blob: c5aa3ac314478c7b7bc6eccc1cc8ba8e79b25aba (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
---
services:
headscale-client:
image: tailscale/tailscale:latest
environment:
- DEPLOYMENT_TIME={{ now() }}
- TS_AUTHKEY={{ headscale_user_auth_key }}
- TS_EXTRA_ARGS=--login-server=https://{{ headscale_host }} --accept-routes --accept-dns --stateful-filtering=false
- TS_STATE_DIR=/var/lib/tailscale
- TS_USERSPACE=false
- TZ={{ timezone }}
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "tailscale status"]
interval: 1s
timeout: 5s
retries: 10
hostname: headscale-outbound
cap_add:
- NET_ADMIN
- SYS_ADMIN
volumes:
- ./data:/var/lib/tailscale
- ./headscale/headscale-client.sh:/headscale-client.sh
- /dev/net/tun:/dev/net/tun
networks:
- internal_subnet_router # magic.
sysctls:
- net.ipv4.ip_forward=1
entrypoint: ["/bin/sh"]
command: /headscale-client.sh
{{ vpn_proxy_filter_container_name }}:
image: nginx:latest
entrypoint: ["/bin/sh"]
command: /wait-for-bridge.sh
pre_stop:
- command: /dont-die-until-conn-closed.sh
cap_add:
- NET_ADMIN # to modify the routing table
environment:
- DEPLOYMENT_TIME={{ now() }}
- VIRTUAL_HOST=*.{{ domain }},{{ domain }}
- VIRTUAL_PORT=80
- LETSENCRYPT_HOST=*.{{ domain }},{{ domain }}
healthcheck:
test: ["CMD", "curl", "http://localhost/health"]
interval: 10s
timeout: 5s
retries: 3
depends_on:
- headscale-client
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf
- ./nginx/conf.d:/etc/nginx/conf.d
- ./nginx/toplevel.conf.d:/etc/nginx/toplevel.conf.d
- ./nginx/wait-for-bridge.sh:/wait-for-bridge.sh
- ./nginx/dont-die-until-conn-closed.sh:/dont-die-until-conn-closed.sh
networks:
- proxy
- internal_subnet_router
networks:
internal_subnet_router:
driver: bridge
proxy:
external: true
|
