| 1 | #!/bin/sh |
| 2 | # Join the tailnet in userspace mode, expose an HTTP CONNECT proxy for Caddy, |
| 3 | # then run Caddy. tailscaled dials upstreams by address through SOCKS5 so the |
| 4 | # Host header passes through untouched. TS_AUTHKEY comes from a Fly secret and is only needed the |
| 5 | # first time; afterwards the identity persists on the state volume. |
| 6 | set -eu |
| 7 | STATE="${TS_STATE_DIR:-/var/lib/tailscale}" |
| 8 | mkdir -p /var/run/tailscale "$STATE" |
| 9 | tailscaled --state="$STATE/tailscaled.state" --socket=/var/run/tailscale/tailscaled.sock \ |
| 10 | --tun=userspace-networking --socks5-server=127.0.0.1:1055 & |
| 11 | until [ -S /var/run/tailscale/tailscaled.sock ]; do sleep 1; done |
| 12 | if [ -n "${TS_AUTHKEY:-}" ]; then |
| 13 | tailscale --socket=/var/run/tailscale/tailscaled.sock up --authkey="$TS_AUTHKEY" --hostname="${TS_HOSTNAME:-tiny-edge}" --accept-dns=false |
| 14 | elif [ -f "$STATE/tailscaled.state" ]; then |
| 15 | tailscale --socket=/var/run/tailscale/tailscaled.sock up --hostname="${TS_HOSTNAME:-tiny-edge}" --accept-dns=false |
| 16 | else |
| 17 | echo "TS_AUTHKEY is not set and no tailnet state exists; set the secret and redeploy" >&2 |
| 18 | fi |
| 19 | exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile |