VPS (public)
- Internet-facing ingress and stable public IP.
- Runs the Headscale control-plane (Tailscale-compatible).
- Runs Traefik (Docker provider + file provider) to route public and selected internal names.
System Overview
VPS, Docker, Firewalls, Tailnet
A pragmatic home and edge platform: private access, split DNS, TLS termination, observability, and backups.
Goals
- Private, encrypted access to internal apps (LAN services) without exposing them publicly.
- Centralize TLS so internal apps do not each need separate certificates.
- Enforce access via tailnet ACLs/tags plus firewall policy.
- Keep the system observable (metrics/logs) and maintainable (runbooks + backups).
NAS (LAN workloads)
- Runs the majority of apps as Docker stacks.
- Uses Traefik for per-container routing on internal domains.
- Runs Prometheus exporters (node-exporter/cAdvisor) and provides metrics for Grafana.
Firewalls (OPNsense HA pair)
- High availability routing and policy enforcement.
- HAProxy for TLS termination on a VIP: one entrypoint, many hostnames.
- ACME client automates wildcard certificates.
Tailnet (Headscale + clients)
- Device identity + encrypted connectivity between VPS, NAS, firewalls, laptop, phone.
- Split DNS / MagicDNS for internal domains (for example:
*.headscale.planetonyx.net). - Subnet routes can be advertised by router nodes to reach internal segments.
DNS Model (Split-Horizon)
There are effectively multiple DNS "views": public DNS for planetonyx.net and internal DNS
for LAN/tailnet domains like *.lan.planetonyx.net and *.headscale.planetonyx.net.
- Public: names resolvable on the open internet (often terminating on the VPS).
- Private: names resolvable only inside LAN/tailnet (terminating on HAProxy VIP or NAS Traefik).
TLS / Certificates
Wildcards require DNS-01 validation. Certificates are obtained and renewed automatically, then used for TLS termination at the ingress layer (HAProxy and/or VPS Traefik).
*.planetonyx.net*.lan.planetonyx.net*.headscale.planetonyx.net*.srv.planetonyx.net(optional)
The practical result: internal services can run plain HTTP behind the proxy while clients still get valid TLS.
Traffic Flow (Typical)
Example for a private app request:
- Client connects via tailnet to
app.headscale.planetonyx.net. - Split DNS returns an internal IP (VIP or NAS ingress).
- TLS terminates on HAProxy (wildcard cert).
- HAProxy forwards to NAS Traefik, which routes by Host header to the correct container.