auto-ci
51 lines
1.6 KiB
Bash
51 lines
1.6 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Start Tailscale in background
|
|
/usr/local/bin/tailscaled --tun=userspace-networking --encrypt-state=false --hardware-attestation=false &
|
|
TAILSCALED_PID=$!
|
|
|
|
# Wait for Tailscale to initialize
|
|
sleep 2
|
|
|
|
if [ -z "${TS_AUTHKEY:-}" ]; then
|
|
echo "TS_AUTHKEY must be set when enabling the tailscale profile" >&2
|
|
kill "$TAILSCALED_PID"
|
|
wait "$TAILSCALED_PID" || true
|
|
exit 1
|
|
fi
|
|
|
|
# tailscale up flags change over time; avoid deprecated options.
|
|
/usr/local/bin/tailscale up --authkey="$TS_AUTHKEY" ${TS_EXTRA_ARGS:-"--accept-dns=false --advertise-exit-node"}
|
|
|
|
# Wait a bit for Tailscale to be ready
|
|
sleep 3
|
|
|
|
# Configure iptables to redirect all traffic through redsocks
|
|
echo "Setting up iptables rules for traffic redirection..."
|
|
|
|
# Enable IP forwarding for exit node
|
|
sysctl -w net.ipv4.ip_forward=1 2>/dev/null || true
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 2>/dev/null || true
|
|
|
|
# Create a chain for darkproxy traffic
|
|
iptables -t nat -N DARKPROXY 2>/dev/null || iptables -t nat -F DARKPROXY
|
|
|
|
# Whitelist local traffic and Tailscale
|
|
iptables -t nat -A DARKPROXY -d 127.0.0.0/8 -j RETURN
|
|
iptables -t nat -A DARKPROXY -d 10.5.0.0/16 -j RETURN
|
|
iptables -t nat -A DARKPROXY -d 100.64.0.0/10 -j RETURN # Tailscale IP range
|
|
|
|
# Redirect all other TCP to redsocks
|
|
iptables -t nat -A DARKPROXY -p tcp -j REDIRECT --to-ports 12345
|
|
|
|
# Apply chain to all output
|
|
iptables -t nat -I OUTPUT 1 -j DARKPROXY 2>/dev/null || true
|
|
iptables -t nat -I PREROUTING 1 -j DARKPROXY 2>/dev/null || true
|
|
|
|
echo "Starting redsocks..."
|
|
redsocks -c /etc/redsocks.conf
|
|
|
|
# Keep container alive
|
|
wait $TAILSCALED_PID
|