求助， HeadScale 自建后， win 端 Tailscale 无法登陆

背景：

• 服务器：阿里云轻量
• 主体搭建方案：headscale-ui 的 github 页提供的 docker-compose
• 域名：有域名，未备案，已配好 dns 解析
• 反代方案：caddy
• ssl 证书方案：自编译支持阿里云的 caddy ，走 dns 挑战

操作表现&&症状：

• 搭好后，浏览器访问 http://<服务器 IP>:3000/web,可成功访问 headscale-ui 后台页面
• hs-ui 后面页面填入 https://<服务器域名>:61111 与 apikeys ，可成功通过页面与 headscale 进行交互（增删用户、增删 PreAuthKey 等操作）
• 可正常通过 https:///<服务器域名>:61111/windows 打开 win 客户端的登陆指引页面，浏览器 https 标识正常，查看证书信息正常，显示 Let's Encrypt 证书，三个月后到期
• 安卓客户端通过修改 server ，可正常跳转到浏览器，但是打不开页面，显示 ERR_CONNECTION_RESET ，但复制链接里的 mkey 到后台，可以成功添加设备，后续安卓端可在线
• win 端按提示 tailscale login --login-server https://<服务器域名>:61111 ，执行后，会弹出小气泡，点击气泡和点击任务栏图标登陆都没反应
• 清除相关文件、卸载重装 tailscale ，问题依旧
• 查看 tailscale 日志：

Received error: fetch control key: Get "https://<服务器域名>:61111/key?v=113": read tcp 192.168.11.86:55438->服务器 IP:61111: wsarecv: An existing connection was forcibly closed by the remote host. 

• 查看 headscale 日志：

2025-03-08T09:05:21Z ERR noise upgrade failed error="noise handshake failed: decrypting machine key: chacha20poly1305: message authentication failed" 2025/03/08 09:05:21 http: response.WriteHeader on hijacked connection from github.com/juanfont/headscale/hscontrol.(*Headscale).NoiseUpgradeHandler (noise.go:83) 2025/03/08 09:05:21 http: response.Write on hijacked connection from fmt.Fprintln (print.go:305) 

配置文件

• headscale-config.yaml

 server_url: https://<我的域名>:61111 listen_addr: 0.0.0.0:8080 metrics_listen_addr: 127.0.0.1:9090 grpc_listen_addr: 127.0.0.1:50443 grpc_allow_insecure: false noise: private_key_path: /var/lib/headscale/noise_private.key prefixes: v4: 100.64.0.0/10 v6: fd7a:115c:a1e0::/48 allocation: sequential derp: server: region_id: 996 region_code: "headscale" region_name: "Headscale Embedded DERP" stun_listen_addr: "0.0.0.0:3478" private_key_path: /var/lib/headscale/derp_server_private.key automatically_add_embedded_derp_region: true ipv4: 1.2.3.4 ipv6: 2001:db8::1 urls: [] paths: - /etc/headscale/my-derp.yaml auto_update_enabled: true update_frequency: 24h disable_check_updates: true ephemeral_node_inactivity_timeout: 30m database: type: sqlite debug: false gorm: prepare_stmt: true parameterized_queries: true skip_err_record_not_found: true slow_threshold: 1000 sqlite: path: /var/lib/headscale/db.sqlite write_ahead_log: true wal_autocheckpoint: 1000 acme_url: https://acme-v02.api.letsencrypt.org/directory acme_email: "" tls_letsencrypt_hostname: "" tls_letsencrypt_cache_dir: /var/lib/headscale/cache tls_letsencrypt_challenge_type: HTTP-01 tls_letsencrypt_listen: ":http" tls_cert_path: "" tls_key_path: "" log: format: text level: info policy: mode: file path: "" dns: magic_dns: true base_domain: <服务器域名> nameservers: global: - 1.1.1.1 - 1.0.0.1 - 2606:4700:4700::1111 - 2606:4700:4700::1001 split: {} search_domains: [] extra_records: [] unix_socket: /var/run/headscale/headscale.sock unix_socket_permission: "0770" logtail: enabled: false randomize_client_port: false 

• compose.yaml 文件

version: '3.5' services: headscale: image: headscale/headscale:0.24.0 container_name: headscale volumes: - ./headscale-config/:/etc/headscale/ - ./headscale-data/:/var/lib/headscale/ ports: - 8080:8080 command: serve restart: unless-stopped headscale-ui: image: ghcr.io/gurucomputing/headscale-ui:latest restart: unless-stopped container_name: headscale-ui ports: - 3000:8080 

• Caddyfile 配置文件

https://<服务器域名>:61111 { tls { dns alidns { access_key_id "XXXXXXXXXXXXXXX" access_key_secret "XXXXXXXXXXXXXXX" } } #匹配跨域请求 @hs-options { host 服务器域名 method OPTIONS } @hs-other { host 服务器域名 } #处理跨域请求 handle @hs-options { header { Access-Control-Allow-Origin "http://<服务器 IP>:3000" Access-Control-Allow-Headers * Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE" Access-Control-Allow-Credentials true } respond 204 } handle @hs-other { header Access-Control-Allow-Origin "http://<服务器 IP>:3000" header Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE" header Access-Control-Allow-Headers * header Access-Control-Allow-Credentials true reverse_proxy http://localhost:8080 } }