From dd794a2e47ac131fae5d8b15c0808986ecf21beb Mon Sep 17 00:00:00 2001
From: "assistant-ngalaiko[bot]"
 <307087249+assistant-ngalaiko[bot]@users.noreply.github.com>
Date: Fri, 23 Oct 2026 19:16:37 +0000
Subject: [PATCH] Accept relayed Tailscale connectivity before deployment

The readiness probe received DERP pongs but required a direct path by default,
so reachable nodes timed out before activation. Disable that requirement while
keeping unreachable-peer retries and the existing timeout.

Amp-Thread-ID: T-01a169a1-b58f-747d-8dfa-f3b5a4e3ed4b
---
 .github/workflows/deploy.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 9018f17..9eb24e4 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -36,9 +36,10 @@ jobs:
 
       # A freshly created box joins the tailnet only after restoring its
       # backup, which takes minutes.
+      # Relayed connectivity is sufficient for SSH; direct UDP is not required.
       - name: Wait for the node
         timeout-minutes: 30
-        run: until tailscale ping -c 1 exedev; do sleep 15; done
+        run: until tailscale ping --until-direct=false -c 1 exedev; do sleep 15; done
 
       # DEPLOY_FLAKE pins the workflow commit; the box fetches, builds and
       # switches to it itself.