Files

Timmy 2ffa06ac80 Initial commit: Tailscale Docker deployment with Headscale

Docker Compose 部署 Tailscale 連線至自架 Headscale 控制伺服器，
包含子網路由、出口節點、iptables NAT 設定及完整中文文件。

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-10 09:17:12 +08:00

1.7 KiB

Raw Blame History

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Overview

Docker-based Tailscale deployment using a self-hosted Headscale control server (https://headscale.lotimmy.com). Runs a tailscale/tailscale:latest container in host network mode with subnet routing (192.168.88.0/24) and exit node capability.

Commands

# Start the Tailscale container
./run.sh                          # docker-compose up -d

# Stop the container
./stop.sh                         # docker-compose down

# Connect to Headscale (advertise subnet routes + exit node)
./docker_exec_tailscale_up.sh

# Check status / get IP
./docker_exec_tailscale_status.sh
./docker_exec_tailscale_ip.sh

# Run arbitrary tailscale commands inside the container
./tailscale <args>                # wrapper for: docker exec -i tailscale tailscale "$@"

# Reset iptables and configure NAT/forwarding for Tailscale routing (run on host)
./iptables_reset_and_configure.sh

Architecture

docker-compose.yml - Single service (tailscale) running tailscale/tailscale:latest with NET_ADMIN/SYS_MODULE caps, host networking, TUN device mount, and persistent state at /opt/tailscale.
.env - Contains TS_AUTHKEY for pre-authenticated registration with Headscale.
iptables_reset_and_configure.sh - Configures host firewall: allows SSH/HTTP/HTTPS/ICMP, sets up MASQUERADE NAT for Tailscale CGNAT range (100.64.0.0/10) via eth0, and enables forwarding between tailscale0 and eth0.
Watchtower auto-update is enabled via container label.

Notes

Documentation (README) is in Traditional Chinese.
Hostname convention: ip-192-168-88-XX matching the host's LAN IP.