KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(tailscale): document subnet router HA + fix resolv.conf immutable bug

Browse Source 
Adds section documenting the redundant subnet router architecture:
both netinfra-01 and netinfra-02 now advertise 192.168.0.0/22 for
automatic failover. This fixes the SPOF where all remote monitoring
(Uptime Kuma on Cloudron VPS) routed through netinfra-01 alone —
any DERP bounce or Docker LinkChange event took down visibility to
every LAN host simultaneously.

Also documents the resolv.conf immutable flag fix on netinfra-01
(chattr -i) that was preventing tailscaled from updating DNS config
after every link change event.

[#377]
This commit is contained in:
mrcharles
2026-08-06 12:53:36 -05:00
parent 30ddb37b34
commit 75e229c0ab
1 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/server-build/tailscale.md
+35 -1
View File
@@ -97,7 +97,41 @@ tailscale up --accept-dns=false
- No dependency on LAN reachability
- Accept the `tailscaled` dependency (if the tunnel is down, you're off-network anyway)
## 6. Known items / future work
## 6. Subnet router HA (redundant routing)
> **Redmine:** [#377](https://projects.knownelement.com/issues/377)
Both DNS nodes advertise the LAN subnet as Tailscale subnet routes,
providing automatic failover for remote monitoring (Uptime Kuma on the
Cloudron VPS) and off-site access:
| Node | Tailscale IP | Advertised route | Role |
|------|-------------|-----------------|------|
| pfv-netinfra-01 | 100.70.181.72 | 192.168.0.0/22 | Primary subnet router + exit node |
| pfv-netinfra-02 | 100.71.171.20 | 192.168.0.0/22 | Secondary subnet router (failover) |
To configure on a node:
```bash
sudo tailscale set --advertise-routes=192.168.0.0/22
```
**Both routes must be approved** in the Tailscale admin console
(https://login.tailscale.com/admin/machines) for failover to activate.
Tailscale uses the primary router by default and fails over to the
secondary if the primary's tunnel drops.
### Known instability factors (2026-08-06, [#377])
- **DERP relay bouncing:** netinfra-01 was observed switching between DERP
relays (#9, #12, #13) every ~15 minutes, causing brief tunnel disruptions.
- **Docker LinkChange events:** container create/destroy adds/removes bridge
interfaces, triggering `LinkChange: major, rebinding` in tailscaled and
momentarily dropping all connections.
- **resolv.conf immutable flag:** netinfra-01 had the `+i` (immutable)
attribute on `/etc/resolv.conf`, preventing tailscaled from updating DNS
config after link changes. Fixed by `chattr -i /etc/resolv.conf`.
## 7. Known items / future work
1. **Pi-hole upstream configuration.** Pi-hole on both hosts should forward
to the local Technitium instance (port 5300) for `knel.net` and to an