5 Commits

Include renames

Author	SHA1	Message	Date
Kaloyan DanchevandClaude Opus 5	27f5a7d5af	docs: Tailscale SSH ACL set to accept ... Tailnet SSH policy changed from the default action:"check" to accept. The effective policy is now a single rule covering all tailnet nodes, with no expiry and port forwarding allowed, so the per-device ~12h grants and the browser re-auth prompt are gone. Verified unattended with BatchMode=yes: a plain command, a -L forward returning HTTP 302, and the Herdr fallback leg. Records the trade-off: check acted as a second factor, so a compromised tailnet device now reaches root on Unraid without a further step. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-11-03 23:03:47 +02:00
Kaloyan DanchevandClaude Opus 5	32a60f0c6e	docs: Unraid as a Herdr machine, and why it needed a --via wrapper ... herdr-core machine add kept failing with "core did not start within 5 s". Cause: hc puts its core socket under XDG_RUNTIME_DIR, which on Unraid is /run/user/0 — created and destroyed per login session by elogind. The socket vanished with the session that started the core, so later clients found an empty directory. The core itself kept running on an unlinked socket, and core.log stayed empty because the failure is client side. Fixed entirely on the Mac with a --via transport that pins XDG_RUNTIME_DIR=/var/run/herdr-rt. Nothing on the server was changed. The transport uses key auth on 192.168.10.20:422, not Tailscale SSH, since --via needs something that asks nothing and the default tailnet ACL demands periodic browser re-auth. Also records the reboot caveat (/ is RAM, so the remote hc binary is lost) with a go-script fix written up but not applied, and corrects the 192.168.31.0/24 note: that shim was created for a Pi-hole that AdGuard replaced. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-11-03 22:29:40 +02:00
Kaloyan DanchevandClaude Opus 5	da981a7b40	docs: Unraid exit node approved ... Approved in the Tailscale admin console, so xtrm-unraid now shows as "offers exit node" and appears in tailscale exit-node list. The tailnet has two exit nodes: mikrotik-tailscale (primary) and xtrm-unraid (fallback). Neither has been exercised from the Mac. Noted that without --exit-node-allow-lan-access an exit node cuts the client's own LAN access, which would break an SSH session routed over Tailscale. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-11-03 21:51:49 +02:00
Kaloyan DanchevandClaude Opus 5	666b9baa5c	docs: Unraid re-enrolled on Tailscale as 100.100.208.69 ... Unraid's Tailscale plugin node had been logged out since roughly May 2026. Re-enrolled as xtrm-unraid (100.100.208.69); the stale 100.100.208.70 node was deleted first, so the tailnet issued a new address. Dropped the old 192.168.31.0/24 advertisement — that subnet is only the macvlan shim and nothing reachable lives there. No LAN subnet routes are advertised from Unraid; the MikroTik container stays primary. accept-routes and accept-dns stay off, the former because Unraid sits on 192.168.10.0/24 and would otherwise loop. Tailscale SSH enabled, since sshd binds only 192.168.10.20 and 192.168.31.250 and so never listens on the Tailscale IP. Port forwarding over it verified. Exit node advertised, pending approval in the admin console. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-11-03 21:42:14 +02:00
Kaloyan DanchevandClaude Opus 4.6	ec9659d0cb	Restructure docs: archive VLAN migration, update IPs to VLAN 10 ... Major documentation cleanup after VLAN migration completion: - Archive 12 VLAN project docs to archive/vlan-migration/ - Archive 5 done WIP docs (VLAN proposals, AI stack, Fossorial, DNS backup) - Create standing reference docs 08-DNS-ARCHITECTURE and 09-TAILSCALE-VPN - Renumber docs to clean 01-09 sequence with merged CHANGELOG - Update all active docs from stale 192.168.31.x to current VLAN 10 IPs - Fix CSS1 (.10.9→.10.3) and ZX1 (.10.7→.10.4) IPs in hardware inventory - Clean 06-VLAN-DEVICE-ASSIGNMENT: remove migration columns/sections, fix VLAN 25 subnet Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-06 12:45:16 +02:00