143 lines
9.4 KiB
Bash
143 lines
9.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Enroll using a locally prepared package and a short-lived root-only key file.
|
|
set -euo pipefail
|
|
export LC_ALL=C
|
|
fail() { printf 'ERROR: %s\n' "$*" >&2; return 1; }
|
|
validate_host() {
|
|
local host=$1 label octet
|
|
[[ -n "$host" && ${#host} -le 253 && "$host" != .* && "$host" != *. && "$host" != *..* ]] || { fail 'Invalid Headscale URL host'; return 1; }
|
|
if [[ "$host" =~ ^[0-9]+(\.[0-9]+){3}$ ]]; then
|
|
local octets=()
|
|
IFS=. read -r -a octets <<< "$host"
|
|
for octet in "${octets[@]}"; do
|
|
[[ "$octet" =~ ^(0|[1-9][0-9]{0,2})$ ]] && ((10#$octet <= 255)) || { fail 'Invalid Headscale IPv4 host'; return 1; }
|
|
done
|
|
return 0
|
|
fi
|
|
[[ "$host" =~ ^[A-Za-z0-9.-]+$ ]] || { fail 'Invalid Headscale URL host'; return 1; }
|
|
local labels=()
|
|
IFS=. read -r -a labels <<< "$host"
|
|
for label in "${labels[@]}"; do
|
|
[[ "$label" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$ ]] || { fail 'Invalid Headscale URL host label'; return 1; }
|
|
done
|
|
}
|
|
validate_tags() {
|
|
# Tailscale tags are not DNS labels: letters, digits and dashes are valid
|
|
# after the first letter, with no DNS length or final-character limit.
|
|
[[ -z "$1" || "$1" =~ ^tag:[A-Za-z][A-Za-z0-9-]*(,tag:[A-Za-z][A-Za-z0-9-]*)*$ ]] || { fail 'Invalid authorized tags'; return 1; }
|
|
}
|
|
validate_tailnet_status() {
|
|
jq -e '
|
|
def tailip:
|
|
split(".") | select(length == 4) | map(tonumber) |
|
|
.[0] == 100 and .[1] >= 64 and .[1] <= 127 and
|
|
all(.[]; . >= 0 and . <= 255);
|
|
.BackendState == "Running" and (.Self.ID | type == "string" and length > 0) and
|
|
(.Self.DNSName | type == "string" and length > 0) and
|
|
([.Self.TailscaleIPs[] | select(contains(":") | not)] | length == 1 and all(.[]; tailip))
|
|
' "$1" >/dev/null || { fail 'Running Tailscale identity with one 100.64.0.0/10 IPv4 and MagicDNS name required'; return 1; }
|
|
}
|
|
write_tailnet_receipt() {
|
|
local status=$1 url=$2 name=$3 destination=$4 pending
|
|
validate_tailnet_status "$status" || return 1
|
|
[[ ! -L "$destination" && ! -L "$(dirname -- "$destination")" ]] || { fail 'Symlink in tailnet receipt path'; return 1; }
|
|
pending=$(mktemp "${destination}.XXXXXXXX")
|
|
jq --arg url "$url" --arg name "$name" '{version: 1, control_url: $url, hostname: $name,
|
|
node_id: .Self.ID, node_public_key: .Self.PublicKey,
|
|
ipv4: (.Self.TailscaleIPs[] | select(contains(":") | not)),
|
|
dns_name: (.Self.DNSName | rtrimstr(".")), tags: ((.Self.Tags // []) | sort)}' "$status" > "$pending"
|
|
if [[ -e "$destination" ]] && ! jq -e --slurpfile candidate "$pending" '
|
|
.control_url == $candidate[0].control_url and .hostname == $candidate[0].hostname and
|
|
.node_id == $candidate[0].node_id and .ipv4 == $candidate[0].ipv4 and
|
|
.dns_name == $candidate[0].dns_name and .tags == $candidate[0].tags' "$destination" >/dev/null; then
|
|
rm -f -- "$pending"; fail 'Tailnet identity/address changed; reconcile the existing member, never silently rebind'; return 1
|
|
fi
|
|
chmod 0600 "$pending"
|
|
mv -fT -- "$pending" "$destination"
|
|
}
|
|
main() {
|
|
local version='' package='' sha='' login='' login_port='' name='' auth='' tags='' action=''
|
|
while (($#)); do
|
|
case "$1" in
|
|
--help|-h) echo 'Usage: bash tailscale.sh --check|--apply --version VERSION --package LOCAL_DEB --sha256 SHA --login-server HTTPS_URL --hostname NAME --tags tag:ENV-ROLE,... [--auth-key-file /run/platform-secrets/KEY]'; return 0;;
|
|
--check|--apply) [[ -z "$action" ]] || return 1; action=$1; shift;;
|
|
--version|--package|--sha256|--login-server|--hostname|--auth-key-file|--tags)
|
|
(($# >= 2)) || return 1
|
|
case "$1" in --version) version=$2;; --package) package=$2;; --sha256) sha=$2;; --login-server) login=$2;; --hostname) name=$2;; --auth-key-file) auth=$2;; --tags) tags=$2;; esac; shift 2;;
|
|
*) fail "Unknown argument: $1"; return 1;;
|
|
esac
|
|
done
|
|
local word='[a-z][a-z0-9]{0,15}'
|
|
[[ $EUID == 0 && ( "$action" == --check || "$action" == --apply ) && "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ && "$sha" =~ ^[a-f0-9]{64}$ && "$name" =~ ^(dev|test|stage|prod)-$word-$word(-$word)?-(0[1-9]|[1-9][0-9])$ ]] || { fail 'Explicit root/action/version/Headscale/hostname inputs required'; return 1; }
|
|
if [[ "$login" =~ ^https://([^/:?#]+)(:([0-9]{1,5}))?/?$ ]]; then
|
|
local login_host=${BASH_REMATCH[1]}
|
|
login_port=${BASH_REMATCH[3]}
|
|
validate_host "$login_host"
|
|
if [[ -n "$login_port" ]]; then
|
|
[[ "$login_port" =~ ^[0-9]{1,5}$ ]] && ((10#$login_port >= 1 && 10#$login_port <= 65535)) || { fail 'Invalid Headscale port'; return 1; }
|
|
fi
|
|
login=${login%/}
|
|
else
|
|
fail 'Explicit HTTPS Headscale URL required'; return 1
|
|
fi
|
|
validate_tags "$tags"
|
|
[[ -n "$tags" ]] || { fail 'Explicit expected Headscale authorization tags required'; return 1; }
|
|
[[ -f "$package" && ! -L "$package" ]] || { fail 'Prepared Tailscale DEB required'; return 1; }
|
|
printf '%s %s\n' "$sha" "$package" | sha256sum -c - >/dev/null
|
|
[[ $(dpkg-deb -f "$package" Package) == tailscale && $(dpkg-deb -f "$package" Version) == "$version" && $(dpkg-deb -f "$package" Architecture) == amd64 ]] || { fail 'Package identity or architecture differs'; return 1; }
|
|
if command -v tailscale >/dev/null; then [[ $(tailscale version | head -n 1) == "$version" ]] || { fail 'Existing version differs; use explicit maintenance'; return 1; }; fi
|
|
if [[ -n "$auth" ]]; then
|
|
[[ "$auth" == /run/platform-secrets/* && "$auth" != */../* && "$auth" != */./* && -f "$auth" && ! -L "$auth" && $(stat -c %u "$auth") == 0 && $(stat -c %a "$auth") == 600 && ! -L /run/platform-secrets ]] || { fail 'Use a root-owned 0600 temporary enrollment key file'; return 1; }
|
|
fi
|
|
[[ "$action" == --apply ]] || { echo 'Local inputs verified; network enrollment not checked.'; return 0; }
|
|
umask 077
|
|
exec 9>>/run/lock/platform-tailscale.lock; flock -n 9 || { fail 'Enrollment is already running'; return 1; }
|
|
local task cleanup status='' state
|
|
task=$(mktemp -d)
|
|
printf -v cleanup 'rm -rf -- %q' "$task"
|
|
if [[ -n "$auth" ]]; then printf -v cleanup '%s; rm -f -- %q' "$cleanup" "$auth"; fi
|
|
trap "$cleanup" EXIT
|
|
if ! command -v tailscale >/dev/null; then apt-get -o DPkg::Lock::Timeout=60 install -y "$package"; fi
|
|
systemctl enable --now tailscaled
|
|
if ! tailscale status --json > "$task/status.json" 2> "$task/error"; then
|
|
fail 'Cannot inspect the existing Tailscale identity; do not reset it'; return 1
|
|
fi
|
|
state=$(jq -er .BackendState "$task/status.json") || { fail 'Tailscale returned an invalid status document'; return 1; }
|
|
if [[ "$state" == Running ]]; then
|
|
tailscale debug prefs > "$task/prefs.json"
|
|
jq -e --arg url "$login" --arg name "$name" '(.ControlURL | if type == "string" then rtrimstr("/") else "" end) == $url and .Hostname == $name' "$task/prefs.json" >/dev/null || { fail 'Existing node belongs to another controller or name'; return 1; }
|
|
echo 'Existing connected identity reused; enrollment key not consumed.'
|
|
elif [[ "$state" == NeedsLogin ]]; then
|
|
[[ -n "$auth" ]] || { fail 'Provide a short-lived single-use Headscale enrollment key'; return 1; }
|
|
local up_args=(up --login-server="$login" --hostname="$name" --accept-routes=false --ssh=false --auth-key="file:$auth")
|
|
# Headscale 0.29.6 takes pre-authenticated node tags from the key.
|
|
# It rejects client RequestTags for every pre-auth-key registration.
|
|
if ! tailscale "${up_args[@]}" > "$task/enroll-output" 2>&1; then
|
|
fail 'Enrollment failed; inspect Headscale and the original node identity before retrying'; return 1
|
|
fi
|
|
else fail 'Existing backend is not ready for first enrollment; inspect it without resetting identity'; return 1; fi
|
|
tailscale status --json > "$task/status.json" || { fail 'Tailscale enrollment status is unavailable'; return 1; }
|
|
validate_tailnet_status "$task/status.json"
|
|
if [[ -n "$tags" ]]; then
|
|
jq -e --arg expected "$tags" '($expected | split(",") | sort) == ((.Self.Tags // []) | sort)' "$task/status.json" >/dev/null || { fail 'Headscale authorization tags differ; inspect the pre-auth key and node without resetting identity'; return 1; }
|
|
fi
|
|
tailscale debug prefs > "$task/prefs.json" || { fail 'Tailscale preferences are unavailable'; return 1; }
|
|
jq -e --arg url "$login" --arg name "$name" '(.ControlURL | if type == "string" then rtrimstr("/") else "" end) == $url and .Hostname == $name' "$task/prefs.json" >/dev/null || { fail 'Enrolled node belongs to another controller or name'; return 1; }
|
|
jq -e '((.AdvertiseRoutes // []) | length == 0) and ((.ExitNodeID // "") == "") and
|
|
((.ExitNodeIP // "") == "")' "$task/prefs.json" >/dev/null || {
|
|
fail 'Existing advertised routes or exit node need explicit network migration; identity preserved'; return 1;
|
|
}
|
|
tailscale set --accept-routes=false --ssh=false
|
|
tailscale debug prefs > "$task/prefs.json"
|
|
jq -e '.RouteAll == false and .RunSSH == false' "$task/prefs.json" >/dev/null || { fail 'Tailnet-only preferences were not applied'; return 1; }
|
|
[[ ! -L /var/lib/platform-bootstrap ]] || { fail 'Symlink in receipt directory'; return 1; }
|
|
install -d -m 0700 /var/lib/platform-bootstrap
|
|
write_tailnet_receipt "$task/status.json" "$login" "$name" /var/lib/platform-bootstrap/tailnet.json
|
|
cat /var/lib/platform-bootstrap/tailnet.json
|
|
echo 'Tailnet identity recorded. Confirm this address with Headscale before generating cluster endpoints and TLS certificates; test firewall access separately.'
|
|
rm -rf -- "$task"
|
|
[[ -z "$auth" ]] || rm -f -- "$auth"
|
|
trap - EXIT
|
|
}
|
|
if [[ ${BASH_SOURCE[0]:-} == "$0" || -z ${BASH_SOURCE[0]:-} ]]; then main "$@"; fi
|