-
Notifications
You must be signed in to change notification settings - Fork 30
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This is a much cleaner process now. The tailscale package is installed from the repo and the .deb stored in /config to be reinstalled on firmware upgrade. The firstboot and post-config scripts seem to work with minimal (no?) manual intervention needed and should ensure that Tailscale starts after routing is available. We now use a bind mount of the state directory to /var/lib/tailscale as the symlink wasn't reliable - the bind mount means systemd can ensure it's in place before starting the service. The post-config script should detect when tailscaled.service needs restarting and do so, in case unit overrides or the mount point weren't in place when the package was installed.
- Loading branch information
Showing
2 changed files
with
85 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,33 +2,101 @@ | |
|
|
||
| set -e | ||
|
|
||
| # Symlink the state directory to /config to preserve across reboots/upgrades | ||
| mkdir -p /config/tailscale/systemd/tailscaled.service.d | ||
| mkdir -p /config/tailscale/state | ||
| ln -s /config/tailscale/state /var/lib/tailscale | ||
|
|
||
| # Create a bind mount for the Tailscale state directory | ||
| if [ ! -f /config/tailscale/systemd/var-lib-tailscale.mount ]; then | ||
| cat > /config/tailscale/systemd/var-lib-tailscale.mount <<-EOF | ||
| [Mount] | ||
| What=/config/tailscale/state | ||
| Where=/var/lib/tailscale | ||
| Type=none | ||
| Options=bind | ||
| [Install] | ||
| WantedBy=multi-user.target | ||
| EOF | ||
| fi | ||
|
|
||
| # Add an override to tailscaled.service to require the bind mount | ||
| if [ ! -f /config/tailscale/systemd/tailscaled.service.d/mount.conf ]; then | ||
| cat > /config/tailscale/systemd/tailscaled.service.d/mount.conf <<-EOF | ||
| [Unit] | ||
| RequiresMountsFor=/var/lib/tailscale | ||
| EOF | ||
| fi | ||
| # Add an override to tailscaled.service to wait until "UBNT Routing Daemons" | ||
| # has finished, otherwise tailscaled won't have proper networking | ||
| if [ ! -f /config/tailscale/systemd/tailscaled.service.d/wait-for-networking.conf ]; then | ||
| cat > /config/tailscale/systemd/tailscaled.service.d/wait-for-networking.conf <<-EOF | ||
| [Unit] | ||
| Wants=vyatta-router.service | ||
| After=vyatta-router.service | ||
| EOF | ||
| fi | ||
|
|
||
| if [ ! -L /etc/systemd/system/tailscaled.service.d ]; then | ||
| ln -s /config/tailscale/systemd/tailscaled.service.d /etc/systemd/system/tailscaled.service.d | ||
| fi | ||
| systemctl daemon-reload | ||
|
|
||
| # Ensure there is a post-config script to install the tailscale package | ||
| # Ensure there is a post-config script to install Tailscale | ||
| mkdir -p /config/scripts/post-config.d | ||
| if [ ! -x /config/scripts/post-config.d/tailscale.sh ]; then | ||
| cat > /config/scripts/post-config.d/tailscale.sh <<EOF | ||
| cat > /config/scripts/post-config.d/tailscale.sh <<"EOF" | ||
| #!/bin/sh | ||
| set -e | ||
| if ! gpg --list-keys --with-colons --keyring /etc/apt/trusted.gpg | grep -qF [email protected]; then | ||
| reload="" | ||
| # The mount unit needs to be copied rather than linked. | ||
| # systemd errors with "Link has been severed" if the unit is a symlink. | ||
| if [ ! -f /etc/systemd/system/var-lib-tailscale.mount ]; then | ||
| echo Installing /var/lib/tailscale mount unit | ||
| cp /config/tailscale/systemd/var-lib-tailscale.mount /etc/systemd/system/var-lib-tailscale.mount | ||
| reload=y | ||
| fi | ||
| if [ ! -L /etc/systemd/system/tailscaled.service.d ]; then | ||
| ln -s /config/tailscale/systemd/tailscaled.service.d /etc/systemd/system/tailscaled.service.d | ||
| reload=y | ||
| fi | ||
| if [ -n "$reload" ]; then | ||
| # Ensure systemd has loaded the unit overrides | ||
| systemctl daemon-reload | ||
| fi | ||
| KEYRING=/usr/share/keyrings/tailscale-stretch-stable.gpg | ||
| if ! gpg --list-keys --with-colons --keyring $KEYRING 2>/dev/null | grep -qF [email protected]; then | ||
| echo Installing Tailscale repository signing key | ||
| if [ ! -e /config/tailscale/stretch.gpg ]; then | ||
| curl -fsSLo /config/tailscale/stretch.gpg https://pkgs.tailscale.com/stable/debian/stretch.gpg | ||
| curl -fsSL https://pkgs.tailscale.com/stable/debian/stretch.asc | gpg --dearmor > /config/tailscale/stretch.gpg | ||
| fi | ||
| apt-key add /config/tailscale/stretch.gpg >/dev/null 2>&1 | ||
| cp /config/tailscale/stretch.gpg $KEYRING | ||
| fi | ||
| if ! dpkg-query -Wf '${Status}' tailscale 2>/dev/null | grep -qF "install ok installed"; then | ||
| apt-get update | ||
| apt-get install tailscale | ||
| mkdir -p /config/data/firstboot/install-packages | ||
| cp /var/cache/apt/archives/tailscale_*.deb /config/data/firstboot/install-packages | ||
| pkg_status=$(dpkg-query -Wf '${Status}' tailscale 2>/dev/null || true) | ||
| if ! echo $pkg_status| grep -qF "install ok installed"; then | ||
| # Sometimes after a firmware upgrade the package goes into half-configured state | ||
| if echo $pkg_status | grep -qF "half-configured"; then | ||
| # Use systemd-run to configure the package in a separate unit, otherwise it will block | ||
| # due to tailscaled.service waiting on vyatta-router.service, which is running this script. | ||
| systemd-run --no-block dpkg --configure -a | ||
| else | ||
| echo "Installing Tailscale" | ||
| apt-get update | ||
| apt-get install tailscale | ||
| mkdir -p /config/data/firstboot/install-packages | ||
| cp /var/cache/apt/archives/tailscale_*.deb /config/data/firstboot/install-packages | ||
| fi | ||
| fi | ||
| if [ -n "$reload" ]; then | ||
| systemctl --no-block restart tailscaled | ||
| fi | ||
| EOF | ||
| chmod 755 /config/scripts/post-config.d/tailscale.sh | ||
|
|
||