pipistrello
ea9501f719
This file has been unsafe to deploy for two separate reasons. Both are fixed here, and the result is now byte-identical in effective config to what actually runs on the client-02 host (verified by diffing `docker compose config` on both). 1. ts-vpn + ikev2 were missing entirely. The IKEv2 VPN front has run on the host since 2026-09-05, but was never mirrored here — this file defined only ts-proxy, proxy and telemt. Deploying it as-is would have taken the VPN down for the Windows and iOS clients. Added both services, plus ikev2-egress.sh, which the ikev2 service mounts and cannot start without. ts-vpn is a SECOND Tailscale node in kernel/TUN mode (unlike ts-proxy, which is userspace): it forwards raw IP packets rather than TCP streams, so a userspace SOCKS5 is useless for it. It owns the network namespace that ikev2 joins via network_mode, which is also why the ports and sysctls live on ts-vpn and not on ikev2 — Docker forbids net.* sysctls on a network_mode:service container. 2. ts-proxy still pointed at the pre-migration exit node. TS_EXTRA_ARGS --exit-node=100.121.234.85 -> --exit-node=100.106.197.99 TS_HOSTNAME / hostname technohim-lan-proxy -> 02-tekhnohim-lan-proxy 100.121.234.85 has not existed since the 2026-08-27 tailnet migration. This is worse than a dead setting: with the exit node absent this stack does NOT fail closed — it silently egresses through the local ISP, so a redeploy from this repo would have turned a censorship-avoiding proxy into a plain local-egress one while still reporting healthy. This drift was recorded as an open issue in the migration write-up on 2026-08-27; these are the exact substitutions it prescribed. Not included, deliberately: ts-vpn.env and ikev2.env, which hold TS_AUTHKEY and the VPN credentials. Like every other config in this stack they are staged on the host by hand — a git push does not deploy config here, and these must never enter git. Both extracted files were scanned for secrets before being added.