- Upgrade all nodes from v1.12.1/v1.12.2 to v1.12.4 installer image
- Set explicit nameservers (9.9.9.9, 149.112.112.112, 1.1.1.1) on
workers to replace unreliable DHCP-provided resolver at 10.0.15.254
- Fix talos-worker2 missing ExtensionServiceConfig for ext-tailscale
which was causing node reboots every ~35 minutes
- Update tailscale.patch.yaml with working auth key
- Ensures Phoenix knows the original request was HTTPS
- Complements externalTrafficPolicy:Local on Traefik service
- Service was patched with: kubectl patch service traefik -n traefik -p '{"spec":{"externalTrafficPolicy":"Local"}}'
- This preserves real client IPs for geolocation
