fixed health check, added disabled openwebui

flatcar-todo.md

@@ -112,33 +112,26 @@ as an exit node. Three things have to happen outside this repo:
    It must be both ephemeral and reusable -- the VM keeps tailscaled's state in
    memory, so it re-registers on every boot:
 
+   The key also carries the tag that drives route auto-approval (see 2), so
+   the VM never has to pass `--advertise-tags` itself:
+
    ```bash
-   headscale preauthkeys create --user <user> --ephemeral --reusable --expiration 8760h
+   headscale preauthkeys create --user <user> --ephemeral --reusable \
+     --tags tag:oswl-connector --expiration 8760h
    ```
 
    Until that secret exists, `tofu plan` fails while rendering
    `butane/oswl_connector.yaml.tftpl` (`templatefile`: no value for
    "headscale_authkey").
 
-2. **Approve the route and the exit node** once the VM has registered --
-   headscale honours neither until enabled:
+2. **Route approval is automatic, via the key's tag.** The preauth key applies
+   `tag:oswl-connector` as a forced tag at registration, and headscale's
+   `autoApprovers` policy approves the subnet route and the exit node for that
+   tag. This is what makes the node's ephemerality survivable: it re-registers
+   on every boot and after every `tofu taint` rebuild, and each time the routes
+   come back approved without anyone touching headscale.
 
-   ```bash
-   headscale nodes list
-   headscale nodes approve-routes -i <id> -r 192.168.7.0/24,0.0.0.0/0,::/0
-   ```
-
-   (On headscale older than 0.26 that is `headscale routes list` plus
-   `headscale routes enable -r <route-id>`, once per route.)
-
-   Because the node is ephemeral it re-registers on every boot, so this has to
-   be redone after each reboot and after each `tofu taint` rebuild. Headscale
-   can do it automatically, but **the policy has to exist before the node
-   advertises the tag** -- `tailscale up --advertise-tags` fails outright if
-   the tag is not owned by the registering user, which takes tailscaled down
-   with it. So: add the policy first, confirm it loads, and only then add
-   `--advertise-tags=tag:oswl-connector` to `TS_EXTRA_ARGS` in
-   `butane/oswl_connector.yaml.tftpl` and rebuild the VM.
+   The policy this depends on:
 
    ```json
    {
@@ -154,21 +147,28 @@ as an exit node. Three things have to happen outside this repo:
    }
    ```
 
-   `<user>@` is the user the preauth key belongs to (policy v2 spells
-   usernames with a trailing `@`). Load the policy with `policy.mode: file` +
-   `policy.path` in headscale's `config.yaml`, or `headscale policy set -f
-   policy.json` in database mode.
+   Two things worth knowing if it ever stops approving:
 
-   Two further caveats if you go that route:
-
-   - **List the tag in `autoApprovers`, not a user or a group.** Approval by
+   - **`autoApprovers` must name the tag, not a user or a group.** Approval by
      username or group silently does not fire for a node whose identity is a
-     tag ([#2891](https://github.com/juanfont/headscale/issues/2891), open as
-     of 0.27.1). Naming the tag is both the documented form and the workaround.
+     forced tag ([#2891](https://github.com/juanfont/headscale/issues/2891),
+     open as of 0.27.1).
    - **A tagged node is governed by the tag in ACLs, not by its user.** With
      headscale's default allow-all policy that changes nothing, but if you
      later write real ACL rules, `tag:oswl-connector` needs its own grants.
 
+   To approve by hand (if the policy is ever removed):
+
+   ```bash
+   headscale nodes list
+   headscale nodes approve-routes -i <id> -r 192.168.7.0/24,0.0.0.0/0,::/0
+   ```
+
+   Do not add `--advertise-tags` to `TS_EXTRA_ARGS` to try to set the tag from
+   the client side: the key already sets it, and `tailscale up` fails outright
+   if the registering user does not own the tag, which takes tailscaled down
+   with it.
+
 3. **Check the LAN's return path.** The VM has one NIC on VLAN 7, so clients
    reaching 192.168.7.0/24 through the tunnel arrive with a tailnet source
    address. The container runs with `--network host` and tailscaled installs
@@ -176,6 +176,18 @@ as an exit node. Three things have to happen outside this repo:
    without touching the router; drop that default only if you add a route for
    the tailnet CIDR on the 192.168.7.0/24 gateway.
 
+   That SNAT is only real if the netfilter modules are loaded -- the container
+   has NET_ADMIN but no SYS_MODULE and no `/lib/modules`, so it cannot load
+   them itself. The `modprobe -a` line in `tailscaled.service` loads them on
+   the host, where the container picks them up through `--network host`. If
+   tailscale ever reports "packet filter not installed" or
+   "cannot create the ts-input chain", that line is what to check:
+
+   ```bash
+   lsmod | grep -E 'iptable|ip6table|nf_nat|nf_tables'
+   docker exec tailscaled iptables -t nat -S | grep ts-postrouting
+   ```
+
 Note the same caveat as the Gitea runner: the auth key ends up in plaintext in
 the rendered Ignition snippet under `/var/lib/vz/snippets` on goose.