-09-06, operator-requested)
All three routers advertise+serve exit nodes (approved). Clients pick location:
`tailscale set --exit-node=nh3-scale|esh-scale|ana-scale`. NH3 = residential egress
(70.230.226.88) → replaces the nh3-dev SOCKS5 proxy. ⚠ Enabling exit nodes REQUIRED flipping
`--snat-subnet-routes=true` (reversed the source-preserving NoSNAT); cross-site traffic now
shows the router IP as source. A node advertising an exit node can't consume one — test from
the laptop/iPad, not the routers.