From fb3b5ff5641cf3e1ceb3b275ad45f1d5196c4cd4 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Wed, 22 Apr 2026 01:22:45 -0500
Subject: [PATCH] Add vpn.neuralplatform.ai to Cloudflare tunnel for Headscale
 access

---
 servers/legion/main.tf | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 8461d6f..89c9836 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -171,6 +171,15 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
+    # vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
+    ingress_rule {
+      hostname = "vpn.neuralplatform.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"