dig +short vpn.matzka.cloud A

Erwartete Ausgabe: 188.245.52.235

ssh root@ssh2.matzka.cloud

Verzeichnisse anlegen

sudo mkdir -p /opt/headscale/{config,data,scripts}
 cd /opt/headscale

version: '3.8'


services:
   headscale:
     image: headscale/headscale:latest
     container_name: headscale
     restart: unless-stopped
     volumes:
       - ./config/config.yaml:/etc/headscale/config.yaml:ro
       - ./data:/var/lib/headscale
       - ./data/acls.yaml:/etc/headscale/acls.yaml:ro
     command: serve
     environment:
       - TZ=Europe/Vienna
     healthcheck:
       test: ["CMD", "headscale", "health"]
       interval: 30s
       timeout: 10s
       retries: 3
     networks:
       - frontend
     labels:
       # Traefik aktivieren
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"


      # HTTPS Router
       - "traefik.http.routers.headscale.rule=Host(vpn.matzka.cloud)"
       - "traefik.http.routers.headscale.entrypoints=websecure"
       - "traefik.http.routers.headscale.tls=true"
       - "traefik.http.routers.headscale.tls.certresolver=letsencrypt"
       - "traefik.http.routers.headscale.service=headscale"


      # HTTP Redirect
       - "traefik.http.routers.headscale-http.rule=Host(vpn.matzka.cloud)"
       - "traefik.http.routers.headscale-http.entrypoints=web"
       - "traefik.http.routers.headscale-http.middlewares=redirect-to-https@docker"


      # Service
       - "traefik.http.services.headscale.loadbalancer.server.port=8080"


      # Redirect Middleware
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"


networks:
   frontend:
     external: true

# Headscale Configuration

Docs: https://headscale.net/ref/configuration/
Public URL (via Traefik)

server_url: https://vpn.matzka.cloud

Listen Adressen (intern)

listen_addr: 0.0.0.0:8080
 metrics_listen_addr: 0.0.0.0:9090

Database

database:
   type: sqlite
   sqlite:
     path: /var/lib/headscale/db.sqlite

IP-Bereiche für Tailnet

prefixes:
   v4: 100.64.0.0/10
   v6: fd7a:115c:a1e0::/48

DNS-Konfiguration

dns:
   magic_dns: true
   base_domain: matzka.internal
   nameservers:
     global:
       - 1.1.1.1
       - 8.8.8.8

ACL Policy

policy:
   path: /etc/headscale/acls.yaml
   mode: file

Logging

log:
   level: info
   format: text

DERP Server (für Relay-Verbindungen)

derp:
   server:
     enabled: false
   urls:
     - https://controlplane.tailscale.com/derpmap/default
   auto_update_enabled: true
   update_frequency: 24h

Noise (WireGuard-basierte Verschlüsselung)

noise:
   private_key_path: /var/lib/headscale/noise_private.key

Unix Socket für CLI

unix_socket: /var/lib/headscale/headscale.sock
 unix_socket_permission: "0770"

TLS wird von Traefik terminiert

tls_cert_path: ""
 tls_key_path: ""

Ephemeral Nodes

ephemeral_node_inactivity_timeout: 30m

Update Check

disable_check_updates: false

{
   // Headscale ACL Policy
   // Format: HuJSON (JSON mit Kommentaren)


  // Gruppen definieren
   "groups": {
     "group:admins": ["admin@matzka.cloud"]
   },


  // Tag-Besitzer (muss user@ oder group: sein)
   "tagOwners": {
     "tag:n8n-server": ["group:admins"],
     "tag:llm-client": ["group:admins"]
   },


  // Access Control Rules
   "acls": [
     // Erlaubt allen Traffic innerhalb des Tailnets
     {
       "action": "accept",
       "src": ["*"],
       "dst": [":"]
     }
   ],


  // SSH-Regeln (optional)
   "ssh": []
 }

# Container starten
 cd /opt/headscale
 docker compose up -d

Logs prüfen

docker logs headscale

Erwartete Ausgabe:
INF Starting Headscale version=v0.27.1
INF listening and serving HTTP on: 0.0.0.0:8080

# User (Namespace) erstellen
 docker exec headscale headscale users create matzka-cloud

User auflisten

docker exec headscale headscale users list

Ausgabe:
ID | Name | Username     | Email | Created
1  |      | matzka-cloud |       | 2026-01-10 18:55:36

# Tailscale installieren
 curl -fsSL https://tailscale.com/install.sh | sh

Pre-Auth Key für Server generieren (1 Stunde gültig)

docker exec headscale headscale preauthkeys create \
   --user 1 \
   --expiration 1h \
   --reusable=false

Ausgabe: <YOUR_PREAUTH_KEY>
Server mit Headscale verbinden

tailscale up \
   --login-server=https://vpn.matzka.cloud \
   --authkey=<YOUR_PREAUTH_KEY> \
   --accept-routes

Status prüfen

tailscale status

Ausgabe: 100.64.0.1  server2  matzka-cloud  linux  -

# Pre-Auth Key für Client generieren (7 Tage gültig)
 docker exec headscale headscale preauthkeys create \
   --user 1 \
   --expiration 168h \
   --reusable=false

Ausgabe: <YOUR_PREAUTH_KEY>

# PowerShell als Administrator

Download Tailscale

$installerUrl = "https://pkgs.tailscale.com/stable/tailscale-setup-latest.exe"
 Invoke-WebRequest -Uri $installerUrl -OutFile "$env:TEMP\tailscale-setup.exe"

Installation

Start-Process -FilePath "$env:TEMP\tailscale-setup.exe" -Args "/quiet /norestart" -Wait

Mit Headscale verbinden

cd "C:\Program Files\Tailscale"
 .\tailscale.exe up `
   --login-server=https://vpn.matzka.cloud `
   --authkey=<YOUR_PREAUTH_KEY> `
   --hostname=llm-client

Status prüfen

.\tailscale.exe status
 .\tailscale.exe ip -4

# Tailscale installieren
 curl -fsSL https://tailscale.com/install.sh | sh

Mit Headscale verbinden

sudo tailscale up \
   --login-server=https://vpn.matzka.cloud \
   --authkey=<YOUR_PREAUTH_KEY> \
   --hostname=llm-client \
   --accept-routes

Status prüfen

tailscale status
 tailscale ip -4

# Client-IP ermitteln
 docker exec headscale headscale nodes list

/etc/hosts aktualisieren

sudo nano /etc/hosts

Zeile hinzufügen:

100.64.0.3    llm-client litellm.matzka.cloud

Test

ping llm-client -c 4

# PowerShell als Administrator

Port 4000 (LiteLLM) erlauben

New-NetFirewallRule -DisplayName "Tailscale to LiteLLM" `
   -Direction Inbound `
   -Protocol TCP `
   -LocalPort 4000 `
   -Action Allow `
   -Profile Any

ICMP (Ping) erlauben

New-NetFirewallRule -DisplayName "Tailscale ICMP" `
   -Direction Inbound `
   -Protocol ICMPv4 `
   -Action Allow `
   -Profile Any

Regeln prüfen

Get-NetFirewallRule | Where-Object {$_.DisplayName -like "Tailscale"}

# Alle Nodes auflisten
 docker exec headscale headscale nodes list

Beispiel-Ausgabe:
ID | Hostname   | Name       | User         | IP addresses  | Connected
1  | server2    | server2    | matzka-cloud | 100.64.0.1    | online
2  | llm-client | llm-client | matzka-cloud | 100.64.0.3    | online
Node umbenennen

docker exec headscale headscale nodes rename -i 2 --name "windows-llm"

Node löschen

docker exec headscale headscale nodes delete -i 2 --force

Node-Details anzeigen

docker exec headscale headscale nodes show -i 1

# Tag zu Node hinzufügen
 docker exec headscale headscale nodes tag -i 1 -t tag:n8n-server
 docker exec headscale headscale nodes tag -i 2 -t tag:llm-client

Tags prüfen

docker exec headscale headscale nodes list

Tags werden in der Ausgabe angezeigt

# Alle Pre-Auth Keys auflisten
 docker exec headscale headscale preauthkeys list --user 1

Neuen Key erstellen (verschiedene Optionen)
Standard (1 Stunde, einmalig)

docker exec headscale headscale preauthkeys create --user 1

7 Tage gültig

docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

Wiederverwendbar (für mehrere Clients)

docker exec headscale headscale preauthkeys create --user 1 --expiration 168h --reusable

Ephemeral (Node wird nach Disconnect gelöscht)

docker exec headscale headscale preauthkeys create --user 1 --ephemeral

Key mit Tags

docker exec headscale headscale preauthkeys create --user 1 --tags tag:llm-client

Key ablaufen lassen

docker exec headscale headscale preauthkeys expire --user 1 <KEY>

# User auflisten
 docker exec headscale headscale users list

Neuen User erstellen

docker exec headscale headscale users create development

User umbenennen

docker exec headscale headscale users rename -i 1 --new-name production

User löschen (VORSICHT: Löscht alle Nodes!)

docker exec headscale headscale users destroy --force <NAME>

# API Key erstellen
 docker exec headscale headscale apikeys create --expiration 90d

API Keys auflisten

docker exec headscale headscale apikeys list

API Key widerrufen

docker exec headscale headscale apikeys expire <PREFIX>

# Alle Routes auflisten
 docker exec headscale headscale routes list

Route aktivieren

docker exec headscale headscale routes enable -r <ROUTE_ID>

Route deaktivieren

docker exec headscale headscale routes disable -r <ROUTE_ID>

{
   // Gruppen
   "groups": {
     "group:admins": ["admin@matzka.cloud"]
   },


  // Tag-Besitzer
   "tagOwners": {
     "tag:n8n-server": ["group:admins"],
     "tag:llm-client": ["group:admins"]
   },


  // Regeln
   "acls": [
     // n8n → LiteLLM nur auf Port 4000
     {
       "action": "accept",
       "src": ["tag:n8n-server"],
       "dst": ["tag:llm-client:4000"]
     },
     // ICMP für Monitoring
     {
       "action": "accept",
       "src": ["tag:n8n-server"],
       "dst": ["tag:llm-client:*"],
       "proto": "icmp"
     },
     // Rückweg für ICMP
     {
       "action": "accept",
       "src": ["tag:llm-client"],
       "dst": ["tag:n8n-server:*"],
       "proto": "icmp"
     }
   ]
 }

{
   "acls": [
     // Alles erlauben (nur für Entwicklung!)
     {
       "action": "accept",
       "src": ["*"],
       "dst": [":"]
     }
   ]
 }

# ACL-Syntax prüfen
 docker exec headscale headscale policy check

Aktuelle ACL anzeigen

docker exec headscale headscale policy get

ACL aus Datei laden

docker exec headscale headscale policy set --file /etc/headscale/acls.yaml

Method: POST
 URL: http://llm-client:4000/v1/chat/completions
 Authentication: Header Auth
   Name: Authorization
   Value: Bearer sk-your-api-key-here
 Body Content Type: JSON
 Body:
   {
     "model": "llama3.1",
     "messages": [
       {"role": "user", "content": "{{ $json.prompt }}"}
     ],
     "max_tokens": 500
   }

Method: POST
 URL: http://llm-client:4000/v1/embeddings
 Authentication: Header Auth (wie oben)
 Body:
   {
     "model": "nomic-embed-text",
     "input": "{{ $json.text }}"
   }

curl -X POST http://llm-client:4000/v1/chat/completions \
   -H "Content-Type: application/json" \
   -H "Authorization: Bearer sk-matzka-..." \
   -d '{"model":"llama3.1","messages":[{"role":"user","content":"Hello"}],"max_tokens":50}'

# 1. Neuen Key generieren
 openssl rand -base64 48

2. In .env aktualisieren
3. LiteLLM neu starten

docker-compose restart litellm

4. In n8n Workflows aktualisieren

# Konfigurierte Regeln:

- Port 4000/TCP - LiteLLM API
- Port 11434/TCP - Ollama API
- Port 80/TCP - Caddy HTTP
- Port 443/TCP - Caddy HTTPS
- ICMP - Ping
Regeln anzeigen (PowerShell)

Get-NetFirewallRule | Where-Object {$_.DisplayName -like "Docker -*"}

ping llm-client -c 4

64 bytes from llm-client (100.64.0.3): icmp_seq=1 ttl=128 time=87.3 ms
64 bytes from llm-client (100.64.0.3): icmp_seq=2 ttl=128 time=20.4 ms
64 bytes from llm-client (100.64.0.3): icmp_seq=3 ttl=128 time=20.2 ms
64 bytes from llm-client (100.64.0.3): icmp_seq=4 ttl=128 time=19.8 ms
--- 0% packet loss, avg ~37ms

# Logs prüfen
 docker logs headscale

Häufige Fehler:
- "Invalid Owner" → ACL-Syntax prüfen (user@, group:, tag:)
- "database locked" → Nur ein Headscale-Prozess erlaubt
- "bind: address already in use" → Port bereits belegt
Konfiguration testen

docker exec headscale headscale configtest

# Server-seitig prüfen
 docker exec headscale headscale nodes list

DNS prüfen

dig +short vpn.matzka.cloud

HTTPS erreichbar?

curl -I https://vpn.matzka.cloud

Pre-Auth Key gültig?

docker exec headscale headscale preauthkeys list --user 1

Neuen Key erstellen falls abgelaufen

docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

# Beide Nodes online?
 docker exec headscale headscale nodes list

Tailscale Status auf Server

tailscale status

Tailscale Status auf Client

tailscale status  # Linux
 & "C:\Program Files\Tailscale\tailscale.exe" status  # Windows

Firewall prüfen (Windows)

Get-NetFirewallRule | Where-Object {$_.DisplayName -like "Tailscale"}

Firewall prüfen (Linux)

sudo ufw status

# Vom Server testen
 nc -zv llm-client 4000

Direkt mit IP testen

nc -zv 100.64.0.3 4000

Wenn IP funktioniert aber Hostname nicht:

cat /etc/hosts | grep llm-client

Service auf Client läuft?
Windows:

netstat -an | findstr 4000

Linux:

ss -tulpn | grep 4000

Docker-Ports prüfen

docker port <container_name>

# Wenn ein Node eine neue IP bekommt:

1. Alten Node löschen

docker exec headscale headscale nodes delete -i <ID> --force

2. Neuen Pre-Auth Key erstellen

docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

3. Client neu verbinden

tailscale up --login-server=https://vpn.matzka.cloud --authkey=<NEW_KEY>

4. /etc/hosts aktualisieren

sudo sed -i 's/100.64.0.2/100.64.0.3/g' /etc/hosts

# Live-Logs
 docker logs -f headscale

Letzte 100 Zeilen

docker logs --tail 100 headscale

Fehler filtern

docker logs headscale 2>&1 | grep -E "(ERR|FTL|error)"

Verbindungsversuche

docker logs headscale 2>&1 | grep -i "register"

# 1. Pre-Auth Key auf Server erstellen
 ssh root@ssh2.matzka.cloud
 docker exec headscale headscale preauthkeys create --user 1 --expiration 168h

2. Auf Client verbinden
Windows:

tailscale up --login-server=https://vpn.matzka.cloud --authkey=<KEY> --hostname=<NAME>

Linux:

sudo tailscale up --login-server=https://vpn.matzka.cloud --authkey=<KEY> --hostname=<NAME>

3. Node-Liste prüfen

docker exec headscale headscale nodes list

4. /etc/hosts auf Server aktualisieren

echo "<TAILSCALE_IP>    <HOSTNAME>" | sudo tee -a /etc/hosts

5. Verbindung testen

ping <HOSTNAME>
 nc -zv <HOSTNAME> <PORT>