|
|
@@ -1,3 +1,126 @@
|
|
|
# headscale
|
|
|
|
|
|
-内网穿透
|
|
|
+内网穿透
|
|
|
+
|
|
|
+Tailscale 客户端开源，服务端社区有第三方开源版本Headscale
|
|
|
+
|
|
|
+* 服务端：
|
|
|
+```
|
|
|
+# 下载
|
|
|
+wget https://github.com/juanfont/headscale/releases/download/v0.16.4/headscale_0.16.4_linux_amd64 -O /usr/local/bin/headscale
|
|
|
+
|
|
|
+# 增加可执行权限
|
|
|
+chmod +x /usr/local/bin/headscale
|
|
|
+
|
|
|
+# 配置目录
|
|
|
+mkdir -p /etc/headscale
|
|
|
+
|
|
|
+# 创建用户
|
|
|
+useradd \
|
|
|
+ --create-home \
|
|
|
+ --home-dir /var/lib/headscale/ \
|
|
|
+ --system \
|
|
|
+ --user-group \
|
|
|
+ --shell /usr/sbin/nologin \
|
|
|
+ headscale
|
|
|
+
|
|
|
+```
|
|
|
+
|
|
|
+```
|
|
|
+ # 创建 SystemD 配置文件
|
|
|
+ # /lib/systemd/system/headscale.service
|
|
|
+[Unit]
|
|
|
+Description=headscale controller
|
|
|
+After=syslog.target
|
|
|
+After=network.target
|
|
|
+
|
|
|
+[Service]
|
|
|
+Type=simple
|
|
|
+User=headscale
|
|
|
+Group=headscale
|
|
|
+ExecStart=/usr/local/bin/headscale serve
|
|
|
+Restart=always
|
|
|
+RestartSec=5
|
|
|
+
|
|
|
+# Optional security enhancements
|
|
|
+NoNewPrivileges=yes
|
|
|
+PrivateTmp=yes
|
|
|
+ProtectSystem=strict
|
|
|
+ProtectHome=yes
|
|
|
+ReadWritePaths=/var/lib/headscale /var/run/headscale
|
|
|
+AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
+RuntimeDirectory=headscale
|
|
|
+
|
|
|
+[Install]
|
|
|
+WantedBy=multi-user.target
|
|
|
+```
|
|
|
+
|
|
|
+配置 /etc/headscale/config.yaml
|
|
|
+```
|
|
|
+---
|
|
|
+# Headscale 服务器的访问地址
|
|
|
+#
|
|
|
+# 这个地址是告诉客户端需要访问的地址, 即使你需要在跑在
|
|
|
+# 负载均衡器之后这个地址也必须写成负载均衡器的访问地址
|
|
|
+server_url: https://your.domain.com
|
|
|
+
|
|
|
+# Headscale 实际监听的地址
|
|
|
+listen_addr: 0.0.0.0:8080
|
|
|
+
|
|
|
+# 监控地址
|
|
|
+metrics_listen_addr: 127.0.0.1:9090
|
|
|
+
|
|
|
+# grpc 监听地址
|
|
|
+grpc_listen_addr: 0.0.0.0:50443
|
|
|
+
|
|
|
+# 是否允许不安全的 grpc 连接(非 TLS)
|
|
|
+grpc_allow_insecure: false
|
|
|
+
|
|
|
+# 客户端分配的内网网段
|
|
|
+ip_prefixes:
|
|
|
+ - fd7a:115c:a1e0::/48
|
|
|
+ - 100.64.0.0/10
|
|
|
+
|
|
|
+# 中继服务器相关配置
|
|
|
+derp:
|
|
|
+ server:
|
|
|
+ # 关闭内嵌的 derper 中继服务(可能不安全, 还没去看代码)
|
|
|
+ enabled: false
|
|
|
+
|
|
|
+ # 下发给客户端的中继服务器列表(默认走官方的中继节点)
|
|
|
+ urls:
|
|
|
+ - https://controlplane.tailscale.com/derpmap/default
|
|
|
+
|
|
|
+ # 可以在本地通过 yaml 配置定义自己的中继接待你
|
|
|
+ paths: []
|
|
|
+
|
|
|
+# SQLite config
|
|
|
+db_type: sqlite3
|
|
|
+db_path: /var/lib/headscale/db.sqlite
|
|
|
+
|
|
|
+# 使用自动签发证书是的域名
|
|
|
+tls_letsencrypt_hostname: ""
|
|
|
+
|
|
|
+# 使用自定义证书时的证书路径
|
|
|
+tls_cert_path: ""
|
|
|
+tls_key_path: ""
|
|
|
+
|
|
|
+# 是否让客户端使用随机端口, 默认使用 41641/UDP
|
|
|
+randomize_client_port: false
|
|
|
+```
|
|
|
+
|
|
|
+```
|
|
|
+# 开机自启动 并 立即启动
|
|
|
+systemctl enable headscale --now
|
|
|
+
|
|
|
+```
|
|
|
+
|
|
|
+* 客户端
|
|
|
+
|
|
|
+```
|
|
|
+curl -fsSL https://tailscale.com/install.sh | sh
|
|
|
+```
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
