auto-ci
49 lines
1.6 KiB
Bash
49 lines
1.6 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Start Tailscale in background
|
|
/usr/local/bin/tailscaled --tun=userspace-networking --encrypt-state=false --hardware-attestation=false &
|
|
TAILSCALED_PID=$!
|
|
|
|
# Wait for Tailscale to initialize
|
|
sleep 2
|
|
|
|
# Authenticate with Tailscale via auth key
|
|
if [ -n "$TS_AUTHKEY" ] && [ "$TS_AUTHKEY" != "tskey-YOUR-AUTH-KEY-HERE" ]; then
|
|
# tailscale up flags change over time; avoid deprecated options.
|
|
/usr/local/bin/tailscale up --authkey="$TS_AUTHKEY" ${TS_EXTRA_ARGS:-"--accept-dns=false --advertise-exit-node"} || true
|
|
else
|
|
echo "TS_AUTHKEY is not set to a real key; skipping tailscale up"
|
|
fi
|
|
|
|
# Wait a bit for Tailscale to be ready
|
|
sleep 3
|
|
|
|
# Configure iptables to redirect all traffic through redsocks
|
|
echo "Setting up iptables rules for traffic redirection..."
|
|
|
|
# Enable IP forwarding for exit node
|
|
sysctl -w net.ipv4.ip_forward=1 2>/dev/null || true
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 2>/dev/null || true
|
|
|
|
# Create a chain for darkproxy traffic
|
|
iptables -t nat -N DARKPROXY 2>/dev/null || iptables -t nat -F DARKPROXY
|
|
|
|
# Whitelist local traffic and Tailscale
|
|
iptables -t nat -A DARKPROXY -d 127.0.0.0/8 -j RETURN
|
|
iptables -t nat -A DARKPROXY -d 10.5.0.0/16 -j RETURN
|
|
iptables -t nat -A DARKPROXY -d 100.64.0.0/10 -j RETURN # Tailscale IP range
|
|
|
|
# Redirect all other TCP to redsocks
|
|
iptables -t nat -A DARKPROXY -p tcp -j REDIRECT --to-ports 12345
|
|
|
|
# Apply chain to all output
|
|
iptables -t nat -I OUTPUT 1 -j DARKPROXY 2>/dev/null || true
|
|
iptables -t nat -I PREROUTING 1 -j DARKPROXY 2>/dev/null || true
|
|
|
|
echo "Starting redsocks..."
|
|
redsocks -c /etc/redsocks.conf
|
|
|
|
# Keep container alive
|
|
wait $TAILSCALED_PID
|