Erich Blume
0c6223fcf1
Resolves multiple issues found during first deploy: - Drop --tun=userspace-networking: Fly.io Firecracker VMs support TUN natively; userspace mode broke MagicDNS and Tailscale IP routing - Add preauthorized=True to TailnetKey: required when tailnet has device approval enabled, otherwise containers hang on restart - Move /healthz to default_server: Fly health checks send no Host header, so healthz must be on the catch-all server block - Change region from sea (deprecated) to sjc - Add iptables/ip6tables for TUN device support - Add proxy_ssl_server_name for proper TLS SNI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
17 lines
512 B
Bash
17 lines
512 B
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Start tailscale daemon. Fly.io runs Firecracker microVMs which support
|
|
# TUN devices natively — no need for --tun=userspace-networking.
|
|
tailscaled --statedir=/var/lib/tailscale &
|
|
sleep 2
|
|
|
|
# Authenticate and join tailnet
|
|
tailscale up --authkey="${TS_AUTHKEY}" --hostname=flyio-proxy
|
|
|
|
# Wait for tailscale to be ready
|
|
until tailscale status > /dev/null 2>&1; do sleep 1; done
|
|
echo "Tailscale connected"
|
|
|
|
# Start nginx — MagicDNS resolves *.tail8d86e.ts.net hostnames
|
|
nginx -g "daemon off;"
|