dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
Files
docs-kimi-new
nixfiles/docs/sites/colony/shill/containers/waffletail.md
T
jackos1998 d51f2d62b6 docs: Document the deployment 
Add a top-level README mapping the boxes and a full docs/ tree: topic
pages (architecture, networking, deployment), per-site box pages for
colony and home with containers nested under their hosts, remote and
mobile boxes, the installer, and the home switch fabric reference
(folded in from home-switches.md, with AGENTS.md and code comments
retargeted to its new home). Box pages carry marked assignment tables
that CI regenerates from nixos.allAssignments.

AGENTS.md points at the new docs and keeps its terse agent version of
the mechanics, referring to the topic pages for depth.
2026-07-26 19:16:43 +01:00

2.0 KiB
Raw Permalink Blame History

waffletail

The colony Tailscale node: a subnet router and exit node that advertises the colony prefixes into the tailnet.

Role

  • tailscale — joins via an auth key from secrets (tailscale-auth.key) against the self-hosted Headscale control plane at hs.nul.ie. Runs with --netfilter-mode=off (firewall is managed by the repo's own nftables rules), --advertise-exit-node, and --advertise-routes covering the whole colony — 10.100.0.0/16 and 2a0e:97c0:4d2:10::/60. Does not accept routes itself. Listens on UDP 41641 (openFirewall), which estuary port-forwards to this container.
  • shill routes the Tailscale prefixes (100.64.0.0/10, fd7a:115c:a1e0::/48) to this container, so colony hosts can reach tailnet clients and vice versa.
  • nftables: tailscale0 is a trusted interface; forwarding from host0 into Tailscale is allowed for the colony source ranges, and tailnet-sourced traffic leaving via host0 is SNATed to the container's colony addresses (except when destined to the colony ranges themselves).

Network assignments

Name Assignment IPv4 IPv6 Domain Notes
waffletail-ctr internal 10.100.2.9/24 gw 10.100.2.1 2a0e:97c0:4d2:12::9/64 ams1.int.nul.ie
waffletail tailscale 100.64.0.5/32 fd7a:115c:a1e0::5/128 —

Two assignments: internal on the ctrs network like the other containers, and tailscale — its addresses on the tailnet itself (host 5 of 100.64.0.0/10 and fd7a:115c:a1e0::/48; no DNS name).

Notable config files

Reference in New Issue View Git Blame Copy Permalink