# Tailscale Subnet Router LXC Deployment — CHECKPOINT

## Status: 2026-06-11 22:20 UTC

### Progress
- ✅ **3030** (MK33): Online, advertising `192.168.0.0/18`, route approved
- ✅ **3031** (MK33): FIXED — tailscaled running, route approved by Bobby in console
- ✅ **Skill created:** `tailscale-lxc-subnet-router` — documents 3031 fix + critical route hijacking pitfall
- ✅ **Artemis LAN partition FIXED:** `tailscale set --accept-routes=false` restored direct L2 routing
- ✅ **Bobby can now SSH directly to Artemis** (was blocked by Tailscale routing table hijacking)
- ⏳ **3032/3033** (MK50): Terraform ready — awaiting deploy signal

### Critical Discovery — Tailscale Route Hijacking
**Root cause of Artemis "network partition":** `tailscale set --accept-routes=true` installed kernel routing rules (table 52) that redirected ALL `192.168.0.0/18` traffic through `tailscale0` instead of direct `eno1`.

| Before Fix | After Fix |
|-----------|-----------|
| `ip route get 192.168.50.41` → `dev tailscale0` | `ip route get 192.168.50.41` → `dev eno1` ✅ |
| Bobby could NOT SSH to Artemis via LAN | Bobby CAN SSH to Artemis via LAN ✅ |
| Artemis could NOT reach fleet nodes via LAN | Artemis routing table correct (pings still fail for some nodes — separate issues) |

**Standing rule:** Artemis must NOT `accept-routes` while advertising `192.168.0.0/18`. Subnet routers (3030/3031) handle tailnet→LAN; Artemis stays direct L2 for LAN peers.

### 3031 Fix Summary
**Root cause:** `/etc/default/tailscaled` missing `PORT` variable → systemd unit `--port=${PORT}` expanded to `--port=` → `INVALIDARGUMENT`
**Solution:** `pct exec` from MK33 host, wrote `PORT=41641` + `FLAGS=`, daemon-reload, restart, re-auth with route-capable key

### Credentials
- Latest LXC auth key stored in `fleet.env` as `TAILSCALE_AUTH_KEY_LXC`
- MK50 PVE API token exists in `fleet.env`

### Next Actions
1. Deploy 3032/3033 on MK50 via Terraform when Bobby signals
2. Verify all 4 LXCs advertise `192.168.0.0/18` and routes approved
3. Investigate remaining LAN unreachability for MK50/MK33/Shield (may be their own accept-routes conflicts)