Prometheus runs as a pod and only has Tailscale routes to the three k8s nodes it runs on (isaiah, jeremiah, zeke) plus hosea. Scraping genesis, exodus, and linode via *.shire-zebra.ts.net fails instantly (~1ms, connection refused) because those Tailscale routes don't exist inside the cluster network. Fix by host type: - k8s nodes (isaiah, jeremiah, zeke, hosea): keep Tailscale hostnames - LAN hosts (genesis): use LAN IP 10.42.1.5 - Roaming/VPS (exodus, linode): use Tailscale IPs directly (100.x.x.x) since they have no fixed LAN address but the k8s nodes do route to other Tailscale IPs via the subnet router Apply same logic to kea, dnsmasq (genesis-only jobs) and the systemd/ping exporter jobs.