other/tailscale/tailscale-install.md

```
https://github.com/juanfont/headscale/releases/download/v0.27.1/headscale_0.27.1_linux_amd64
https://raw.githubusercontent.com/juanfont/headscale/main/config-example.yaml
mkdir /var/lib/headscale
chown -R headscale:headscale /var/lib/headscale/
touch /var/lib/headscale/db.sqlite

headscale_0.27.1_linux_amd64 /usr/local/bin/headscale
chmod +x /usr/local/bin/headscale 
mkdir /etc/headscale/
cp config-example.yaml /etc/headscale/

```

```
修改配置文件，将 server_url 改为公网 IP 或域名。如果是国内服务器，域名必须要备案。我的域名无法备案，所以我就直接用公网 IP 了。
如果暂时用不到 DNS 功能，可以先将 magic_dns 设为 false。
server_url 设置为 http://<PUBLIC_ENDPOINT>:8080，将 <PUBLIC_ENDPOINT> 替换为公网 IP 或者域名。
建议打开随机端口，将 randomize_client_port 设为 true。
可自定义私有网段，也可同时开启 IPv4 和 IPv6：

ip_prefixes:
  # - fd7a:115c:a1e0::/48
  - 100.64.0.0/16
```
#### vim /etc/systemd/system/headscale.service
```
[Unit]
Description=headscale controller
After=syslog.target
After=network.target

[Service]
Type=simple
User=headscale
Group=headscale
ExecStart=/usr/local/bin/headscale serve
Restart=always
RestartSec=5

# Optional security enhancements
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/headscale /var/run/headscale
AmbientCapabilities=CAP_NET_BIND_SERVICE
RuntimeDirectory=headscale

[Install]
WantedBy=multi-user.target

```
#### 需要# 启用IP转发
```
echo 'net.ipv4.ip_forward=1' |  tee -a /etc/sysctl.conf
 sysctl -p
```
##### 配置NAT规则（以eth0为外网接口）
```
apt install iptables-persistent
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t filter -A FORWARD -i tailscale0 -o eth0 -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o tailscale0 -m state --state RELATED,ESTABLISHED -j ACCEPT
netfilter-persistent save
```
#### 启用出口节点模式
```
tailscale up --advertise-exit-node
```


#### 启动
```
systemctl daemon-reload
systemctl enable --now headscale
systemctl status headscale.service
```


#### 完整 egrep -v "#|^$" /etc/headscale/config.yaml
```

egrep -v "#|^$" /etc/headscale/config.yaml
---
server_url: http://47.106.140.17:8080
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 127.0.0.1:9090
grpc_listen_addr: 0.0.0.0:50443
grpc_allow_insecure: false
noise:
  private_key_path: /var/lib/headscale/noise_private.key
prefixes:
  v4: 100.64.0.0/10
  v6: fd7a:115c:a1e0::/48
  allocation: sequential
derp:
  server:
    enabled: false
    region_id: 999
    region_code: "headscale"
    region_name: "Headscale Embedded DERP"
    verify_clients: true
    stun_listen_addr: "0.0.0.0:3478"
    private_key_path: /var/lib/headscale/derp_server_private.key
    automatically_add_embedded_derp_region: true
    ipv4: 198.51.100.1
  ip_allocation: "sequential"
  acl:
    - action: "accept"
  urls:
    - https://controlplane.tailscale.com/derpmap/default
  paths: []
  auto_update_enabled: true
  update_frequency: 3h
disable_check_updates: false
ephemeral_node_inactivity_timeout: 30m
database:
  type: sqlite
  debug: false
  gorm:
    prepare_stmt: true
    parameterized_queries: true
    skip_err_record_not_found: true
    slow_threshold: 1000
  sqlite:
    path: /var/lib/headscale/db.sqlite
    write_ahead_log: true
    wal_autocheckpoint: 1000
acme_url: https://acme-v02.api.letsencrypt.org/directory
acme_email: ""
tls_letsencrypt_hostname: ""
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
tls_letsencrypt_challenge_type: HTTP-01
tls_letsencrypt_listen: ":http"
tls_cert_path: ""
tls_key_path: ""
log:
  level: info
  format: text
policy:
  mode: file
  path: ""
dns:
  magic_dns: false
  base_domain: rapha.top
  override_local_dns: true
  nameservers:
    global:
      - 114.114.114.114
      - 233.5.5.5
      - 1.1.1.1
      - 8.8.8.8
    split:
      {}
  search_domains: []
  extra_records: []
unix_socket: /var/run/headscale/headscale.sock
unix_socket_permission: "0770"
logtail:
  enabled: false
randomize_client_port: false

```

### 创建用户
```
headscale user create cba
```
### 查看用户

```
# headscale user list
ID | Name | Username | Email | Created            
1  |      | cba      |       | 2025-12-11 14:11:53
2  |      | abc      |       | 2025-12-13 12:23:02
```

### linux cli 配置
```
wget https://pkgs.tailscale.com/stable/tailscale_1.22.2_amd64.tgz
tar zxvf tailscale_1.22.2_amd64.tgz

cp tailscale_1.22.2_amd64/tailscaled /usr/sbin/tailscaled
cp tailscale_1.22.2_amd64/tailscale /usr/bin/tailscale

cp tailscale_1.22.2_amd64/systemd/tailscaled.service /lib/systemd/system/tailscaled.service
cp tailscale_1.22.2_amd64/systemd/tailscaled.defaults /etc/default/tailscaled
```
```
systemctl enable --now tailscaled
systemctl status tailscaled
```
#### Tailscale 接入 Headscale：
```
## 如果你是在自己的服务器上部署的，请将 <HEADSCALE_PUB_ENDPOINT> 换成你的 Headscale 公网 IP 或域名

 tailscale up --login-server=http://47.106.140.17:8080 --accept-routes=true --accept-dns=false

```
### 将其中的命令复制粘贴到服务段 headscale 所在机器的终端中，并将 USERNAME 替换为前面所创建的 user。

  headscale nodes register --key ZR12m7dvnPUgbbfkx_FdMUvW --user  cba
```
```
#### 注册成功，查看注册的节点：
```
# headscale nodes list
ID | Hostname  | Name      | MachineKey | NodeKey | User | IP addresses                  | Ephemeral | Last seen           | Expiration          | Connected | Expired
1  | localhost | localhost | [ZqdSj]    | [qxtoU] | cba  | 100.64.0.1, fd7a:115c:a1e0::1 | false     | 2025-12-13 15:03:06 | 0001-01-01 00:00:00 | offline   | no     
2  | smb-kk    | smb-kk    | [6+OpS]    | [ZOUQN] | abc  | 100.64.0.2, fd7a:115c:a1e0::2 | false     | 2025-12-13 14:42:15 | 0001-01-01 00:00:00 | online    | no     

```
#### 回到 Tailscale 客户端所在的 Linux 主机，可以看到 Tailscale 会自动创建相关的路由表和 iptables 规则。路由表可通过以下命令查看
```
# ip route show table 52

100.64.0.1 dev tailscale0 
100.100.100.100 dev tailscale0 
```
#### 查看 iptables 规则：

```
#  iptables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-BRIDGE
-N DOCKER-CT
-N DOCKER-FORWARD
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-N ts-forward
-N ts-input
-A INPUT -j ts-input
-A FORWARD -j ts-forward
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-FORWARD
-A DOCKER ! -i docker0 -o docker0 -j DROP
-A DOCKER-BRIDGE -o docker0 -j DOCKER
-A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-FORWARD -j DOCKER-CT
-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1
-A DOCKER-FORWARD -j DOCKER-BRIDGE
-A DOCKER-FORWARD -i docker0 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-USER -j RETURN
-A ts-forward -i tailscale0 -j MARK --set-xmark 0x40000/0xff0000
-A ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT
-A ts-forward -s 100.64.0.0/10 -o tailscale0 -j DROP
-A ts-forward -o tailscale0 -j ACCEPT
-A ts-input -s 100.64.0.2/32 -i lo -j ACCEPT
-A ts-input -s 100.115.92.0/23 ! -i tailscale0 -j RETURN
-A ts-input -s 100.64.0.0/10 ! -i tailscale0 -j DROP
-A ts-input -i tailscale0 -j ACCEPT
-A ts-input -p udp -m udp --dport 41641 -j ACCEPT
```