From f8eb3606ebb3b100f7cdc325840558c4348a805f Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sun, 6 Sep 2026 00:43:48 -0700 Subject: [PATCH] feat(mesh): fold irv-ml1 in additively (node 100.64.0.6), wg0 lifeline preserved; wg0 retirement deferred to on-site --- docs/pfi/headscale-mesh-plan.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/docs/pfi/headscale-mesh-plan.md b/docs/pfi/headscale-mesh-plan.md index cd061b5..5ca2317 100644 --- a/docs/pfi/headscale-mesh-plan.md +++ b/docs/pfi/headscale-mesh-plan.md @@ -323,3 +323,33 @@ during upload sampled ~32% (single reading) → not clearly the cap; upload like userspace-WireGuard single-flow, the CT vNIC, or the WAN. Operator: the ANA AT&T line is SHARED fiber, so the upload figure may be the line, not the routers — left as-is (no CT core bump). Baseline for future comparison, not a hardware limit. + +## 2026-09-06 — irv-ml1 folded in ADDITIVELY (operator inaccessible 5 days — lifeline preserved) + +Constraint: operator has NO physical access to the Irvine building for 5 days; irv-ml1 must +not go dark unrecoverably. Its ONLY remote path is the bespoke WireGuard tunnel `wg0` +(10.100.79.3 → nh3-dev, AllowedIPs 10.0/16+10.100/16+10.250/16); its LAN 10.6.110.50 is not +reachable from the fleet. + +Enrolled irv-ml1 as headscale node **100.64.0.6** (`infra-ops@10.100.79.3` has NOPASSWD root; +`tailscaled` was already running but logged out with STALE prefs → **public** Tailscale +`controlplane.tailscale.com` + `RouteAll:true`). Used `tailscale up --reset --login-server +https://headscale.phasefinal.com --authkey … --accept-routes=false --accept-dns=false +--hostname irv-ml1`. ⚠ **accept-routes MUST stay OFF**: wg0's AllowedIPs are the exact /16s the +mesh routers advertise, so accepting them would fight the lifeline over the prefix my SSH +returns on = 5-day lockout. Armed an auto-revert dead-man switch (`tailscale down` in 10m +unless disarmed) before the change; disarmed via sentinel after verifying. + +Result: **DUAL PATH** — wg0 (10.100.79.3, untouched, fleet routes still via it) AND mesh +(100.64.0.6). Both verified from nh3-dev. Reboot-safe: `wg-quick@wg0` + `tailscaled` both +enabled, prefs now headscale + accept-routes=false + WantRunning=true. Mesh peering currently +rides over wg0 as transport (11ms). + +⚠ **DEFERRED to the on-site window (do NOT do remotely):** retire wg0; enable accept-routes / +subnet-routing over the mesh; migrate yt-voice-clipper egress off the dante SOCKS proxy. Each +touches the exact routing that is the lifeline. When on-site (physical console as fallback): +flip accept-routes on, confirm fleet reachability over the mesh, THEN down wg0. + +⚠ **Lesson (repeat):** `pkill -f` / `pgrep -f ` over SSH self-matches when the pattern +is in your own ssh argv — killed my session twice disarming the switch. Kill by explicit PID, +or make the switch sentinel-based (which saved it here).