Fix Rancher: remove conflicting LoadBalancer, add HTTPS port-forward, use tailscale serve only

ansible/roles/private-access/tasks/main.yml

@@ -35,18 +35,30 @@
     unit_local_port: 19001
     unit_remote_port: 9001
 
-- name: Create systemd unit for Rancher private access
+- name: Create systemd unit for Rancher HTTP private access
   template:
     src: kubectl-port-forward.service.j2
     dest: /etc/systemd/system/k8s-portforward-rancher.service
     mode: "0644"
   vars:
-    unit_description: Port-forward Rancher for Tailscale access
+    unit_description: Port-forward Rancher HTTP for Tailscale access
     unit_namespace: cattle-system
     unit_target: svc/cattle-system-rancher
     unit_local_port: 19442
     unit_remote_port: 80
 
+- name: Create systemd unit for Rancher HTTPS private access
+  template:
+    src: kubectl-port-forward.service.j2
+    dest: /etc/systemd/system/k8s-portforward-rancher-https.service
+    mode: "0644"
+  vars:
+    unit_description: Port-forward Rancher HTTPS for Tailscale access
+    unit_namespace: cattle-system
+    unit_target: svc/cattle-system-rancher
+    unit_local_port: 19443
+    unit_remote_port: 443
+
 - name: Reload systemd
   systemd:
     daemon_reload: true
@@ -61,6 +73,7 @@
     - k8s-portforward-prometheus.service
     - k8s-portforward-flux-ui.service
     - k8s-portforward-rancher.service
+    - k8s-portforward-rancher-https.service
 
 - name: Configure Tailscale Serve for private access endpoints
   shell: >-
@@ -68,5 +81,6 @@
     tailscale serve --bg --tcp={{ private_access_grafana_port }} tcp://127.0.0.1:13080 &&
     tailscale serve --bg --tcp={{ private_access_prometheus_port }} tcp://127.0.0.1:19090 &&
     tailscale serve --bg --tcp={{ private_access_flux_port }} tcp://127.0.0.1:19001 &&
-    tailscale serve --bg --tcp={{ private_access_rancher_port }} tcp://127.0.0.1:19442
+    tailscale serve --bg --tcp={{ private_access_rancher_port }} tcp://127.0.0.1:19442 &&
+    tailscale serve --bg --tcp=9443 tcp://127.0.0.1:19443
   changed_when: true