Initial commit: Tailscale Docker deployment with Headscale

Docker Compose 部署 Tailscale 連線至自架 Headscale 控制伺服器，
包含子網路由、出口節點、iptables NAT 設定及完整中文文件。

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

iptables_reset_and_configure.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+echo "🧹 清除所有規則並重設策略..."
+iptables -F
+iptables -t nat -F
+iptables -X
+
+# 設定預設策略
+# iptables -P INPUT DROP
+iptables -P INPUT ACCEPT
+iptables -P FORWARD ACCEPT
+# iptables -P FORWARD DROP
+iptables -P OUTPUT ACCEPT
+
+echo "✅ 設定 INPUT 安全規則..."
+
+# 允許已建立與相關的連線（像是回應封包）
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow established/related"
+
+# 允許 loopback
+iptables -A INPUT -i lo -j ACCEPT -m comment --comment "Allow loopback"
+
+# 允許 ICMP (ping)
+iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -m comment --comment "Allow ping"
+
+# 允許 SSH
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT -m comment --comment "Allow SSH"
+
+# 可選：允許 HTTP/HTTPS（如果有 Web 應用）
+iptables -A INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP"
+iptables -A INPUT -p tcp --dport 443 -j ACCEPT -m comment --comment "Allow HTTPS"
+
+echo "🔧 設定 Tailscale 出口 NAT（MASQUERADE）"
+iptables -t nat -A POSTROUTING -s 100.64.0.0/10 -o eth0 -j MASQUERADE -m comment --comment "Tailscale NAT"
+
+echo "🔧 允許 Tailscale → LAN 轉送"
+iptables -A FORWARD -i tailscale0 -o eth0 -j ACCEPT -m comment --comment "Tailscale → LAN"
+iptables -A FORWARD -i eth0 -o tailscale0 -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment "LAN → Tailscale return"
+
+echo "📦 儲存規則（iptables-persistent）"
+iptables-save > /etc/iptables/rules.v4
+
+echo "✅ 防火牆與 NAT 重設完成！"
+