ginnoir
2aa8122cd3
Adds stacks/share/ — a dedicated stack of userspace Tailscale 'serve' nodes that expose individual internal services to external tailnet users (a friend on his own tailnet) over each node's 100.x identity. No public exposure, no LAN access, immune to the friend's home-subnet addressing. First node ts-roms serves RomM at roms-share.<tailnet>.ts.net -> romm:8080. One reusable tag:share auth key + one ACL rule cover every node; adding a service is a serve-<svc>.json + a copied service block. roms stack reverted to a pointer comment.
14 lines
831 B
Bash
14 lines
831 B
Bash
# share stack secrets — Tailscale `serve` nodes.
|
|
# Read via env_file (no ${VAR} interpolation), so this git stack needs no
|
|
# Portainer UI env vars. See memory portainer-env-interpolation.
|
|
TZ=America/Chicago
|
|
|
|
# ── Tailscale auth (shared by EVERY ts-* node in this stack) ──────────────────
|
|
# ONE reusable, NON-ephemeral, TAGGED auth key from:
|
|
# https://login.tailscale.com/admin/settings/keys ("Generate auth key")
|
|
# - Reusable: ON - Ephemeral: OFF - Tags: tag:share
|
|
# Prereq: add "tagOwners": { "tag:share": ["autogroup:admin"] } to your ACLs
|
|
# first, or key generation rejects the tag. Tagged nodes never expire, so once
|
|
# the nodes have joined this key is no longer needed (state lives in the volumes).
|
|
TS_AUTHKEY=tskey-auth-kGQ7kgFizL11CNTRL-HWpbE5TudYTaV2ss4LDmYT7sZ8EddXVH
|