Connect agents to z4j over a private network

# On the worker host, after `tailscale up`:
export Z4J_BRAIN_URL="http://z4j:7700"         # MagicDNS resolves this
export Z4J_TOKEN="<bearer>"
export Z4J_PROJECT_ID="<project-slug>"
export Z4J_HMAC_SECRET="<hmac>"

# Or use z4j's tailnet IP directly:
export Z4J_BRAIN_URL="http://100.64.0.5:7700"

// In the Tailscale admin: ACL excerpt that lets agents reach
// z4j on port 7700 only, nothing else.
{
  "tagOwners": {
    "tag:z4j": ["autogroup:admin"],
    "tag:z4j-agent": ["autogroup:admin"]
  },
  "acls": [
    {
      "action": "accept",
      "src":    ["tag:z4j-agent"],
      "dst":    ["tag:z4j:7700"]
    }
  ]
}

# Run Headscale on a small VM with a public DNS name.
docker run -d --name headscale \
  -v ./config:/etc/headscale \
  -p 8080:8080 -p 9090:9090 \
  ghcr.io/juanfont/headscale:latest \
  serve

# Create the user / namespace and pre-auth key.
docker exec headscale headscale users create z4j
docker exec headscale headscale --user z4j preauthkeys create --reusable

# On every node (brain and agents):
tailscale up --login-server=https://hs.example.com --authkey=<key>

# /etc/wireguard/wg0.conf on z4j host (the public peer).
[Interface]
Address    = 10.42.0.1/24
ListenPort = 51820
PrivateKey = <brain-private-key>

# One [Peer] block per agent.
[Peer]
PublicKey  = <agent-public-key>
AllowedIPs = 10.42.0.10/32

# /etc/wireguard/wg0.conf on the agent host.
[Interface]
Address    = 10.42.0.10/32
PrivateKey = <agent-private-key>

[Peer]
PublicKey  = <brain-public-key>
Endpoint   = brain.example.com:51820
AllowedIPs = 10.42.0.0/24
PersistentKeepalive = 25

# Then on the worker:
export Z4J_BRAIN_URL="http://10.42.0.1:7700"

# On every node (brain and agents):
curl -fsSL https://pkgs.netbird.io/install.sh | sh
netbird up --setup-key <key>            # cloud control plane
# or
netbird up --management-url https://nb.example.com:33073 --setup-key <key>

# On the worker:
export Z4J_BRAIN_URL="http://100.92.0.1:7700"

# Set these in the z4j host's .env:
Z4J_PUBLIC_URL=https://brain.example.com
Z4J_ALLOWED_HOSTS=["brain.example.com"]
Z4J_TRUSTED_PROXIES=["127.0.0.1/32"]

# On the same host:
cloudflared tunnel login
cloudflared tunnel create z4j
cloudflared tunnel route dns z4j brain.example.com

cat > ~/.cloudflared/config.yml <<'EOF'
tunnel: z4j
credentials-file: <absolute-path-to-tunnel-credentials-json>
ingress:
  - hostname: brain.example.com
    service: http://localhost:7700
  - service: http_status:404
EOF

cloudflared tunnel run z4j

# On the agent:
export Z4J_BRAIN_URL="https://brain.example.com"

# Create a network at my.zerotier.com (or your self-hosted controller).
# Then on every node:
curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join <network-id>

# Authorize each node in the network admin, then on the worker:
export Z4J_BRAIN_URL="http://10.147.18.1:7700"     # ZeroTier-assigned IP

# Assuming a standard OpenVPN server at vpn.example.com:1194/udp.
sudo openvpn --config /etc/openvpn/client/z4j.ovpn

# Brain reachable on the VPN's internal IP:
export Z4J_BRAIN_URL="http://10.8.0.1:7700"