tailscale与headscale协同组网并启用derp中继

# 进入VPS，并下载安装包
wget -O headscale.deb https://github.com/juanfont/headscale/releases/download/v0.29.5/headscale_0.29.5_linux_amd64.deb
# 安装headscale
sudo apt install ./headscale.deb
 
# 修改headscale的配置
sudo vim /etc/headscale/config.yaml

server_url: https://hs.example.com  # 指明headscale面板/服务端的地址
listen_addr: 127.0.0.1:8080         # 服务面板的端口（后续nginx反代地址）
 
derp:
  server:
    enabled: true                   # 开启derp
    stun_listen_addr: "0.0.0.0:3478" 
    private_key_path: /var/lib/headscale/derp_server_private.key
    ipv4: 198.51.100.1              # 这里一定要改成VPS真实的IP地址，默认是美国旧金山的
    # ipv6: 2001:db8::1               # ipv6一般不用，直接注释掉即可
    
dns:
  magic_dns: true
  base_domain: tail.net             # 这里配置一个内网DNS的解析根域名
  override_local_dns: false         # 防止覆盖掉VPS自身的DNS
  nameservers:
    global:
      - 223.5.5.5                   # 补一个国内阿里云DNS

# 首先用certbot申请一下证书
sudo apt install certbot python3-certbot-nginx
sudo certbot certonly --nginx -d hs.example.com
# 然后以单文件形式放一下headscale的nginx配置
sudo vim /etc/nginx/conf.d/headscale.conf

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}
 
server {
    listen 80;
    listen [::]:80;
    server_name hs.example.com;
    return 301 https://$host$request_uri;
}
 
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name hs.example.com;
 
    ssl_certificate     /etc/letsencrypt/live/hs.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/hs.example.com/privkey.pem;
 
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

# 检验nginx配置格式并重载
sudo nginx -t && sudo systemctl reload nginx

# 首先保证权限通关
sudo chown -R headscale:headscale /var/lib/headscale
# 开机自启
sudo systemctl enable --now headscale
# 立即重启
sudo systemctl restart headscale
 
# 依次检验服务连通性
curl -i https://hs.example.com/health 
curl -i https://hs.example.com/derp/probe
sudo ss -lunp | grep 3478 
 
# 创建用户(home为默认设备组)
sudo headscale users create home
# 检查一下用户id
sudo headscale users list
 
# 创建一个24小时过期的认证密钥(这里--user 1，前边首次创建home默认id就是1)
# 这会返回一个认证密钥，用于24小时内的无确认进组
sudo headscale preauthkeys create --user 1 --reusable --expiration 24h

# Desktop桌面端
sudo tailscale up --login-server=https://hs.example.com --authkey=<密钥>
 
# Phone移动端一般没有命令行操作，所以还是用服务器确认认证的方式
# 下面是移动客户端发起请求后，VPS的操作
# 这里的id来自移动客户端
sudo headscale auth register --auth-id <id> --user home 

# 查看当前headscale下的节点
sudo headscale nodes list
# 给某些设备节点一个别名，比如nas
sudo headscale nodes rename -i <ID> nas
 
# 客户端tailscale进行网络检查
tailscale netcheck
# 客户端tailscale的内部DNS-Ping通信
tailscale ping nas
 
# 再进入其他网络中，可以进行备注（同一客户端只能进入一个虚拟组网中）
tailscale login --nickname=friend
# 展示可切换组网
tailscale switch --list
tailscale switch friend