variant: flatcar
version: 1.0.0

# Headscale (Tailscale) node: advertises 192.168.7.0/24 as a subnet route and
# offers itself as an exit node.
#
# Registered as an EPHEMERAL node: tailscaled runs with in-memory state, so the
# VM re-authenticates on every boot and headscale drops the node shortly after
# it goes offline. That requires the preauth key to be both --ephemeral and
# --reusable, otherwise the second boot fails to register.
#
# HEADSCALE_AUTHKEY is templated in from Infisical (see secrets.tmpl) by
# main.tf, not stored here. It still ends up in plaintext in the rendered
# Ignition snippet on the node's storage -- see the caveat in flatcar-todo.md.

systemd:
  units:
    - name: tailscaled.service
      enabled: true
      contents: |
        [Unit]
        Description=Tailscale node (headscale subnet router + exit node)
        After=docker.service network-online.target
        Requires=docker.service
        Wants=network-online.target
        [Service]
        TimeoutStartSec=0
        # tun is not loaded by default on a stock Flatcar boot.
        ExecStartPre=-/usr/sbin/modprobe tun
        # Recommended by Tailscale for subnet routers and exit nodes: without
        # this, UDP throughput through the node is roughly halved.
        ExecStartPre=-/usr/bin/bash -c 'ethtool -K $(ip route show 0.0.0.0/0 | cut -d" " -f5) rx-udp-gro-forwarding on rx-gro-list off'
        ExecStartPre=-/usr/bin/docker rm --force tailscaled
        ExecStart=/usr/bin/docker run --name tailscaled \
          --network host --cap-add NET_ADMIN --cap-add NET_RAW \
          --device /dev/net/tun \
          -e TS_AUTHKEY=${headscale_authkey} \
          -e TS_HOSTNAME=oswl-connector \
          -e TS_ROUTES=192.168.7.0/24 \
          -e TS_ACCEPT_DNS=false \
          -e "TS_EXTRA_ARGS=--login-server=https://hs.atlashorizon.net --advertise-exit-node" \
          -e TS_USERSPACE=false \
          docker.io/tailscale/tailscale:stable
        ExecStop=/usr/bin/docker stop tailscaled
        Restart=always
        RestartSec=5s
        [Install]
        WantedBy=multi-user.target
    - name: dozzle-agent.service
      enabled: true
      contents: |
        [Unit]
        Description=Dozzle Agent
        After=docker.service
        Requires=docker.service
        [Service]
        TimeoutStartSec=0
        ExecStartPre=-/usr/bin/docker rm --force dozzle-agent
        ExecStart=/usr/bin/docker run --name dozzle-agent \
          -v /var/run/docker.sock:/var/run/docker.sock \
          -p 7007:7007 \
          amir20/dozzle:v11.1.1 agent
        ExecStop=/usr/bin/docker stop dozzle-agent
        Restart=always
        RestartSec=5s
        [Install]
        WantedBy=multi-user.target

storage:
  files:
    # Forwarding must be on for the subnet route and the exit node to pass
    # traffic at all; the container shares the host netns (--network host), so
    # this has to be set on the host, not inside it.
    - path: /etc/sysctl.d/99-tailscale.conf
      mode: 0644
      contents:
        inline: |
          net.ipv4.ip_forward = 1
          net.ipv6.conf.all.forwarding = 1