tinyagentos.com: Headscale mesh control plane (phase 4)

[jaylfc]

Self-hosted Headscale running as a systemd service on the platform LXC, providing the WireGuard-based mesh that connects TAOS controllers to the platform and to each other. One Headscale user is created per TAOS account (named acct-<account_id>), plus a dedicated platform-admin user for the remote desktop proxy. Headscale is configured with an embedded DERP relay for the initial deployment — an external DERP split is tracked separately under the bandwidth monitoring issue.

The ACL policy restricts the platform-admin Tailnet user so it can only reach nodes tagged controller-<account_id> on TCP 7070 (the TAOS API port). This prevents the remote desktop proxy from reaching any controller it was not explicitly paired with, and prevents cross-account reachability even if a proxy session is misdirected. Policy file lives at config/headscale/acl.hujson and is committed to the platform repo.

Headscale's gRPC API is bound to 127.0.0.1 only. The orchestrator calls it directly to create users, pre-auth keys, and register nodes. Headscale's HTTPS control endpoint is exposed through Caddy at headscale.tinyagentos.com.

Acceptance criteria:

• Headscale running as a systemd service, control endpoint reachable at headscale.tinyagentos.com
• platform-admin user exists and can only reach tag:controller-<id> on TCP 7070 per ACL
• Orchestrator creates a Headscale user via gRPC on new account registration
• Auth key issued by orchestrator allows a controller to join the mesh and receive a stable WireGuard IP
• Embedded DERP relay passes connectivity smoke test (two nodes communicate through relay)
• ACL policy is enforced: cross-account node reachability blocked at WireGuard level
• Headscale version pinned in the provisioning playbook

Depends on: #90