From 3234d9cee66d90a2811ba91b43d546662c470e4a Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Wed, 22 Apr 2026 01:38:28 -0500 Subject: [PATCH] route vpn.neuralplatform.ai tunnel directly to headscale, bypass traefik --- servers/legion/main.tf | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/servers/legion/main.tf b/servers/legion/main.tf index 89c9836..cd83305 100644 --- a/servers/legion/main.tf +++ b/servers/legion/main.tf @@ -172,12 +172,11 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" { } # vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane) + # Route directly to Headscale — bypasses Traefik which strips the Upgrade: ts2021 header + # Cloudflare handles TLS termination; internal connection is plain HTTP ingress_rule { hostname = "vpn.neuralplatform.ai" - service = "https://traefik.kube-system.svc:443" - origin_request { - no_tls_verify = true - } + service = "http://headscale.headscale.svc.cluster.local:8080" } # Catch-all — must be last