Headscale (the self-hosted Tailscale control plane) runs as a new stack on
proxy_net, following the house pattern of syncthing/forgejo/ntfy: own
directory, own compose file, committed config, git-ignored bind-mounted state,
CLI-only admin via docker exec.
- headscale/config.yaml: server_url https://remote.waldson.com.br, MagicDNS
with base domain ts.waldson.com.br, embedded DERP relay with the upstream
Tailscale DERP map dropped so relayed traffic stays on the droplet, HA
subnet-router route failover, SQLite state under /var/lib/headscale. The CLI
unix socket is relocated into the data dir so the UID 1000 container can use
it.
- headscale/compose.yaml: image pinned to the v0.29 minor, runs as 1000:1000,
publishes only STUN on 3478/udp; gRPC not exposed.
- Caddyfile: remote.waldson.com.br reverse-proxies to headscale-headscale-1:8080.
- README: Headscale stack section (deploy, upgrade, user/node CLI runbook),
firewall table row for 3478/udp, DNS row for remote.waldson.com.br.
Run a single-user, self-hosted git server on the droplet. New forgejo/ compose
stack on proxy_net: git-over-SSH is published on host 2222 (container sshd on 22)
so the host's admin sshd keeps port 22, while the web UI (3000) is unpublished
and reached only through the central Caddy, which gains a git.waldson.com.br
reverse-proxy block. SQLite backs the instance and all state - repos, database,
generated app.ini, SSH host keys - lives in the forgejo_data volume, so a
force-recreate preserves every user and repository.
The full configuration is injected via FORGEJO__ environment variables and
written into app.ini on startup: registration disabled, Forgejo Actions
disabled, and DOMAIN/SSH_DOMAIN/SSH_PORT set so clone URLs carry the right host
and port. INSTALL_LOCK skips the web installer, so the single admin is created
from the CLI; the security posture survives recreation instead of depending on
installer clicks. README documents the deploy, admin-creation, SSH-config, and
upgrade runbook.
Run an always-on Syncthing peer on the droplet as an off-site copy for the
owner's folders. New syncthing/ compose stack on proxy_net: the sync protocol
is published on host 22000 (tcp+udp) for direct device connections, while the
GUI (8384) is unpublished and reached only through the central Caddy, which
gains a sync.waldson.com.br reverse-proxy block. Config and folder data live on
a host bind mount for SSH inspection and are git-ignored. README documents the
deploy, upgrade, and interactive pairing runbook.
Binding the GUI to a non-loopback address (STGUIADDRESS) also disables
Syncthing's DNS-rebinding host check, so the proxy needs no Host rewrite.
The droplet's single Caddy container terminates TLS for every site and routes
each host to its upstream over proxy_net. Until now its only copy lived on the
server; capture compose.yaml and the Caddyfile here, with a README covering how
to add a site and reload without downtime. ACME material is git-ignored.
