Headscale (the self-hosted Tailscale control plane) runs as a new stack on
proxy_net, following the house pattern of syncthing/forgejo/ntfy: own
directory, own compose file, committed config, git-ignored bind-mounted state,
CLI-only admin via docker exec.
- headscale/config.yaml: server_url https://remote.waldson.com.br, MagicDNS
with base domain ts.waldson.com.br, embedded DERP relay with the upstream
Tailscale DERP map dropped so relayed traffic stays on the droplet, HA
subnet-router route failover, SQLite state under /var/lib/headscale. The CLI
unix socket is relocated into the data dir so the UID 1000 container can use
it.
- headscale/compose.yaml: image pinned to the v0.29 minor, runs as 1000:1000,
publishes only STUN on 3478/udp; gRPC not exposed.
- Caddyfile: remote.waldson.com.br reverse-proxies to headscale-headscale-1:8080.
- README: Headscale stack section (deploy, upgrade, user/node CLI runbook),
firewall table row for 3478/udp, DNS row for remote.waldson.com.br.
