docs: Unraid exit node approved

Approved in the Tailscale admin console, so xtrm-unraid now shows as
"offers exit node" and appears in tailscale exit-node list. The tailnet has
two exit nodes: mikrotik-tailscale (primary) and xtrm-unraid (fallback).

Neither has been exercised from the Mac. Noted that without
--exit-node-allow-lan-access an exit node cuts the client's own LAN access,
which would break an SSH session routed over Tailscale.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/09-TAILSCALE-VPN.md

@@ -191,7 +191,7 @@ Tailscale VPN running as a container on MikroTik hAP ax³, providing remote acce
 | Tailscale IP | Device | Status |
 |--------------|--------|--------|
 | 100.74.219.35 | MikroTik hAP ax³ (container) | Online |
-| 100.100.208.69 | xtrm-unraid (Unraid plugin) | Online |
+| 100.100.208.69 | xtrm-unraid (Unraid plugin, offers exit node) | Online |
 | 100.100.208.70 | xtrm-unraid (old node, deleted 2026-11-03) | Removed |
 | 100.112.103.7 | hapax3 (old native install) | Offline |
 | 100.75.93.123 | mikrotik-tailscale (previous container) | Offline |
@@ -230,7 +230,7 @@ logged out since roughly May 2026 and was re-enrolled on 2026-11-03.
 |------|-------|--------|
 | `--advertise-routes` | none | The old `192.168.31.0/24` advertisement was dropped. That subnet is only the macvlan shim (`br0-shim` holds `192.168.31.250/32` with one host route to `192.168.31.4`) — nothing reachable lives there. |
 | LAN subnet routing | not advertised | The MikroTik container is primary for `192.168.10.0/24`, `.20`, `.25`, `.30`. A second advertiser for a subnet Unraid itself sits on would create a routing conflict. |
-| `--advertise-exit-node` | on | Redundant with the hAP today, kept as a fallback on the 24/7 box. **Needs approval in the admin console** before it appears in `tailscale exit-node list`. |
+| `--advertise-exit-node` | on | Redundant with the hAP today, kept as a fallback on the 24/7 box. **Approved in the admin console 2026-11-03** — shows as `offers exit node` and appears in `tailscale exit-node list`. |
 | `--accept-routes` | **false** | Critical. Unraid is *on* `192.168.10.0/24`; accepting the hAP's route for its own subnet would loop. This is why `tailscale status` reports the health warning "Some peers are advertising routes but --accept-routes is false" — expected here, not a fault. |
 | `--accept-dns` | false | Keeps local AdGuard resolution intact (Unraid AdGuard is config master). |
 | `--ssh` | on | Tailscale SSH. Needed — see the sshd caveat below. |
@@ -287,7 +287,16 @@ AllowTcpForwarding yes          # limetech - permit only root SSH tunneling
 
 Any non-root account added later will not be able to open tunnels.
 
-### Open item
+### Exit node
 
-- Approve the advertised exit node for `xtrm-unraid` in the Tailscale admin
-  console (Machines -> xtrm-unraid -> Edit route settings).
+Approved 2026-11-03. The tailnet now has two exit nodes:
+
+| IP | Node |
+|----|------|
+| `100.74.219.35` | `mikrotik-tailscale` (primary) |
+| `100.100.208.69` | `xtrm-unraid` (fallback, 24/7 box) |
+
+Select one with `tailscale set --exit-node=xtrm-unraid`. Not exercised in anger
+yet — note that without `--exit-node-allow-lan-access` an exit node cuts the
+client's own LAN access, which will break an SSH session that is itself routed
+over Tailscale.

docs/CHANGELOG.md

@@ -10,7 +10,7 @@
 - **[NETWORK]** Dropped the node's old `192.168.31.0/24` advertisement. That subnet is only the macvlan shim — `br0-shim` holds `192.168.31.250/32` with a single host route to `192.168.31.4`, and no container or service lives there. No LAN subnet routes are advertised from Unraid: the MikroTik container stays primary for `192.168.10.0/24`, `.20`, `.25`, `.30`.
 - **[NETWORK]** `--accept-routes=false` and `--accept-dns=false` kept deliberately. Unraid sits *on* `192.168.10.0/24`, so accepting the hAP's route for its own subnet would loop; the resulting "peers are advertising routes but --accept-routes is false" health warning is expected, not a fault.
 - **[SERVICE]** Tailscale SSH enabled on the node. Necessary because `/etc/ssh/sshd_config` binds only `192.168.10.20` and `192.168.31.250` with no wildcard, so sshd never listens on the Tailscale IP. Port forwarding over Tailscale SSH verified (`-L 18089:127.0.0.1:80` returned HTTP 302 from the Unraid web UI).
-- **[SERVICE]** Exit node advertised from Unraid as a fallback to the hAP. **Pending manual approval** in the Tailscale admin console.
+- **[SERVICE]** Exit node advertised from Unraid as a fallback to the hAP, and approved in the Tailscale admin console the same day. The tailnet now has two exit nodes: `mikrotik-tailscale` (100.74.219.35, primary) and `xtrm-unraid` (100.100.208.69, fallback). Neither has been exercised in anger from the Mac — without `--exit-node-allow-lan-access` an exit node cuts the client's own LAN access.
 - Detail, including the root-only `AllowTcpForwarding` behaviour in Unraid's stock sshd config, in `docs/09-TAILSCALE-VPN.md`.
 
 ---