如何使用 Headscale ( Tailscale 开源版 ) 快速搭建一个私有专属的 P2P 内网穿透网络

# 下载
wget https://github.com/juanfont/headscale/releases/download/v0.16.4/headscale_0.16.4_linux_amd64 -O /usr/local/bin/headscale

# 增加可执行权限
chmod +x /usr/local/bin/headscale

# 配置目录
mkdir -p /etc/headscale

# 创建用户
useradd \
	--create-home \
	--home-dir /var/lib/headscale/ \
	--system \
	--user-group \
	--shell /usr/sbin/nologin \
	headscale

# /lib/systemd/system/headscale.service
[Unit]
Description=headscale controller
After=syslog.target
After=network.target

[Service]
Type=simple
User=headscale
Group=headscale
ExecStart=/usr/local/bin/headscale serve
Restart=always
RestartSec=5

# Optional security enhancements
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/headscale /var/run/headscale
AmbientCapabilities=CAP_NET_BIND_SERVICE
RuntimeDirectory=headscale

[Install]
WantedBy=multi-user.target

---
# Headscale 服务器的访问地址
# 
# 这个地址是告诉客户端需要访问的地址, 即使你需要在跑在
# 负载均衡器之后这个地址也必须写成负载均衡器的访问地址
server_url: https://your.domain.com

# Headscale 实际监听的地址
listen_addr: 0.0.0.0:8080

# 监控地址
metrics_listen_addr: 127.0.0.1:9090

# grpc 监听地址
grpc_listen_addr: 0.0.0.0:50443

# 是否允许不安全的 grpc 连接(非 TLS)
grpc_allow_insecure: false

# 客户端分配的内网网段
ip_prefixes:
  - fd7a:115c:a1e0::/48
  - 100.64.0.0/10

# 中继服务器相关配置
derp:
  server:
    # 关闭内嵌的 derper 中继服务(可能不安全, 还没去看代码)
    enabled: false

  # 下发给客户端的中继服务器列表(默认走官方的中继节点)
  urls:
    - https://controlplane.tailscale.com/derpmap/default

  # 可以在本地通过 yaml 配置定义自己的中继接待你
  paths: []

# SQLite config
db_type: sqlite3
db_path: /var/lib/headscale/db.sqlite

# 使用自动签发证书是的域名
tls_letsencrypt_hostname: ""

# 使用自定义证书时的证书路径
tls_cert_path: ""
tls_key_path: ""

# 是否让客户端使用随机端口, 默认使用 41641/UDP
randomize_client_port: false

# 开机自启动 并 立即启动
systemctl enable headscale --now

server_url: https://your.domain.com
listen_addr: 0.0.0.0:443
tls_letsencrypt_hostname: "your.domain.com"
tls_cert_path: ""
tls_key_path: ""

server_url: https://your.domain.com
listen_addr: 0.0.0.0:443
tls_letsencrypt_hostname: ""
tls_cert_path: "/path/to/cert"
tls_key_path: "/path/to/key"

server_url: https://your.domain.com
listen_addr: 0.0.0.0:8080
tls_letsencrypt_hostname: ""
tls_cert_path: ""
tls_key_path: ""

2022-09-18T07:57:36Z WRN Listening without TLS but ServerURL does not start with http://

# docker-compose.yaml
version: "3.9"

services:
  headscale:
    container_name: headscale
    image: headscale/headscale:0.16.4
    ports:
      - "8080:8080"
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
    restart: always
    volumes:
      - ./conf:/etc/headscale
      - data:/var/lib/headscale
    command: ["headscale", "serve"]
volumes:
  config:
  data:

curl -fsSL https://tailscale.com/install.sh | sh

tailscale up --login-server https://your.domain.com --advertise-routes=192.168.11.0/24 --accept-routes=true --accept-dns=false

# 安装 go
brew install go

# 编译命令行客户端
go install tailscale.com/cmd/tailscale{,d}@main

# 安装为系统服务
sudo tailscaled install-system-daemon

# 编译 DERP Server
go install tailscale.com/cmd/derper@main

# 复制到系统可执行目录
mv ${GOPATH}/bin/derper /usr/local/bin

# 创建用户和运行目录
useradd \
        --create-home \
        --home-dir /var/lib/derper/ \
        --system \
        --user-group \
        --shell /usr/sbin/nologin \
        derper

# /lib/systemd/system/derper.service
[Unit]
Description=tailscale derper server
After=syslog.target
After=network.target

[Service]
Type=simple
User=derper
Group=derper
ExecStart=/usr/local/bin/derper -c=/var/lib/derper/private.key -a=:8989 -stun-port=3456 -verify-clients
Restart=always
RestartSec=5

# Optional security enhancements
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/derper /var/run/derper
AmbientCapabilities=CAP_NET_BIND_SERVICE
RuntimeDirectory=derper

[Install]
WantedBy=multi-user.target

systemctl enable derper --now

# /etc/headscale/derper.yaml

regions:
  901:
    regionid: 901
    regioncode: private-derper
    regionname: "My Private Derper Server"
    nodes:
      - name: private-derper
        regionid: 901
        # 自行更改为自己的域名
        hostname: derper.xxxxx.com
        # Derper 节点的 IP
        ipv4: 123.123.123.123
        # Derper 设置的 STUN 端口
        stunport: 3456

derp:
  server:
    # 这里关闭 Headscale 默认的 Derper Server
    enabled: false
  # urls 留空, 保证不加载官方的默认 Derper
  urls: []
  # 这里填写 Derper 节点信息配置的绝对路径
  paths:
  - /etc/headscale/derper.yaml

  # If enabled, a worker will be set up to periodically
  # refresh the given sources and update the derpmap
  # will be set up.
  auto_update_enabled: true

  # How often should we check for DERP updates?
  update_frequency: 24h

~ ❯❯❯ tailscale netcheck

Report:
        * UDP: true
        * IPv4: yes, 124.111.111.111:58630
        * IPv6: no, but OS has support
        * MappingVariesByDestIP: false
        * HairPinning: false
        * PortMapping: UPnP, NAT-PMP, PCP
        * CaptivePortal: true
        * Nearest DERP: XXXX Derper Server
        * DERP latency:
                - XXXX: 10.1ms  (XXXX Derper Server)

version: '3.9'
services:
  derper:
    image: mritd/derper
    container_name: derper
    restart: always
    ports:
      - "8080:8080/tcp"
      - "3456:3456/udp"
    environment:
      TZ: Asia/Shanghai
    volumes:
      - /etc/timezone:/etc/timezone
      - /var/run/tailscale:/var/run/tailscale
      - data:/var/lib/derper
volumes:
  data:

~ ❯❯❯ tailscale ping 10.24.0.5
pong from k8s13 (10.24.0.5) via DERP(XXXXX) in 14ms
pong from k8s13 (10.24.0.5) via DERP(XXXXX) in 13ms
pong from k8s13 (10.24.0.5) via DERP(XXXXX) in 14ms
pong from k8s13 (10.24.0.5) via DERP(XXXXX) in 12ms
pong from k8s13 (10.24.0.5) via DERP(XXXXX) in 12ms
pong from k8s13 (10.24.0.5) via 3.4.170.23:2495 in 9ms

~ ❯❯❯ tailscale status
10.24.0.8       xmac                 kovacs       macOS   -
                alivpn               kovacs       linux   active; direct 4.3.4.5:41644, tx 1264 rx 944
                aliyun               kovacs       linux   -
                bob                  kovacs       macOS   offline
                bob-imac             kovacs       macOS   offline
                company              kovacs       linux   active; direct 114.114.114.114:41642, tx 1296 rx 880

~ ❯❯❯ tailscale netcheck
2022/10/19 21:15:27 portmap: [v1] Got PMP response; IP: 123.123.123.123, epoch: 297671
2022/10/19 21:15:27 portmap: [v1] Got PCP response: epoch: 297671
2022/10/19 21:15:27 portmap: [v1] UPnP reply {Location:http://192.168.11.1:39735/rootDesc.xml Server:AsusWRT/386 UPnP/1.1 MiniUPnPd/2.2.0 USN:uuid:23345-2380-45f5-34534-04421abwb7cf0::urn:schemas-upnp-org:device:InternetGatewayDevice:1}, "HTTP/1.1 200 OK\r\nCACHE-CONTROL: max-age=120\r\nST: urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\nUSN: uuid:34564645-2380-45f5-b069-sdfdght3245....."
2022/10/19 21:15:27 portmap: UPnP meta changed: {Location:http://192.168.11.1:39735/rootDesc.xml Server:AsusWRT/386 UPnP/1.1 MiniUPnPd/2.2.0 USN:uuid:23345-2380-45f5-b069-04421abwb7cf0::urn:schemas-upnp-org:device:InternetGatewayDevice:1}

Report:
        * UDP: true
        * IPv4: yes, 123.123.123.123:5935
        * IPv6: no, but OS has support
        * MappingVariesByDestIP: false
        * HairPinning: true
        * PortMapping: UPnP, NAT-PMP, PCP
        * CaptivePortal: true
        * Nearest DERP: XXXXX Aliyun
        * DERP latency:
                - XXXXX: 9.5ms   (XXXXX Aliyun)
                - XXXXX: 53.1ms  (XXXXX BandwagonHost)