Architecture
Anyone, on a public hostname that resolves to the Fly nodes' anycast pair. HTTPS, HTTP/2 and HTTP/3, with plain HTTP redirected. The only public address anything here has.
People and devices, on tailnet hostnames that resolve to an address real nowhere: every edge aliases it and advertises the host route, and regional routing sends each device to the edge nearest it by latency. Routers published here carry the lockdown middleware, which admits tailnet source ranges and nothing else.
Terminates TLS and routes by hostname. Its routers, middlewares and certificates are files on the ConfigFS mount, watched for changes and reloaded in place. Backends are dialled by tailnet address, through the node's own tailscaled or a tsnet node embedded in Traefik for a tailnet of its own.
Each answers on the tailnet: a VIP that tailscale serve proxies into the pod, a tsinject node with an identity of its own, or a cluster IP behind a subnet route. None of them is reachable any other way.
Pulumi writes Traefik's dynamic configuration here and legocert renews the TLS certificates into it. The edge mounts the tree and Traefik reads both as files, so a new route or a fresh certificate is a write, not a deploy.