feat: retire Tailscale in favor of Cloudflare Tunnel + LAN - #50
Merged
Merged
Conversation
…ck to LAN Retired the monthly `tailscale cert` renewal job and its scp-to-Watchdog companion together — nothing verifies against the Tailscale-issued cert anymore (Watchdog's CERT_PATH now points at api.travelnet.dev.crt), so renewing and distributing it served no purpose. Added _RETIRED_PATTERNS so the old crontab lines for both actually get stripped on the next run, rather than staying stuck forever (the existing filter only matched patterns from *current* jobs). Retargeted the api.travelnet.dev.crt scp destination, and graceful_reboot.sh's maintenance-mode curl, from the Watchdog's Tailscale hostname to its LAN IP (192.168.0.63). Part of the Tailscale-removal migration, phase 1. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…r Cloudflare Tunnel Dashboard is now fronted by admin.travelnet.dev via Cloudflare Tunnel + Access instead of the Tailscale hostname. Removed the travelnet.tail186ff8.ts.net server block from nginx.conf (its cert had 6 days left and no remaining renewal path, per this morning's watchdog cron retirement). Published the dashboard container's port to the host as 127.0.0.1:5000 only, loopback-scoped, so cloudflared can reach it directly without widening exposure to the LAN. Verified: old Tailscale hostname no longer serves the Dashboard, admin.travelnet.dev correctly challenges through Cloudflare Access, and the untouched api.travelnet.dev / Constellation server blocks still work. Part of the Tailscale-removal migration, phase 2. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Exposes latest and historical location as randomly-jittered coordinates (never raw) for Constellation's "how far apart are we" stat. Jitter distance/bearing is randomised per call so repeated requests can't be averaged out to recover the real point. History is downsampled using the existing LOCATION_CHANGE_RADIUS_M movement threshold so genuine movement survives while dense stationary points collapse. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…oint feat(public): add fuzzed /public/location endpoint for Constellation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 1 of the Tailscale-removal migration:
tailscale certrenewal cron job and its scp-to-Watchdog companion — nothing verifies against the Tailscale-issued cert anymore (Watchdog'sCERT_PATHnow points atapi.travelnet.dev.crt)_RETIRED_PATTERNSso old crontab lines from retired jobs actually get stripped on the next run, instead of lingering foreverapi.travelnet.dev.crtscp destination andgraceful_reboot.sh's maintenance-mode curl from Watchdog's Tailscale hostname to its LAN IPTest plan
🤖 Generated with Claude Code