headscale: rename coordination endpoint to vpn.neuralplatform.ai

servers/legion/apps/headscale.yaml

@@ -5,24 +5,27 @@ metadata:
   namespace: headscale
 data:
   config.yaml: |
-    server_url: https://headscale.neuralplatform.ai
+    server_url: https://vpn.neuralplatform.ai
     listen_addr: 0.0.0.0:8080
     grpc_listen_addr: 0.0.0.0:50443
     grpc_allow_insecure: true
     private_key_path: /data/private.key
     noise:
       private_key_path: /data/noise_private.key
-    ip_prefixes:
-      - 100.64.0.0/10
-    db_type: sqlite3
-    db_path: /data/headscale.db
+    prefixes:
+      v4: 100.64.0.0/10
+    database:
+      type: sqlite
+      sqlite:
+        path: /data/headscale.db
     log:
       level: info
-    dns_config:
-      nameservers:
-        - 100.64.0.1
+    dns:
       magic_dns: true
       base_domain: vpn.neuralplatform.ai
+      nameservers:
+        global:
+          - 100.64.0.1
     derp:
       server:
         enabled: false
@@ -111,3 +114,31 @@ spec:
       port: 50443
       targetPort: 50443
   type: ClusterIP
+---
+# Traefik ingress — direct TLS, bypasses Cloudflare proxy so WebSocket
+# upgrades (required by Tailscale TS2021) pass through unmodified.
+# DNS: vpn.neuralplatform.ai A 72.204.75.49 (DNS-only, not proxied)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: headscale
+  namespace: headscale
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  tls:
+    - hosts:
+        - vpn.neuralplatform.ai
+      secretName: headscale-tls
+  rules:
+    - host: vpn.neuralplatform.ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: headscale
+                port:
+                  number: 8080