Commit b135465

@@ -103,6 +103,24 @@
         reverseProxy)
     );
 
+  # Hosts whose reverse-proxy domains resolve to tailscale IPs (direct-dns
+  # mode "tailscale") are reached through the tailnet like tailnet-domain
+  # sites, so they need the same web-port grants.
+  mkDirectDnsGrants = reverseProxy: let
+    tailscaleHosts = lib.filter (h: h.v4 != null || h.v6 != null) (
+      map (e: {inherit (e) v4 v6;})
+      (lib.filter (e: e.mode == "tailscale") (mkDirectEntries reverseProxy))
+    );
+  in
+    lib.unique (
+      map (h: {
+        src = ["*"];
+        ip = ["tcp:80" "tcp:443"];
+        dst = lib.optionals (h.v4 != null) [h.v4.value] ++ lib.optionals (h.v6 != null) [h.v6.value];
+      })
+      tailscaleHosts
+    );
+
   mkDnsRecords = {
     reverseProxy,
     tailnetDomain,
@@ -150,6 +168,7 @@
 in {
   inherit
     mkCaddyGrants
+    mkDirectDnsGrants
     mkDirectEntries
     mkDnsRecords
     mkPolicyGrants

@@ -10,13 +10,14 @@
       inherit
         (import ./_lib.nix {inherit lib;})
         mkCaddyGrants
+        mkDirectDnsGrants
         mkPolicyGrants
         ;
     in {
       services.headscale.settings.policy.path =
         pkgs.writeText "headscale-policy.json"
         (builtins.toJSON {
-          grants = mkPolicyGrants tailscaleGrant ++ mkCaddyGrants reverseProxy;
+          grants = mkPolicyGrants tailscaleGrant ++ mkCaddyGrants reverseProxy ++ mkDirectDnsGrants reverseProxy;
         });
     };
   };