# CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

## Overview

Docker-based Tailscale deployment using a self-hosted Headscale control server (`https://headscale.lotimmy.com`). Runs a `tailscale/tailscale:latest` container in host network mode with subnet routing (192.168.88.0/24) and exit node capability.

## Commands

```bash
# Start the Tailscale container
./run.sh                          # docker-compose up -d

# Stop the container
./stop.sh                         # docker-compose down

# Connect to Headscale (advertise subnet routes + exit node)
./docker_exec_tailscale_up.sh

# Check status / get IP
./docker_exec_tailscale_status.sh
./docker_exec_tailscale_ip.sh

# Run arbitrary tailscale commands inside the container
./tailscale <args>                # wrapper for: docker exec -i tailscale tailscale "$@"

# Reset iptables and configure NAT/forwarding for Tailscale routing (run on host)
./iptables_reset_and_configure.sh
```

## Architecture

- **docker-compose.yml** - Single service (`tailscale`) running `tailscale/tailscale:latest` with `NET_ADMIN`/`SYS_MODULE` caps, host networking, TUN device mount, and persistent state at `/opt/tailscale`.
- **`.env`** - Contains `TS_AUTHKEY` for pre-authenticated registration with Headscale.
- **iptables_reset_and_configure.sh** - Configures host firewall: allows SSH/HTTP/HTTPS/ICMP, sets up MASQUERADE NAT for Tailscale CGNAT range (100.64.0.0/10) via eth0, and enables forwarding between `tailscale0` and `eth0`.
- Watchtower auto-update is enabled via container label.

## Notes

- Documentation (`README`) is in Traditional Chinese.
- Hostname convention: `ip-192-168-88-XX` matching the host's LAN IP.