tailscale/scripts/start.sh

#!/bin/bash

exit_handler() {
    echo "Exit signal cought, restarting container..."
    tailscale down >/dev/null 2>&1
    tailscaled -cleanup >/dev/null 2>&1
    kill $(pidof sleep)
    exit 0
}

trap exit_handler SIGTERM SIGINT

error_handler() {
  echo
  echo "ERROR: Please fix the above issue and restart the container"
  sleep infinity
}

tailscale_watchdog() {
  while true; do
    sleep ${1}s &
    wait $!
    TAILSCALE_RUNNING=$(tailscale status --json | jq -r '.BackendState')
    if [ "$TAILSCALE_RUNNING" != "Running" ]; then
      echo "ERROR: Connection to Tailscale lost, restarting container..."
      exit 1
    fi
  done
}

echo "Starting..."

if [ ! -z "${TAILSCALE_HOSTNAME}" ]; then
  TSD_STATE_DIR=${DATA_DIR}/${TAILSCALE_HOSTNAME}/.tailscale_state
  echo "Settings Tailscale state dir to: ${TSD_STATE_DIR}"
elif [ ! -z "${TAILSCALE_STATE_DIR}" ]; then
  TSD_STATE_DIR=${DATA_DIR}/${TAILSCALE_STATE_DIR}/.tailscale_state
  echo "Settings Tailscale state dir to: ${TSD_STATE_DIR}"
else
  echo "ERROR: TAILSCALE_HOSTNAME nor TAILSCALE_STATE_DIR are set!"
  echo "       You have to set either a Host name or the State dir"
  error_handler
fi

if [ ! -d "${TSD_STATE_DIR}" ]; then
  mkdir -p ${TSD_STATE_DIR}
fi

if [ ! -z "${TAILSCALE_EXIT_NODE_IP}" ]; then
  echo "Using ${TAILSCALE_EXIT_NODE_IP} as Exit Node! See https://tailscale.com/kb/1103/exit-nodes"
  TS_PARAMS=" --exit-node=${TAILSCALE_EXIT_NODE_IP}"
  if [ ! -z "${TAILSCALE_ALLOW_LAN_ACCESS}" ]; then
    echo "Enabling local LAN Access to the container!"
    TS_PARAMS+=" --exit-node-allow-lan-access"
  fi
else
  if [ -z "${TAILSCALE_USERSPACE_NETWORKING}" ] || [ "${TAILSCALE_USERSPACE_NETWORKING}" == "true" ]; then
    TSD_PARAMS+="-tun=userspace-networking "
  else
    if [ ! -c /dev/net/tun ]; then
      echo "ERROR: Device /dev/net/tun not found!"
      echo "       Make sure to pass through /dev/net/tun to the container and add the"
      echo "       parameter --cap-add=NET_ADMIN to the Extra Parameters!"
      error_handler
    fi
  fi
fi

if [ "${TAILSCALE_USE_SSH}" == "true" ]; then
  echo "Enabling SSH. See https://tailscale.com/kb/1193/tailscale-ssh"
  TS_PARAMS+=" --ssh"
fi

if [ "${TAILSCALE_LOG}" != "false" ]; then
  TSD_PARAMS+=">>/var/log/tailscaled 2>&1 "
  TSD_MSG=" with log file /var/log/tailscaled"
else
  TSD_PARAMS+=">/dev/null 2>&1 "
fi

if [[ ! -z "${TAILSCALE_AUTHKEY}" && -f ${TSD_STATE_DIR}/.initialized ]]; then
  echo
  echo "-> It is now save to remove the variable TAILSCALE_AUTHKEY from your template <-"
  echo
  unset TAILSCALE_AUTHKEY
fi

if [ ! -z "${TAILSCALE_AUTHKEY}" ]; then
  TS_AUTH="--authkey=${TAILSCALE_AUTHKEY} "
fi

if [ ! -z "${TAILSCALE_HOSTNAME}" ]; then
  echo "Setting host name to ${TAILSCALE_HOSTNAME}"
  TS_PARAMS+=" --hostname=${TAILSCALE_HOSTNAME/ /}"
fi

if [ "${TAILSCALE_EXIT_NODE}" == "true" ]; then
  echo "Configuring container as Exit Node! See https://tailscale.com/kb/1103/exit-nodes"
  TS_PARAMS+=" --advertise-exit-node"
fi

if [ ! -z "${TAILSCALED_PARAMS}" ]; then
  TSD_PARAMS="${TAILSCALED_PARAMS} ${TSD_PARAMS}"
fi

if [ ! -z "${TAILSCALE_PARAMS}" ]; then
  TS_PARAMS="${TAILSCALE_PARAMS}${TS_PARAMS}"
fi

echo "Starting tailscaled${TSD_MSG}"
eval tailscaled -statedir=${TSD_STATE_DIR} ${TSD_PARAMS}&

echo "Starting tailscale"
eval tailscale up ${TS_AUTH}${TS_PARAMS}
EXIT_STATUS="$?"

sleep 2
if [ "${EXIT_STATUS}" == "0" ]; then
  echo "Connecting to Tailscale successful!"
  if [ ! -f ${TSD_STATE_DIR}/.initialized ]; then
    echo "Please don't remove this file!" > ${TSD_STATE_DIR}/.initialized
  fi
  if [ -z "${CHECK_INTERVAL}" ]; then
    echo "No check interval defined, falling back to 300 seconds"
    CHECK_INTERVAL=300
  fi
  tailscale_watchdog "${CHECK_INTERVAL}" &
  WATCHDOG_PID=$!
else
  echo "ERROR: Connecting to Tailscale not successful!"
  if [ -f /var/log/tailscaled ]; then
    echo "Please check the logs:"
    tail -20 /var/log/tailscaled
  fi
  error_handler
fi

if [[ ! -z "${TAILSCALE_SERVE_PORT}" && "$(tailscale status --json | jq -r '.CurrentTailnet.MagicDNSEnabled')" == "false" ]] ; then
  echo "ERROR: Enable HTTPS on your Tailscale account to use Tailscale Serve/Funnel."
  echo "See: https://tailscale.com/kb/1153/enabling-https"
  error_handler
fi

if [ ! -z ${TAILSCALE_SERVE_PORT} ]; then
  if [ ! -z "${TAILSCALE_SERVE_PATH}" ]; then
    TAILSCALE_SERVE_PATH="=${TAILSCALE_SERVE_PATH}"
  fi
  if [ -z "${TAILSCALE_SERVE_MODE}" ]; then
    TAILSCALE_SERVE_MODE="https"
  fi
  if [ -z "${TAILSCALE_SERVE_PROTOCOL_PORT}" ]; then
    TAILSCALE_SERVE_PROTOCOL_PORT="=443"
  fi
  if [ "${TAILSCALE_FUNNEL}" == "true" ]; then
    echo "Enabling Funnel! See https://tailscale.com/kb/1223/funnel"
    eval tailscale funnel --bg --"${TAILSCALE_SERVE_MODE}"${TAILSCALE_SERVE_PROTOCOL_PORT}${TAILSCALE_SERVE_PATH} http://localhost:"${TAILSCALE_SERVE_PORT}${TAILSCALE_SERVE_LOCALPATH}"
  else
    echo "Enabling Serve! See https://tailscale.com/kb/1312/serve"
    eval tailscale serve --bg --"${TAILSCALE_SERVE_MODE}"${TAILSCALE_SERVE_PROTOCOL_PORT}${TAILSCALE_SERVE_PATH} http://localhost:"${TAILSCALE_SERVE_PORT}${TAILSCALE_SERVE_LOCALPATH}"
  fi
fi

echo "Container fully started"
wait ${WATCHDOG_PID}