According to IRC, my headnode install failures was from using a domain that's publicly resolvable. This is apparently a sin. so I suggest a line like this:
#253
be merged into the CoaL docs, so future uninformed people like me can hopefully not have 3 failures before success.