80 lines
3.0 KiB
Plaintext
80 lines
3.0 KiB
Plaintext
variant: flatcar
|
|
version: 1.0.0
|
|
|
|
# Headscale (Tailscale) node: advertises 192.168.7.0/24 as a subnet route and
|
|
# offers itself as an exit node.
|
|
#
|
|
# Registered as an EPHEMERAL node: tailscaled runs with in-memory state, so the
|
|
# VM re-authenticates on every boot and headscale drops the node shortly after
|
|
# it goes offline. That requires the preauth key to be both --ephemeral and
|
|
# --reusable, otherwise the second boot fails to register.
|
|
#
|
|
# HEADSCALE_AUTHKEY is templated in from Infisical (see secrets.tmpl) by
|
|
# main.tf, not stored here. It still ends up in plaintext in the rendered
|
|
# Ignition snippet on the node's storage -- see the caveat in flatcar-todo.md.
|
|
|
|
systemd:
|
|
units:
|
|
- name: tailscaled.service
|
|
enabled: true
|
|
contents: |
|
|
[Unit]
|
|
Description=Tailscale node (headscale subnet router + exit node)
|
|
After=docker.service network-online.target
|
|
Requires=docker.service
|
|
Wants=network-online.target
|
|
[Service]
|
|
TimeoutStartSec=0
|
|
# tun is not loaded by default on a stock Flatcar boot.
|
|
ExecStartPre=-/usr/sbin/modprobe tun
|
|
# Recommended by Tailscale for subnet routers and exit nodes: without
|
|
# this, UDP throughput through the node is roughly halved.
|
|
ExecStartPre=-/usr/bin/bash -c 'ethtool -K $(ip route show 0.0.0.0/0 | cut -d" " -f5) rx-udp-gro-forwarding on rx-gro-list off'
|
|
ExecStartPre=-/usr/bin/docker rm --force tailscaled
|
|
ExecStart=/usr/bin/docker run --name tailscaled \
|
|
--network host --cap-add NET_ADMIN --cap-add NET_RAW \
|
|
--device /dev/net/tun \
|
|
-e TS_AUTHKEY=${headscale_authkey} \
|
|
-e TS_HOSTNAME=oswl-connector \
|
|
-e TS_ROUTES=192.168.7.0/24 \
|
|
-e TS_ACCEPT_DNS=false \
|
|
-e "TS_EXTRA_ARGS=--login-server=https://hs.atlashorizon.net --advertise-exit-node" \
|
|
-e TS_USERSPACE=false \
|
|
docker.io/tailscale/tailscale:stable
|
|
ExecStop=/usr/bin/docker stop tailscaled
|
|
Restart=always
|
|
RestartSec=5s
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
- name: dozzle-agent.service
|
|
enabled: true
|
|
contents: |
|
|
[Unit]
|
|
Description=Dozzle Agent
|
|
After=docker.service
|
|
Requires=docker.service
|
|
[Service]
|
|
TimeoutStartSec=0
|
|
ExecStartPre=-/usr/bin/docker rm --force dozzle-agent
|
|
ExecStart=/usr/bin/docker run --name dozzle-agent \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-p 7007:7007 \
|
|
amir20/dozzle:v11.1.1 agent
|
|
ExecStop=/usr/bin/docker stop dozzle-agent
|
|
Restart=always
|
|
RestartSec=5s
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
storage:
|
|
files:
|
|
# Forwarding must be on for the subnet route and the exit node to pass
|
|
# traffic at all; the container shares the host netns (--network host), so
|
|
# this has to be set on the host, not inside it.
|
|
- path: /etc/sysctl.d/99-tailscale.conf
|
|
mode: 0644
|
|
contents:
|
|
inline: |
|
|
net.ipv4.ip_forward = 1
|
|
net.ipv6.conf.all.forwarding = 1
|