diff --git a/deployments/headscale/deploy.sh b/deployments/headscale/deploy.sh
index a58c95a..f4ea1f4 100644
--- a/deployments/headscale/deploy.sh
+++ b/deployments/headscale/deploy.sh
@@ -414,81 +414,83 @@ EOF
 # __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64).
 exit 0
 __ARCHIVE_BELOW__
-H4sIAAAAAAAAA+1b/W7bOLbv334Kwil2kk4k24mTdFTkYrJJsMltmuTm484uFgMNI9G2NrKoEaW4
-niLAPsQ+4T7J/Z1DfdlN28HetjMDmA1qiyIPycPz8TuHdKiDe5U5gZ6m2ih3Po2fffbSR9kdDp/1
-d/uDvZ0Bf/b7A65H2ekPt58NdrYG2/29rb3drWf9wdbe3vCZ6H/+qbxfCpPLTIhnO3v+Dzp+UF9j
-zN9RWRMTJUMTyFgJcCK4F44jAhmGc7F+c3a9Ib5tNVi/kVHMX1lgZB7doTbQOgujROY62+isddbE
-jU51rMdzD9+FqPuIII5Ukhvh/JcdwRsOt+mhHsB72X/ZZxLnWhwkxV1k8DJT3hNETKrkvTi5ubns
-bWEKSZ7pWKSZznWg402R6Bwv35xtgpjRQopL/YMIJjKOVTJWYqaLOBR3GdHIJ2rqipNqEt8YcXB5
-KkyRjWSgBKYwm8gcZKqRJ1H+SuTomosoF3F0r4RM5kKDTma7quwhCpTLK7k4PToU4EaUEKlQxWos
-cxWKXIuUdC93olCA1PPLi8PXxzenR/7RxZuD03NXXKlxZHLQlPXgNNdMiVGUGcwh0OmcasqXPgh9
-W303KsgUJphgHFclD26nk8gpOFkzu9N50HExVcbriKbWCWUuq5o0lklTw3u29ATGj6Kx1+mUazb1
-K/oiRDSVYwxqa56/Ozw4Ovqbf3PwF8/ZcmScRol65Ha0gRJPmW9nyR34TaZIQXNPFEmsjHFMrtNU
-hfwu1Vlu7EBCOKL7sg8J6jbPkC+SsapmrVXXK8K0y3UsQtsk9mFkJAQ6xFB5FItD1oL/uT09BFsz
-9aAyo3xI2Nt5Se+psibAtEBNdBxi5+6KMe36KHoLqut/da6UjJ3TSywXfMfWZboYTz5KTU3THLKV
-QIinpKEQu6nZIOFwVEKzFTHEKXOZSGtDLQfcHi9iFEG3eioPeszXVmWm67at7e3R/0svyp3u2U9+
-CbGKMp1MIW/VkCfHB0fXhwdnx6UUe6L7/N1y5WO1IQeHb479Y1SdcbvmsWwRqlQlofF1UtFvTEXN
-NUwojPIIbSrF89Eqzid2m+z3YKKC+6pPDpHyxN+7h2+OupuiOxurnD6dny8c+pzkeer1enBCbh//
-Bt5Wf/Bdue5e98eSCDQLo8nYE9t9UxGOpkoXoL1T1UAHswg7IrbLChZmP1VZpENPDNC1896qSqWp
-a3vN+zYzWY367tZLt/+0EjWq/ilFgjxOZRJaDlbNZQjGx3MPtq6wdfk0HbWkq/cgs15WJL3FgZ6Q
-Qss8dy6nsZXDZm3tVy1pdHvwIVEwdyfFPwz2dqnX4stWvyVDxlOMo7ulKX5aKOr25QOaf5Gth036
-fIXpnVSGW/z7n/8SM3Unbk/FSGcNazbtNsP/zUsjB//Tk+E0SlxyYA5vOxPLZXxvyFeRm2mAAHm5
-WZRP4FfvFZBCosURA0mYKfJp5H/FRJu88swbLpNrbTbZxbGCsLI3xEyg7LGeu2YiRpmelk7r8zOo
-9msLujaeBJkb6V5eqZttYtXt8uzgvFQ3MrYm/7C6cbdPqtsTGlJ3XlISrvuQkiz56AVhb2by/7Wi
-vzVEXZUvWGoo8AXH+ET8t7W9tdPEf9RuMBgMd1fx39coa6KWgEUnYaNBG8McFLl2ImMKgFYpzlSO
-GOk4CbJ5CgOvspx7Pl+GeYiKwgo3O4Sb4Q1BDM5k0oq1CH4jiEKgA0tKQJeDQPeJiC9TPxcRop98
-EhEd9VYGOTsZMr9CYxwmdo1Q553Fp1PQEO+et3Bl5xEv35vpoyg7JIEOlfjF5KEY/xKlHa5tu9TS
-ncbRA7Gi8ZqX0hj2kQiKJxWwh+lHxIlwMyzprNeG2XpggwDSqHiEhhQtWGIA98dYyxzLTMZCxYZj
-0BbLSmLLMa8NAb5nGnYall750XthkQ82BTwtm72r7f9CfNNykttQUG702Gn3/1jHJpRvNavcDrxl
-kYomEnpHaNulrYW/xOdU58qlTX1c6LomznQydojvIbBFZFRvBlkYFzILa06U0dErbM+IQ2W4vpEs
-4nyJVEQriKMponfDyAbgQyff5MAj6KazBI+zxF3oNYoLM/Er5CecwcLbPJOJoWhU0HKWlm25BDRd
-YkQB7Dd9r8Usi3JVN1lu0XDjcWE3mKOt8a6BOYPcuanm41yroADluehO5VsHWGd/e7CzvYtdfQUc
-G8RFqK6LuyMNVUlMt6bzV+cQTIXaOTfzVDkXKUEDQ2+6iTZJNBo1ba/USGWZypxLBuWtWXeNnY7O
-onGUOLOJSpwg00BDtqahgXlCH7L22mI9bi0MTEnBF2gmvtW1sDtTySDT6BLak4r/1kb1D1RayPKL
-jfGp/O/29qDy/4O9rW3y/8PdVf73q5R2/rcdnTmOsKkFBgCXrZxWru8VTMH67eXl8ZV/fX7w+hjG
-S1JwA4sC01lQVoo9mgk0wqANITNFadjizuRRXlC8B6W18R4Hzk+Ef2S9YWgJcYAoB4MIMclIG0XJ
-WEracm5YhPADQR7Py0BLzHXxDaqzIknIgTbLg+EwUahKx8CDmyCL0ty16UtyTRmCejLhxuv1fH8Z
-J/h+xyIVH5gp80SfE0R9m7aeUrwfGP/JFt/1v+t3MO3x1eWhsF7OqdwWgmmsrco9MivYa72qkU9h
-7KwhqkkIjwdCP9Xr+kkcnp2CSfXa6riUKnM0c8VtQhkeSiB/C9xEJz0iGhGnQGkmUW2nJCyaoXlm
-afD0Snb6w+F21ULGsZ7BKxryMgiBRxJwpdNhB02xZZpFD4iY/Xs19wmSeOL9hEyPW/tlUxdNO500
-U5Qz5Qj5YUjJkr67O6TxewOCIw+7GCvck95gsBN4cqD6ntcbvsQbmlEgq0AWqCLJIxkT64+Ory49
-ZmUNLQE/U0hrFPBLMZUpsNf0ToUhNoKrrFwQ4+dG6NEIgIFYpkrAkCibydeIsMXt0WVve7j3sqQZ
-z90OdCClNVgyXgkyeaMrZgkBoStTAU4te6Vs2IxAXs3XxS72iCZm2muwDXHWeOLvlJ+SgOpAWCFx
-vR6pTOCV1SNGW0kw98TWcNLpUO7gTtoNy+HtwbifY4ARmjd/sZP74P6Fd27docIxkl77cOGt7OFM
-xj5Nj9NuqQaW4o2FXlA7NIkBJaF/UTKiFIf17eiv3ua0fweHZ8Km/TaBDSRtEVsKKU6K/76+OBcc
-w6wbpcRCdnBTTHWR5GydbCKrs9boCNB2YyEgHGZBOuiwBoimK4PYdMsZ2bOl7hgQKzddt2MHo/lP
-ETx4PI1Oza6PpC1pUW/kmKTv/JpDKNJe2uxE5a6gLfFDBmbiTlUnBjACxQi6we0TDEiSje4UA8Eo
-K3fsilimuU5d379ByHN+fFNbrw1IZMKyNqVxfXqo9qc1nCfe74oWFGFlMDI+aVhsO1cyzMOzkJei
-PI71nYybDNfA5X+tZ86t189bu/1db7jX79v/oNiDj7wEeuCXJoXceeLdI+uYzIJJuYRKHSA7mfTh
-IHQW2rrySM6rj+JIZSZkJqzZqJKdzeGc9RVkPZfO5BI1s8d75eEcxV11L06PZsp6J3F7dWpPQz/m
-XHo6CumIJo7vEHp36IkYSNlY3yaPo5FPtX5kfPkAQSH9rneQA/Ss7b+WjhR5F+uzQtplmr0P93F8
-fuOjWeu9PT9cbnN9fHgFoaB28O2pqswW2b8oLB8QCZY6QE8chHMe9/L14TFHq2CIFWXiPCKBX5jx
-Dsfe6q0NmWGIrfWyjKTW11s7uzaLXB/jwudOdEhgZSrvSTUytbR57f2BrGoEsMbORHOEl94Hasku
-1wbLUveaga+UDWjEbKJFIBPsbyUOrIttR6sR5ENFp0BANo3NvlKFPoyMVZI15o+ERVDfq7dymloD
-v9B4nOkibbWuXYHDrtosNK5Ev269TPVEz2A6AYrsdEu31pJ/wh8KlgXwCSOgnlIPZd4FMOJmgkf8
-SaYWFpnVGJoQMPQ62UVJXhRGFav0gTSibO6TlfYZNdYmhBIf9cYyMd4nbgSzi+hb2M6CYkbeEZe1
-mergNV72SdieHKOySb81sP6DlAWP9IXG+ET8t721V+d/t4fDHbr/09/bWsV/X6P0eu1jvRpiiXUL
-qjzB0IpVFU1L42Y4tQvPGsUUYvHpsQG46PXwJ07fXF5c3Ryc33gfg1YvLLZ6UQ1YpnJgyhkF6dRh
-OEgES/gls0zOqcH5xQ03qjCYMHOgubdN4Njkjm2as8wPuTy7nC0YuQJrzCmkhctpdSI/TgGveUVQ
-D14BiFOKbi7HFzNAxq6YQmhgKImcpJXB9pFb6X7f3eCWbLW9F91N8gC2J56qqWMsgsHcqOLZ/8IN
-EDhvzG88J9bCugLgUIvWqV3FMgbSYrmsWV7zgS2dwFJ0aOPzzNIJQtEz2UMDS8Wf/oR4ho9vy3uA
-1ella0x2NGmKOHudcO4+ufiNcvY3TaoVC4AzIhZjvCkgSfQAUM4eysH/4M9sEgWTeg/aeW1QulMT
-+RDpIrMil+gKy4ubaDxBNEqOozDEGhvqsjzCbZWuzric+wel6xzOKbC7Y72oK94oBHeZoXyEdThw
-RXB8ecTQmYCKsUJU4wc+t2aulZtq3W6Xbgq857npqsCdvluo+nGzU/WlXu8eNzuW4g+AEFPIs+Wp
-ZQrkhA/bQ8V3qVzB8mYqeSuFbXNRwCy5SsbWlyWMpK7ZxUz9g9EXxwndupE3Zc50W8slemYCToW8
-2IXV20VV+rC4rnOVz3R2L2QQUDYmK2JiLt9Yw3pzrHIGEq8qeXGwA+XduVlkFE/A6jtGZRQGmgck
-PkLVpyKEw1lDSwzBopHZsTZ5bV7VVYh3RI9wCih2aVYp3/YxWfDUwkQ3NDm/eAF2/igeN381pRfU
-vZ39rig1rGyT/DXUnprMjxWnG4N1fX0i1jXn6GX8irFdKTRZkYifatAoWByMmfxEh0xWSr16x1Ff
-Mp2fPzDD5rWoJiuelI+mlV2EWODEchtGxVataqFMdJJpzVzhz5IB3AndV3n+z1A4s1oarC81xifw
-33BrZ9ic/+/tUf5/Z297hf++RlkTh3yL2N4SZlwHzx4LOtRewgRpFNwb2wx2hNR0Si4WXn3uUlrl
-3//6p/0TlzapWp3Nm+bV7/kPS/gzIYP6SgFdazMAWVO1QXFo1r4BNyMm3ZFDlWgRtu4rtG6KA3cm
-lP3hvu0LCsu5n/2JcdvBOmgc8+UFyvIt3rewKYcy8u5VYTJwajQqM1jAQM2Nh302yd8vEee0o0N5
-w6VsomkfJNSpyMpVsLulC/4LycF9ateePmFge/mP8jSh6NqEZNcyDdCS9AwiB0plqnKZAqDa7fUN
-8TeMRiNwL8ktMFtmnNv5xFwWBZNB33qD7v4wgnnylExqPsLJnkxVbhJUDIW0gQCtG1RshhDMLWow
-Rm9ttbi9Omv/JCGEvOaR4Xsu6NtzZyqOnftEz5KezfeVd8LLNJDbWUo37lMCaXkvrloZs4+kTyHw
-NnS7Pf1UJvWJ++VLidQ1ClDoTgwGtmEDqNmDIfv7ErezmAjd77yf9NxflKTmStB6eSeovg30O5Aq
-TPUv9d1a2AkLv610vBKxktC/O8z+3poie8H18OLi9elxvdzy2ldAP3Spzlpah6mLRMU68fX2tPzx
-jAX/Gx8c6uTaRzP/9fHfaJyLErl67R/LVJfRLJMfItkIRzsNLzDdi/OjSsL/g0z8U/Jjb0wtS9GZ
-XQyCFbsi8pp0nlhP067eoSvR5S9+ygPY1tKXJe3pN0/K3CndVbZB4m8uYf+hXC78emG/vGGwcMd6
-316x7tQ/Fdqvfim0gvursiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiqrsiq/svwfUE85lwBQ
-AAA=
+H4sIAAAAAAAAA+1b63LbOJbObz0FSk5N290mJfmaZspb7bW1Y28c2+tLzXRNdTEQCUlcUwSboKyo
+U6mah5gnnCfZ7xzwJlkdz+520p0qISlLBIED4OBcvnMAhTp4UJkT6EmqjXLnk/jFb166KAd7ey+6
+B93e4X6PP7vdHtej7Hf3dl/09nd6u93DncODnRfd3s7h4d4L0f3tp/K0TE0uMyFe7B/6f9Hxo/oS
+Y/6ByoYYKxmaQMZKgBPBg3AcEcgwnIvNu4vbLfFdo8HmnYxi/soCI/NogNpA6yyMEpnrbKu10doQ
+dzrVsR7NPXwXouojgjhSSW6E8292BG9vb5ceqgG8V91XXSZxqcVxMh1EBi8z5a0gYlIlH8TZ3d11
+ZwdTSPJMxyLNdK4DHW+LROd4+fZiG8SMFlJc67+IYCzjWCUjJWZ6GodikBGNfKwmrjgrJ/GNEcfX
+58JMs6EMlMAUZmOZg0w58jjKX4scXXMR5SKOHpSQyVxo0MlsV5U9RoFyeSVX56cnAtyIEiIVqliN
+ZK5CkWuRku7lThQKkHp5fXXypn93fuqfXr09Pr90xY0aRSYHTVkNTnPNlBhGmcEcAp3OqaZ46YPQ
+d+V3o4JMYYIJxnFV8ui2WomcgJMVs1utRx1PJ8p4LVHXOqHMZVmTxjKpa3jPlp7A+GE08lqtYs2m
+ekVfhIgmcoRBbc3LDyfHp6c/+nfHf/acHUfGaZSoj9yONlDiKfPtLLkDv8kUKWjuiWkSK2Mck+s0
+VSG/S3WWGzuQEI5ov+pCgtr1M+SLZKys2WjUdaZh2uY6FqFdEvswMhICHWKoPIrFCWvBf92fn4Ct
+mXpUmVE+JOz9vKC3qmwIMC1QYx2H2LnBdES7Pozeg+rmX50bJWPn/BrLBd+xdZmejsafpKYmaQ7Z
+SiDEE9JQiN3EbJFwOCqh2YoY4pS5TKSxoZYDbocXMYygWx2VBx3ma6My01XbxvZ26O/Si2KnO/aT
+X0KsokwnE8hbOeRZ//j09uT4ol9IsSfaLz8sV34sN+T45G3f76PqgtvVj0WLUKUqCY2vk5J+bSoq
+rmFCYZRHaFMqno9WcT6222S/B2MVPJR9coiUJ/7WPnl72t4W7dlI5fTp/Hzl0Oc4z1Ov04ETcrv4
+1/N2ur3vi3V32j8VRKBZGE3GntjtmpJwNFF6Ctr7ZQ10MIuwI2K3qGBh9lOVRTr0RA9dW09WVShN
+Vdup3zeZyWrUdXdeud3VSlSr+nOKBHmcyCS0HCybyxCMj+cebN3U1uWTdNiQrs6jzDrZNOksDrRC
+Ci3z3LmcxFYO67U1XzWk0e3Ah0TB3B1P/9tgb5d6Lb5s9FsyZDzFOBosTfF5oajaFw9o/lm2Hjbp
+tytM76w03OKff/+HmKmBuD8XQ53VrNm22wz/Ny+MHPxPR4aTKHHJgTm87Uwsl/GDIV9FbqYGAuTl
+ZlE+hl99UEAKiRanDCRhpsinkf8VY23y0jNvuUyusdlkF0cKwsreEDOBssd67pqxGGZ6Ujit355B
+lV9b0LXROMjcSHfyUt1sE6tu1xfHl4W6kbE1+a+rG3d7Vt1WaEjVeUlJuO7XlGTJRy8Iez2T/68V
+/b0h6rp8xlJBgc84xjPx387uzn4d/1G7Xq+3d7CO/75E2RCVBCw6CRsN2hjmeJprJzJmCtAqxYXK
+ESP1kyCbpzDwKsu558tlmIeoKCxxs0O4Gd4QxOBMxo1Yi+A3gigEOrCkBHQ5CHRXRHyZ+nkaIfrJ
+xxHRUe9lkLOTIfMrNMZhYrcIdT5YfDoBDfHhZQNXtj7i5ZOZfhRFhyTQoRK/mDwUo1+itMW1TZda
+uNM4eiRW1F7zWhrDPhJB8bgE9jD9iDgRboYFnc3KMFsPbBBAGhUP0ZCiBUsM4L6PtcyxzGQkVGw4
+Bm2wrCC2HPPaEOAHpmGnYekVH51vLfLBpoCnRbMPlf1fiG8aTnIXCsqNPraa/T/VsQ7lG81KtwNv
+OU1FHQl9ILTt0tbCX+JzonPl0qZ+XOi6IS50MnKI7yGwRWRUZwZZGE1lFlacKKKj19ieIYfKcH1D
+OY3zJVIRrSCOJojeDSMbgA+dfJMDj6CbzhI8zhJ3odcwnpqxXyI/4fQW3uaZTAxFo4KWs7RsyyWg
+6QIjCmC/yZMWsyzKVdVkuUXNjY8Lu8EcbYx3C8wZ5M5dOR/nVgVTUJ6L9kS+d4B1jnZ7+7sH2NXX
+wLFBPA3V7XRwqqEqiWlXdP7qnICpUDvnbp4q5yolaGDoTTvRJomGw7rtjRqqLFOZc82gvDHrtrHT
+0Vk0ihJnNlaJE2QaaMjW1DQwT+hD1lxbrEeNhYEpKfgCzcS3qhZ2ZyIZZBpdQHtS8d/bqH5FpYEs
+P9sYz+V/d3d7pf/vHe7skv/fO1jnf79IaeZ/m9GZ4wibWmAAcN3IaeX6QcEUbN5fX/dv/NvL4zd9
+GC9JwQ0sCkznlLJS7NFMoBEGbQmZKUrDTgcmj/IpxXtQWhvvceC8Ivwj6w1DS4gDRDkYRIhJRtoo
+SsZS0pZzwyKEHwjyeF4EWmKup9+gOpsmCTnQenkwHCYKVeEYeHATZFGauzZ9Sa4pQ1BPJtx4nY7v
+L+ME329ZpOIDM2We6HKCqGvT1hOK9wPjr2zxfff7bgvTHt1cnwjr5ZzSbSGYxtrK3COzgr3W6wr5
+TI2dNUQ1CeHxQOhdta534uTiHEyq1lbFpVSZo5kr7hPK8FAC+TvgJjrpEdGQOAVKM4lqOyVh0QzN
+M0uD1SvZ7+7t7ZYtZBzrGbyiIS+DEHgoAVdaLXbQFFumWfSIiNl/UHOfIIknniZkOtzaL5q6aNpq
+pZminClHyI97lCzpugd7NH6nR3Dk8QBjhYfS6/X2A0/2VNfzOnuv8IZmFMgykAWqSPJIxsT60/7N
+tcesrKAl4GcKaY0CfikmMgX2mgxUGGIjuMrKBTF+boQeDgEYiGWqAAyJspl8jQhb3J9ed3b3Dl8V
+NOO524IOpLQGS8YrQCZvdMksISB0RSrAqWSvkA2bEcjL+brYxQ7RxEw7NbYhzhpP/I3yUxJQHQgr
+JK5XIxUJvKJ6yGgrCeae2Nkbt1qUOxhIu2E5vD0Y93MMMELz5i92cr+6f+HArTqUOEbSax8uvJE9
+nMnYp+lx2i3VwFK8sdALaocmMaAk9C9KhpTisL4d/dX7nPbv+ORC2LTfNrCBpC1iSyHF2fQ/b68u
+Bccwm0YpsZAd3BYTPU1ytk42kdXaqHUEaLu2EBAOsyAddFgDRNOWQWzaxYzs2VJ7BIiVm7bbsoPR
+/CcIHjyeRqti1yfSlrSot3JE0nd5yyEUaS9tdqJyV9CW+CEDMzFQ5YkBjMB0CN3g9gkGJMlGd4qB
+YJSVO3JFLNNcp67v3yHkuezfVdZrCxKZsKxNaFyfHsr9aQzniadd0YIirAxGxicNi23nUoZ5eBby
+QpRHsR7IuM5w9Vz+13jm3Hr1vHPQPfD2Drtd+weK3fvES6AHfmlSyJ0nPnxkHZNZMC6WUKoDZCeT
+PhyEzkJbVxzJedVRHKnMmMyENRtlsrM+nLO+gqzn0plcomb2eK84nKO4q+rF6dFMWe8k7m/O7Wno
+p5xLR0chHdHE8QChd4ueiIGUjfVt8jga+lTrR8aXjxAU0u9qBzlAz5r+a+lIkXexOiukXabZ+3Af
+/cs7H80a7+354XKb2/7JDYSC2sG3p6o0W2T/orB4QCRY6AA9cRDOedzrNyd9jlbBECvKxHlEAr8w
+4x2OvdV7GzLDEFvrZRlJrW939g9sFrk6xoXPHeuQwMpEPpBqZGpp85r7A1nVCGCNnYnmCC99CNSS
+Xa4MlqXu1QPfKBvQiNlYi0Am2N9SHFgXm45WI8iHik6AgGwam32lCn0YGaskG8wfCYugflDv5SS1
+Bn6h8SjT07TRunIFDrtqs9C4FP2q9TLVMz2D6QQostMt3FpD/gl/KFgWwCeMgHpKPRR5F8CIuzEe
+8V8ytXCaWY2hCQFDb5JdlORFYVSxSh9II8rmPllpn1FjZUIo8VFtLBPjfeJGMLuIvoXtLChm5B1x
+WZupDl7jVZeEbeUYpU36vYH1V1IWPNJnGuOZ+G+v1zss47/9XY7/droHu+v470uUTqd5rFdBLLFp
+QZUnGFqxqqJpYdwMp3bhWaOYQiw+PTYAF51Oa4Hev4SnxObl1R1b7RJTCTMHOntPtKpYsE4H28xl
+kfLZ4pnAJFnDTO5PinYuR1czgLu2mGB7YdJgsUCMLK/YJAfQ/qG9tU0t2b5637a3yVbbnngih5JQ
+XhPUGVFzs3J9p/3/OL6/uBNH1vAKVWdrN2mqfDtHYIkYGO9hDO80zG7wwGnFbVF5iGlO5PKxtN4C
+vFSWsQQDo9GYHEs2jQnXIVTLGjwosP+2TTzSoWS4xbTIC5KRdWkvDQXe4Bcd7D3Sqa+GOSWQzPN2
+8Jc4h1jLMHohi5yYcgZEzl5pslMgUgSYc2IOyARjezWKbyDNKeI2cqgIPcVKPioGQ5Q1KLl2PKTl
+HF/+KICJMHME9xGFI6XDkWkaz8FDjxo3jihLgeSowb4LQtEx2WONq8Wf/gTe8vlzcZGxPH5t3IGg
+XCLNg8WHnbDYZK/DCMVYUauAA1+xsX6PAVgRLxcooXBbzPGRZ8aSm5HI2T2nMJLu7fDdHzo2eMp2
+GdCmkFezQmjaXpHuBNVCLq2Pb9O1hCcwge4lDPRgoeqnbRD4uN2yU7uTIzsnI97e396xGlgd6NSC
+T98Lobf+uyHwfGgPQjWowQvFMsEGoTlJIQeQO+uuiU+VvPMKS4VcXGTNO17iwpobS7HWAi3KjkdU
+SjX0nmihK05qDePTIqtaeUMLXUuEKX6gEQjIYAx8C1TK14FMFvC0vsVcRDs0uX0Cp34qJtaYzI/P
+6qfYtDsOaQqWREEPh1uN+YBoX0K9eKssyqRH8D3KGBqFiq/agWK5Ux6fIoEU4JDKIlq8jEtiEPda
+U6C8lebxJr5brWnvtryy/zP8qScxUZMBjG6TXYszLHlXED5O5mT36iWWC4NgjCixUuvWJmVaTBEg
+W1myEvcvT3NxG2vS9Zx+qhWn3Mfb2zNSCwKs7EmyaSLeVRhcTFPw05jxuy13QUns9lpiRIITD2zC
+G9vnijZzug1HYi8FRYEYZHpG217Ab1YeDNCU/oV1WgoVR0W5XrF6YxrtLCfEkz1abMV2cmknE51k
+WjNz+bNm3/rk5asrnFkvfMjnGuM5/L+zv1ff/zg8pPOf/cM1/v8iZQPOkm6R21viDP6GEbkluMgl
+SJVGwYOxzWD4yB4AvUeUrpq7lFb75z/+bv+La5tUL+9mmPrVH/k/lvDvhHKrKyV0rdHAwk4QZsz4
+rKn2lTNi0kBZx8W5kdIrNH4pgCAloewf921eUFnO/R2NjdtM1oBGny+vUJZ38b6NTTkVmZdOmSYB
+dIuGRQbTuK36xssR46kflohz2tmhvPFSNtk0D5KqVHTf9vYYMdAPPBaSw0fUrjl9iqzs5U/K04Wi
+bRPSbcs0IHPSM4gcKBWp6mUKboVYw2g4BPfgVhmfLzPObT0zl0XBZLy/WYP8r0Ywz1bJpB5aULEq
+Vb1N8DEU0mImWjeo2AwxmEtYBsprUWVRLe5vLpo/SQkhr3lk+J4T+nbcmYpj5yEBhOnYfG/xm4Ai
+Dei2ltLNR4xglvbippEx/UT6HAJv4/z78+cy6St+X7CUSIfAUliSSgxsT0hBzR4M2t8Xua3FRPhR
+62nS+2hRkuorYZvFnbDqNtgfQKow1T9Xd6thJ2xKwkrH6yJAH2D2D9YU2QvOJ1dXb8771XKLa38B
+/dCpPGtrHKYvErWZj/vz4sdTBL+N2frVoc5ufTTz3/R/pHHs7SK6T9/4sVR5GdEy+TGStXA0j2EE
+pnt1eVpK+P/hJGaV/Ngbc8tSdGEXo0GOV0Rek86Tq2na1Tt0Jb74xVdxAN9Y+rKkrX6zUubO6a46
+xT9fiUNdIZcLv145Km6YLNyxP7JX7FvVT8WOyl+KrYOLdVmXdVmXdVmXdVmXdVmXdVmXdVmXdVmX
+dVmXdVmX/0X5H8de64YAUAAA
diff --git a/deployments/headscale/policy.hujson b/deployments/headscale/policy.hujson
index 0a43ee0..3f0fb97 100644
--- a/deployments/headscale/policy.hujson
+++ b/deployments/headscale/policy.hujson
@@ -1,39 +1,48 @@
 // headscale ACL policy (HuJSON: JSON with // comments and trailing commas).
 //
-// IMPORTANT: headscale uses Tailscale's *legacy* policy format -- the top-level
-// "acls" array -- NOT the "grants" syntax from the Tailscale admin console.
-// It is also stricter than Tailscale in places; notably, a "tagOwner" must be
-// a user (has "@"), a "group:*", or a "tag:*" -- NOT an autogroup.
+// headscale uses Tailscale's legacy "acls" format (NOT the "grants" syntax
+// from the Tailscale admin console) and is stricter: a "tagOwner" must be a
+// user (has "@"), a "group:*", or a "tag:*" -- never an autogroup.
 //
-// Validate before relying on it:
-//   headscale policy check                 # uses the host CLI wrapper
-//   cd /srv/headscale && docker compose restart headscale   # apply (mode=file)
+// DEFAULT = allow everything (the first acl below). To lock down, comment out
+// that one line and the tighter rules (your Tailscale default, translated)
+// take over. ACLs are additive, so while allow-all is present it wins and the
+// other rules are inert -- which is why they're safe to leave in place.
 //
-// The default below is permissive (allow-all), which is also headscale's
-// behaviour with no policy. Tighten it using the commented examples.
+// After ANY edit, validate before applying:
+//   headscale policy check
+//   cd /srv/headscale && docker compose restart headscale
 {
-  // Static user groups. Members are OIDC identities (emails from pocket-id).
-  //   "group:admins": ["alice@example.com", "bob@example.com"],
-  "groups": {},
+  // Admin users (OIDC emails from pocket-id). Required only if you enable the
+  // tag:shared owner below. Empty is fine while allow-all is active.
+  "groups": {
+    // "group:admins": ["alice@example.com", "bob@example.com"],
+  },
 
-  // Who may apply which tags to devices. Owners must be a user, "group:*", or
-  // "tag:*" (NOT an autogroup -- headscale rejects e.g. "autogroup:member").
-  //   "tag:shared": ["group:admins"],
-  "tagOwners": {},
+  // Tag owners MUST be a user / "group:*" / "tag:*" (not an autogroup).
+  // Uncomment together with group:admins above when you lock down.
+  "tagOwners": {
+    // "tag:shared": ["group:admins"],
+  },
 
-  // Network access rules (first match wins; default-deny otherwise).
   "acls": [
-    // Allow everything. Replace with tighter rules, e.g.:
-    //   { "action": "accept", "src": ["group:admins"], "dst": ["*:*"] },
-    //   { "action": "accept", "src": ["*"],            "dst": ["tag:shared:*"] },
+    // ===== DEFAULT: allow everything. Comment out this line to lock down. =====
     { "action": "accept", "src": ["*"], "dst": ["*:*"] },
+
+    // ===== Your Tailscale default, translated (active once allow-all is off) =====
+    // Each user can reach their own devices (autogroup:self is experimental
+    // in headscale -- validate with `headscale policy check`):
+    // { "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:*"] },
+    // Anyone can reach devices tagged tag:shared (needs the tagOwner above):
+    // { "action": "accept", "src": ["*"], "dst": ["tag:shared:*"] },
   ],
 
-  // Tailscale SSH (optional; nodes must run `tailscale up --ssh`). Example:
-  //   "ssh": [
-  //     { "action": "accept",
-  //       "src":   ["group:admins"],
-  //       "dst":   ["tag:shared"],
-  //       "users": ["autogroup:nonroot", "root"] },
-  //   ],
+  // Tailscale SSH (nodes must run `tailscale up --ssh`). Uncomment to allow
+  // SSH into your own devices. "check" = periodic browser re-auth.
+  "ssh": [
+    // { "action": "check",
+    //   "src":   ["autogroup:member"],
+    //   "dst":   ["autogroup:self"],
+    //   "users": ["autogroup:nonroot", "root"] },
+  ],
 }