dig +short vpn.matzka.cloud A
# Erwartete Ausgabe: 188.245.52.235

ssh root@ssh2.matzka.cloud

# Verzeichnisse anlegen
sudo mkdir -p /opt/headscale/{config,data,scripts}
cd /opt/headscale

version: '3.8'

services:
  headscale:
    image: headscale/headscale:latest
    container_name: headscale
    restart: unless-stopped
    volumes:
      - ./config/config.yaml:/etc/headscale/config.yaml:ro
      - ./data:/var/lib/headscale
      - ./data/acls.yaml:/etc/headscale/acls.yaml:ro
    command: serve
    environment:
      - TZ=Europe/Vienna
    healthcheck:
      test: ["CMD", "headscale", "health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - frontend
    labels:
      # Traefik aktivieren
      - "traefik.enable=true"
      - "traefik.docker.network=frontend"

      # HTTPS Router
      - "traefik.http.routers.headscale.rule=Host(`vpn.matzka.cloud`)"
      - "traefik.http.routers.headscale.entrypoints=websecure"
      - "traefik.http.routers.headscale.tls=true"
      - "traefik.http.routers.headscale.tls.certresolver=letsencrypt"
      - "traefik.http.routers.headscale.service=headscale"

      # HTTP Redirect
      - "traefik.http.routers.headscale-http.rule=Host(`vpn.matzka.cloud`)"
      - "traefik.http.routers.headscale-http.entrypoints=web"
      - "traefik.http.routers.headscale-http.middlewares=redirect-to-https@docker"

      # Service
      - "traefik.http.services.headscale.loadbalancer.server.port=8080"

      # Redirect Middleware
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"

networks:
  frontend:
    external: true

# Headscale Configuration
# Docs: https://headscale.net/ref/configuration/

# Public URL (via Traefik)
server_url: https://vpn.matzka.cloud

# Listen Adressen (intern)
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 0.0.0.0:9090

# Database
database:
  type: sqlite
  sqlite:
    path: /var/lib/headscale/db.sqlite

# IP-Bereiche für Tailnet
prefixes:
  v4: 100.64.0.0/10
  v6: fd7a:115c:a1e0::/48

# DNS-Konfiguration
dns:
  magic_dns: true
  base_domain: matzka.internal
  nameservers:
    global:
      - 1.1.1.1
      - 8.8.8.8

# ACL Policy
policy:
  path: /etc/headscale/acls.yaml
  mode: file

# Logging
log:
  level: info
  format: text

# DERP Server (für Relay-Verbindungen)
derp:
  server:
    enabled: false
  urls:
    - https://controlplane.tailscale.com/derpmap/default
  auto_update_enabled: true
  update_frequency: 24h

# Noise (WireGuard-basierte Verschlüsselung)
noise:
  private_key_path: /var/lib/headscale/noise_private.key

# Unix Socket für CLI
unix_socket: /var/lib/headscale/headscale.sock
unix_socket_permission: "0770"

# TLS wird von Traefik terminiert
tls_cert_path: ""
tls_key_path: ""

# Ephemeral Nodes
ephemeral_node_inactivity_timeout: 30m

# Update Check
disable_check_updates: false

{
  // Headscale ACL Policy
  // Format: HuJSON (JSON mit Kommentaren)

  // Gruppen definieren
  "groups": {
    "group:admins": ["admin@matzka.cloud"]
  },

  // Tag-Besitzer (muss user@ oder group: sein)
  "tagOwners": {
    "tag:n8n-server": ["group:admins"],
    "tag:llm-client": ["group:admins"]
  },

  // Access Control Rules
  "acls": [
    // Erlaubt allen Traffic innerhalb des Tailnets
    {
      "action": "accept",
      "src": ["*"],
      "dst": ["*:*"]
    }
  ],

  // SSH-Regeln (optional)
  "ssh": []
}

# Container starten
cd /opt/headscale
docker compose up -d

# Logs prüfen
docker logs headscale

# Erwartete Ausgabe:
# INF Starting Headscale version=v0.27.1
# INF listening and serving HTTP on: 0.0.0.0:8080

# User (Namespace) erstellen
docker exec headscale headscale users create matzka-cloud

# User auflisten
docker exec headscale headscale users list

# Ausgabe:
# ID | Name | Username     | Email | Created
# 1  |      | matzka-cloud |       | 2026-01-10 18:55:36

# Tailscale installieren
curl -fsSL https://tailscale.com/install.sh | sh

# Pre-Auth Key für Server generieren (1 Stunde gültig)
docker exec headscale headscale preauthkeys create \
  --user 1 \
  --expiration 1h \
  --reusable=false

# Ausgabe: <YOUR_PREAUTH_KEY>

# Server mit Headscale verbinden
tailscale up \
  --login-server=https://vpn.matzka.cloud \
  --authkey=<YOUR_PREAUTH_KEY> \
  --accept-routes

# Status prüfen
tailscale status
# Ausgabe: 100.64.0.1  server2  matzka-cloud  linux  -

# Pre-Auth Key für Client generieren (7 Tage gültig)
docker exec headscale headscale preauthkeys create \
  --user 1 \
  --expiration 168h \
  --reusable=false

# Ausgabe: <YOUR_PREAUTH_KEY>

# PowerShell als Administrator

# Download Tailscale
$installerUrl = "https://pkgs.tailscale.com/stable/tailscale-setup-latest.exe"
Invoke-WebRequest -Uri $installerUrl -OutFile "$env:TEMP\tailscale-setup.exe"

# Installation
Start-Process -FilePath "$env:TEMP\tailscale-setup.exe" -Args "/quiet /norestart" -Wait

# Mit Headscale verbinden
cd "C:\Program Files\Tailscale"
.\tailscale.exe up `
  --login-server=https://vpn.matzka.cloud `
  --authkey=<YOUR_PREAUTH_KEY> `
  --hostname=llm-client

# Status prüfen
.\tailscale.exe status
.\tailscale.exe ip -4

# Tailscale installieren
curl -fsSL https://tailscale.com/install.sh | sh

# Mit Headscale verbinden
sudo tailscale up \
  --login-server=https://vpn.matzka.cloud \
  --authkey=<YOUR_PREAUTH_KEY> \
  --hostname=llm-client \
  --accept-routes

# Status prüfen
tailscale status
tailscale ip -4

# Client-IP ermitteln
docker exec headscale headscale nodes list

# /etc/hosts aktualisieren
sudo nano /etc/hosts

# Zeile hinzufügen:
100.64.0.3    llm-client litellm.matzka.cloud

# Test
ping llm-client -c 4

# PowerShell als Administrator

# Port 4000 (LiteLLM) erlauben
New-NetFirewallRule -DisplayName "Tailscale to LiteLLM" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 4000 `
  -Action Allow `
  -Profile Any

# ICMP (Ping) erlauben
New-NetFirewallRule -DisplayName "Tailscale ICMP" `
  -Direction Inbound `
  -Protocol ICMPv4 `
  -Action Allow `
  -Profile Any

# Regeln prüfen
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Tailscale*"}

# Alle Nodes auflisten
docker exec headscale headscale nodes list

# Beispiel-Ausgabe:
# ID | Hostname   | Name       | User         | IP addresses  | Connected
# 1  | server2    | server2    | matzka-cloud | 100.64.0.1    | online
# 2  | llm-client | llm-client | matzka-cloud | 100.64.0.3    | online

# Node umbenennen
docker exec headscale headscale nodes rename -i 2 --name "windows-llm"

# Node löschen
docker exec headscale headscale nodes delete -i 2 --force

# Node-Details anzeigen
docker exec headscale headscale nodes show -i 1

# Tag zu Node hinzufügen
docker exec headscale headscale nodes tag -i 1 -t tag:n8n-server
docker exec headscale headscale nodes tag -i 2 -t tag:llm-client

# Tags prüfen
docker exec headscale headscale nodes list
# Tags werden in der Ausgabe angezeigt

# Alle Pre-Auth Keys auflisten
docker exec headscale headscale preauthkeys list --user 1

# Neuen Key erstellen (verschiedene Optionen)
# Standard (1 Stunde, einmalig)
docker exec headscale headscale preauthkeys create --user 1

# 7 Tage gültig
docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

# Wiederverwendbar (für mehrere Clients)
docker exec headscale headscale preauthkeys create --user 1 --expiration 168h --reusable

# Ephemeral (Node wird nach Disconnect gelöscht)
docker exec headscale headscale preauthkeys create --user 1 --ephemeral

# Key mit Tags
docker exec headscale headscale preauthkeys create --user 1 --tags tag:llm-client

# Key ablaufen lassen
docker exec headscale headscale preauthkeys expire --user 1 <KEY>

# User auflisten
docker exec headscale headscale users list

# Neuen User erstellen
docker exec headscale headscale users create development

# User umbenennen
docker exec headscale headscale users rename -i 1 --new-name production

# User löschen (VORSICHT: Löscht alle Nodes!)
docker exec headscale headscale users destroy --force <NAME>

# API Key erstellen
docker exec headscale headscale apikeys create --expiration 90d

# API Keys auflisten
docker exec headscale headscale apikeys list

# API Key widerrufen
docker exec headscale headscale apikeys expire <PREFIX>

# Alle Routes auflisten
docker exec headscale headscale routes list

# Route aktivieren
docker exec headscale headscale routes enable -r <ROUTE_ID>

# Route deaktivieren
docker exec headscale headscale routes disable -r <ROUTE_ID>

{
  // Gruppen
  "groups": {
    "group:admins": ["admin@matzka.cloud"]
  },

  // Tag-Besitzer
  "tagOwners": {
    "tag:n8n-server": ["group:admins"],
    "tag:llm-client": ["group:admins"]
  },

  // Regeln
  "acls": [
    // n8n → LiteLLM nur auf Port 4000
    {
      "action": "accept",
      "src": ["tag:n8n-server"],
      "dst": ["tag:llm-client:4000"]
    },
    // ICMP für Monitoring
    {
      "action": "accept",
      "src": ["tag:n8n-server"],
      "dst": ["tag:llm-client:*"],
      "proto": "icmp"
    },
    // Rückweg für ICMP
    {
      "action": "accept",
      "src": ["tag:llm-client"],
      "dst": ["tag:n8n-server:*"],
      "proto": "icmp"
    }
  ]
}

{
  "acls": [
    // Alles erlauben (nur für Entwicklung!)
    {
      "action": "accept",
      "src": ["*"],
      "dst": ["*:*"]
    }
  ]
}

# ACL-Syntax prüfen
docker exec headscale headscale policy check

# Aktuelle ACL anzeigen
docker exec headscale headscale policy get

# ACL aus Datei laden
docker exec headscale headscale policy set --file /etc/headscale/acls.yaml

Method: POST
URL: http://llm-client:4000/v1/chat/completions
Authentication: Header Auth
  Name: Authorization
  Value: Bearer sk-your-api-key-here
Body Content Type: JSON
Body:
  {
    "model": "llama3.1",
    "messages": [
      {"role": "user", "content": "{{ $json.prompt }}"}
    ],
    "max_tokens": 500
  }

Method: POST
URL: http://llm-client:4000/v1/embeddings
Authentication: Header Auth (wie oben)
Body:
  {
    "model": "nomic-embed-text",
    "input": "{{ $json.text }}"
  }

curl -X POST http://llm-client:4000/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk-matzka-..." \
  -d '{"model":"llama3.1","messages":[{"role":"user","content":"Hello"}],"max_tokens":50}'

# 1. Neuen Key generieren
openssl rand -base64 48

# 2. In .env aktualisieren
# 3. LiteLLM neu starten
docker-compose restart litellm

# 4. In n8n Workflows aktualisieren

# Konfigurierte Regeln:
# - Port 4000/TCP - LiteLLM API
# - Port 11434/TCP - Ollama API
# - Port 80/TCP - Caddy HTTP
# - Port 443/TCP - Caddy HTTPS
# - ICMP - Ping

# Regeln anzeigen (PowerShell)
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "Docker -*"}

ping llm-client -c 4
# 64 bytes from llm-client (100.64.0.3): icmp_seq=1 ttl=128 time=87.3 ms
# 64 bytes from llm-client (100.64.0.3): icmp_seq=2 ttl=128 time=20.4 ms
# 64 bytes from llm-client (100.64.0.3): icmp_seq=3 ttl=128 time=20.2 ms
# 64 bytes from llm-client (100.64.0.3): icmp_seq=4 ttl=128 time=19.8 ms
# --- 0% packet loss, avg ~37ms

# Logs prüfen
docker logs headscale

# Häufige Fehler:
# - "Invalid Owner" → ACL-Syntax prüfen (user@, group:, tag:)
# - "database locked" → Nur ein Headscale-Prozess erlaubt
# - "bind: address already in use" → Port bereits belegt

# Konfiguration testen
docker exec headscale headscale configtest

# Server-seitig prüfen
docker exec headscale headscale nodes list

# DNS prüfen
dig +short vpn.matzka.cloud

# HTTPS erreichbar?
curl -I https://vpn.matzka.cloud

# Pre-Auth Key gültig?
docker exec headscale headscale preauthkeys list --user 1

# Neuen Key erstellen falls abgelaufen
docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

# Beide Nodes online?
docker exec headscale headscale nodes list

# Tailscale Status auf Server
tailscale status

# Tailscale Status auf Client
tailscale status  # Linux
& "C:\Program Files\Tailscale\tailscale.exe" status  # Windows

# Firewall prüfen (Windows)
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Tailscale*"}

# Firewall prüfen (Linux)
sudo ufw status

# Vom Server testen
nc -zv llm-client 4000

# Direkt mit IP testen
nc -zv 100.64.0.3 4000

# Wenn IP funktioniert aber Hostname nicht:
cat /etc/hosts | grep llm-client

# Service auf Client läuft?
# Windows:
netstat -an | findstr 4000
# Linux:
ss -tulpn | grep 4000

# Docker-Ports prüfen
docker port <container_name>

# Wenn ein Node eine neue IP bekommt:

# 1. Alten Node löschen
docker exec headscale headscale nodes delete -i <ID> --force

# 2. Neuen Pre-Auth Key erstellen
docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

# 3. Client neu verbinden
tailscale up --login-server=https://vpn.matzka.cloud --authkey=<NEW_KEY>

# 4. /etc/hosts aktualisieren
sudo sed -i 's/100.64.0.2/100.64.0.3/g' /etc/hosts

# Live-Logs
docker logs -f headscale

# Letzte 100 Zeilen
docker logs --tail 100 headscale

# Fehler filtern
docker logs headscale 2>&1 | grep -E "(ERR|FTL|error)"

# Verbindungsversuche
docker logs headscale 2>&1 | grep -i "register"

# 1. Pre-Auth Key auf Server erstellen
ssh root@ssh2.matzka.cloud
docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

# 2. Auf Client verbinden
# Windows:
tailscale up --login-server=https://vpn.matzka.cloud --authkey=<KEY> --hostname=<NAME>

# Linux:
sudo tailscale up --login-server=https://vpn.matzka.cloud --authkey=<KEY> --hostname=<NAME>

# 3. Node-Liste prüfen
docker exec headscale headscale nodes list

# 4. /etc/hosts auf Server aktualisieren
echo "<TAILSCALE_IP>    <HOSTNAME>" | sudo tee -a /etc/hosts

# 5. Verbindung testen
ping <HOSTNAME>
nc -zv <HOSTNAME> <PORT>