fixed health check, added disabled openwebui

butane/oswl_connector.yaml.tftpl

@@ -25,8 +25,17 @@ systemd:
         Wants=network-online.target
         [Service]
         TimeoutStartSec=0
-        # tun is not loaded by default on a stock Flatcar boot.
-        ExecStartPre=-/usr/sbin/modprobe tun
+        # None of these are loaded by default on a stock Flatcar boot, and the
+        # container cannot load them itself: it has NET_ADMIN (enough to write
+        # iptables rules) but not SYS_MODULE, and the image ships no
+        # /lib/modules, so tailscaled's own modprobe fallback fails with
+        # "the filter table does not exist". Loading them here works because
+        # the container shares the host's network namespace (--network host),
+        # so it sees tables created on the host. Without the nat table in
+        # particular there is no ts-postrouting chain, which means no SNAT:
+        # the exit node cannot work at all and subnet-routed replies are sent
+        # back to tailnet addresses the LAN has no route for.
+        ExecStartPre=-/usr/sbin/modprobe -a tun iptable_filter iptable_nat ip6table_filter ip6table_nat nf_tables xt_mark
         # Recommended by Tailscale for subnet routers and exit nodes: without
         # this, UDP throughput through the node is roughly halved.
         ExecStartPre=-/usr/bin/bash -c 'ethtool -K $(ip route show 0.0.0.0/0 | cut -d" " -f5) rx-udp-gro-forwarding on rx-gro-list off'