- Resolve indri's Tailscale IP dynamically via MagicDNS at deploy time
- Add BLUMEOPS_REVERSE_PROXY_IP env var override for break-glass scenarios
- Remove hardcoded IP from stack config
- Clarify that indri hosts Caddy (the reverse proxy) in all docs
- Update PAT permissions list with actual permissions enabled
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Move Tailscale ACL management to pulumi/tailscale/
- Add new Gandi DNS project at pulumi/gandi/ for eblu.me management
- Create wildcard DNS record *.ops.eblu.me pointing to indri's Tailscale IP
- Add mise tasks: dns-up, dns-preview
- Update tailnet-up/preview to use new path and add --yes flag
- Document PAT cycling process (expires every 30 days)
This enables using real DNS names (*.ops.eblu.me) that resolve to Tailscale
IPs, allowing containers to resolve services without MagicDNS dependency.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
