darmanandClaude Opus 4.8
564dfb16b8
Two changes to the control server, plus the fallout on the hosts. OIDC via Authentik, so `tailscale up --login-server ...` opens a browser instead of needing a pre-auth key. This is a second Authentik application, separate from headplane's, with headscale's own /oidc/callback redirect. Headless hosts keep using pre-auth keys. Note that headscale runs OIDC discovery at startup and a failure is FATAL -- pointing `issuer` at an application that does not exist yet means the control server will not boot, so verify the discovery document before deploying. override_local_dns = false, because the upstream default of true replaces resolv.conf with 100.100.100.100 on every node. That silently broke the LAN's `.sol` names -- pihole serves those and the global nameservers return NXDOMAIN for them -- and took ad blocking down with them. It also made each node's entire DNS depend on tailscaled, which is what had forced --accept-dns=false onto neptun and mercury individually; both of those workarounds are now removed, and with MagicDNS resolving properly again neptun no longer needs its hardcoded /etc/hosts pin for jupiter. Also serves jellyfin and seerr from jupiter, matching the ports they already use on its LAN vhosts, and rotates the tailnet pre-auth keys. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
2.2 KiB
YAML
28 lines
2.2 KiB
YAML
darman_password: ENC[AES256_GCM,data:iZQERcXtyH+91yUc3r7U6jnFYrGQPFeCPk/9ZDfxOhPLlGMX3/iEZ+SzZ7a7rDKUeUAaQUsrqANLDLclRYm4Ngo09EkbDxBx5x2GpQwlqSAS45LHnTen9LTzisWghdy79Xnilq322eaB3g==,iv:ozx/BPLR8nZTKHZroKrrh2z6ZlVCuLydQ3aNY4XvcIg=,tag:CSrq5ZipYxtXTT8RintuHQ==,type:str]
|
|
pihole_webpassword: ENC[AES256_GCM,data:5iOTqD0CcbOCnM1b4+RbajMTyAU=,iv:2ZRW7dshnPzWkuudrn6n92y4Z2n/6fdnBB7BO5/ypS4=,tag:8UZSqJM6dVECQgrF6v5Fuw==,type:str]
|
|
tailscale_authkey: ENC[AES256_GCM,data:Ogm5RTcbJl5lsL19qgTcqXLWK7ypxXrAHNYgriduQQSSRoRWvsnJ3A2Lbynb+r756WxJyFSFqY3WGr9pHaCYo8LAf5oD1MJE26I7JtsAVcHY0QS29b2MnQ==,iv:3H0YMk6llOBapqtMkxsdlY8wQhzIXa+6W4ZrWD0iq2M=,tag:3rPQS7FX8ODLAQK5gOL7lw==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOQUdJRFBlYUYzWTFiaWJn
|
|
SS80UlJ0VWhhQmMzSWc3bkM3Q2NHNHJVT0ZFCmRDdnp5bzhCTHlTK2NseHRVc2Mw
|
|
OVl4QVdNclh5VXhoeGlsWXNLUkxUUE0KLS0tIE5jV1djL1FiTithVjZabTRHTzJ2
|
|
anR2d3V3TXA1L1RMcEtHZ0g3dTZ0dncKtzI9bsQEcuJb5PPuXMkNHOObdSmxxvWl
|
|
D3A1dJu2wnMV6TO5TNVAy9+jyp26RBkdkxoUqlChzBs0kl3/gmJNTA==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1UWhaT2tOdm02QWgyTkdB
|
|
Ry9XS0Q4U0dEdkhtbHZDVDNtcFRxcDhZOENrCkdmbjFvWUpzdnFEUTg3bjdXN3Rz
|
|
OXAxYUNGdDlxNjNaMlRZRjVFbDhVYjQKLS0tIHB0Z3RaOUJtZEVGTzlBSHRaQjBh
|
|
V0Yza1RVTmJTblBLZFkzZElwWTlmdncKCAiA6NdlpVJmuTbU1/rcTsB9UeGIQPlD
|
|
x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
|
|
lastmodified: "2026-07-20T18:41:59Z"
|
|
mac: ENC[AES256_GCM,data:Ay3JLVmJu9S5wlxyL5mrACgLv+jbAsKB5/5r8/z5m4fPjfaYnBQbn1b2s8G764yI0+L3JVWyAdvdy2Gqplrds87lWqlf+gpJKGOoargsiIZAfJmJEzZOYZLPT8YanvGMHniAJszeZ9CnL7Uf9fn0RpT4ObeT7didSqIds6xVeRs=,iv:whZ9L1+tMTkTZaVUdshghIsS9Gmde4RozMDe3XN1ek8=,tag:015mccmr9A/YW+7E+1CsGg==,type:str]
|
|
unencrypted_suffix: _unencrypted
|
|
version: 3.13.1
|