# Tailscale

Secure mesh VPN connecting all Kaburu infrastructure nodes using WireGuard. No port forwarding required anywhere — all nodes reach each other directly over the Tailscale subnet.

Account: `kentsteve@hotmail.com`

## Nodes

| Hostname | Tailscale IP | Role |
|----------|-------------|------|
| kaburuaibox | 100.120.18.44 | AI nerve centre — Z840 |
| kaburusvr.uk | 100.112.54.2 | Hetzner VPS — hosting |
| kabururd | 100.122.46.3 | Hetzner CX23 — RustDesk relay (moved 2026-08-05) |
| ubuntu-svr | 100.101.7.86 | Minisforum — Frigate/Omada |
| firewall | 100.127.64.74 | OPNsense router |
| truenas-scale | 100.74.178.14 | NAS storage |

## Access restrictions

- SSH to Hetzner (kaburusvr.uk) is **only** accessible via Tailscale — outbound SSH from LAN is blocked by OPNsense policy
- Open WebUI: `http://100.120.18.44:3000` — Tailscale only
- Hermes dashboard: `http://100.120.18.44:8765` — Tailscale only
- Hermes agent uses Tailscale to SSH to Hetzner for monitoring

## Adding a new device

1. Install Tailscale on the device
2. Authenticate with `kentsteve@hotmail.com` (Google or Microsoft login)
3. Device joins the tailnet automatically — no configuration needed

## Notes

- Tailscale IPs are stable and do not change
- The Hermes SSH key (`/opt/hermes/config/hetzner_id_ed25519`) authenticates to Hetzner via Tailscale IP 100.112.54.2