47 lines
1.8 KiB
Bash
47 lines
1.8 KiB
Bash
|
#!/bin/sh
|
||
|
|
# 30-tailscale.sh — install Tailscale; auto-join tailnet if --ts-auth-key
|
||
|
|
# was passed at build time (key file at /root/s8n-postinstall/ts-auth-key).
|
||
|
|
# Without auth-key: install client only, manual `tailscale up` post-boot.
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
if ! command -v tailscale >/dev/null; then
|
||
|
|
echo "[30] adding tailscale repo + installing"
|
||
|
|
curl -fsSL https://pkgs.tailscale.com/stable/debian/trixie.noarmor.gpg \
|
||
|
|
-o /usr/share/keyrings/tailscale-archive-keyring.gpg
|
||
|
|
curl -fsSL https://pkgs.tailscale.com/stable/debian/trixie.tailscale-keyring.list \
|
||
|
|
-o /etc/apt/sources.list.d/tailscale.list
|
||
|
|
apt-get update
|
||
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tailscale
|
||
|
|
else
|
||
|
|
echo "[30] tailscale already installed"
|
||
|
|
fi
|
||
|
|
|
||
|
|
systemctl enable tailscaled || true
|
||
|
|
|
||
|
|
# Auto-join if auth-key file present. tailscaled isn't running yet (we're in
|
||
|
|
# chroot during install), so write a oneshot unit that joins on first boot.
|
||
|
|
KEY_FILE=/root/s8n-postinstall/ts-auth-key
|
||
|
|
if [ -s "$KEY_FILE" ]; then
|
||
|
|
echo "[30] auth-key found, deploying first-boot join unit"
|
||
|
|
install -m 600 "$KEY_FILE" /etc/tailscale-authkey
|
||
|
|
cat > /etc/systemd/system/s8n-tailscale-join.service <<'UNIT'
|
||
|
|
[Unit]
|
||
|
|
Description=s8n Tailscale first-boot join
|
||
|
|
After=tailscaled.service network-online.target
|
||
|
|
Wants=network-online.target tailscaled.service
|
||
|
|
ConditionPathExists=/etc/tailscale-authkey
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=oneshot
|
||
|
|
ExecStart=/bin/sh -c 'tailscale up --login-server=https://hs.s8n.ru --auth-key=$(cat /etc/tailscale-authkey) && shred -u /etc/tailscale-authkey && systemctl disable s8n-tailscale-join.service'
|
||
|
|
RemainAfterExit=yes
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|
||
|
|
UNIT
|
||
|
|
systemctl enable s8n-tailscale-join.service || true
|
||
|
|
else
|
||
|
|
echo "[30] no auth-key; install tailscale only. Login post-boot:"
|
||
|
|
echo " sudo tailscale up --login-server=https://hs.s8n.ru"
|
||
|
|
fi
|