| 1 | diff --git a/deploy/edge/Caddyfile b/deploy/edge/Caddyfile |
| 2 | index e0d915d..e0dd58f 100644 |
| 3 | --- a/deploy/edge/Caddyfile |
| 4 | +++ b/deploy/edge/Caddyfile |
| 5 | @@ -8,11 +8,11 @@ |
| 6 | |
| 7 | # Fly's proxy terminates TLS and forwards HTTP here with the original Host |
| 8 | # and X-Forwarded-Proto. Upstream traffic reaches the relay host over the |
| 9 | -# tailnet through tailscaled's local CONNECT proxy. |
| 10 | +# tailnet through tailscaled's local SOCKS5 proxy, which dials by address. |
| 11 | :8080 { |
| 12 | reverse_proxy http://{$RELAY_TAILNET_HOST}:8080 { |
| 13 | transport http { |
| 14 | - network_proxy http://127.0.0.1:1055 |
| 15 | + network_proxy url socks5://127.0.0.1:1055 |
| 16 | } |
| 17 | } |
| 18 | } |
| 19 | diff --git a/deploy/edge/start.sh b/deploy/edge/start.sh |
| 20 | index ab1404e..ea80e70 100644 |
| 21 | --- a/deploy/edge/start.sh |
| 22 | +++ b/deploy/edge/start.sh |
| 23 | @@ -1,12 +1,13 @@ |
| 24 | #!/bin/sh |
| 25 | # Join the tailnet in userspace mode, expose an HTTP CONNECT proxy for Caddy, |
| 26 | -# then run Caddy. TS_AUTHKEY comes from a Fly secret and is only needed the |
| 27 | +# then run Caddy. tailscaled dials upstreams by address through SOCKS5 so the |
| 28 | +# Host header passes through untouched. TS_AUTHKEY comes from a Fly secret and is only needed the |
| 29 | # first time; afterwards the identity persists on the state volume. |
| 30 | set -eu |
| 31 | STATE="${TS_STATE_DIR:-/var/lib/tailscale}" |
| 32 | mkdir -p /var/run/tailscale "$STATE" |
| 33 | tailscaled --state="$STATE/tailscaled.state" --socket=/var/run/tailscale/tailscaled.sock \ |
| 34 | - --tun=userspace-networking --outbound-http-proxy-listen=127.0.0.1:1055 & |
| 35 | + --tun=userspace-networking --socks5-server=127.0.0.1:1055 & |
| 36 | until [ -S /var/run/tailscale/tailscaled.sock ]; do sleep 1; done |
| 37 | if [ -n "${TS_AUTHKEY:-}" ]; then |
| 38 | tailscale --socket=/var/run/tailscale/tailscaled.sock up --authkey="$TS_AUTHKEY" --hostname="${TS_HOSTNAME:-tiny-edge}" --accept-dns=false |