port Tailscale as its own section, early, and stop it hanging

Moved to position 7 — after core utils, which give it curl, and well before SSH hardening, which is the step that can lock you out. The argument is that Tailscale is a second way into the machine, so it wants to exist before anything that can go wrong does. ── Why the original hung, and what stops it now ── Its prompt accepted an empty auth key and passed it anyway. `tailscale up --authkey ""` falls back to the interactive flow: it prints a URL and blocks, with no timeout, forever. From the outside that is a script that has frozen. Nothing here passes an empty key — the flag is omitted entirely, and the run says in advance that a URL is coming and that it will wait. Every call carries --timeout=60s, and a timeout is reported with the command to run by hand rather than left as silence. State is read with `tailscale status --json` before anything is run, so a node that is already up is offered a reconfigure instead of having `up` fired at it blindly. Diagnosed on this host rather than guessed at, and honestly the diagnosis is partial: the exit-node branch left no trace at all — no /etc/sysctl.d file, networkd-dispatcher present but with zero mentions in apt history, so it came with the image. ip_forward=1 came from the unconditional part of the section, not the branch. That points at `tailscale up` as where it stopped, and the empty-key path is the candidate that fits, but I could not reproduce it to be certain. ── What the section now covers ── control plane Tailscale's own service by default; a self-hosted headscale as an explicit choice with NO suggested URL. The original defaulted to headscale.pastilhas.eu, so a stranger running it pointed their machine at somebody else's control plane. auth key, or the browser flow, stated as an equal option Tailscale SSH ssh over the tailnet with no keys, governed by tailnet ACLs — and pointed out as a way back in if the sshd hardening later in the run goes wrong subnet router homelab only, defaulting to this machine's actual LAN CIDR exit node with what it means for whose traffic goes where forwarding sysctls and Tailscale's recommended NIC offload settings, and only when an exit node or a route actually needs them Approval is mentioned: an advertised route or exit node does nothing until it is approved in the admin console, which is otherwise a silent non-event. Also added --only <step> and --list, because this section in particular needs to be run on its own while it is being worked on. A step run that way ignores the progress file and does not record itself — asking for one step is not progress through the script. One bash quirk fixed on the way: "${VAR:-Tailscale's own service}" does not parse. An apostrophe inside a ${:-} default opens a quoted section that swallows the closing brace, and the error surfaces as "unexpected EOF" 400 lines away. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-12 19:25:12 +00:00
parent 9d53ff506e
commit 09303299cc
3 changed files with 336 additions and 17 deletions
@@ -85,8 +85,25 @@ fail() {
 #     step_ok
 #   fi

+# Set by --only. When it is set, every step whose name does not match is passed
+# over in silence, and the one that does matches runs regardless of the progress
+# file — the point of asking for a single step is to run that step.
+ONLY_STEP="${ONLY_STEP:-}"
+
 step() {
  CURRENT_STEP="$1"
+
+  if [[ -n "$ONLY_STEP" ]]; then
+    if [[ "${1,,}" == "${ONLY_STEP,,}" ]]; then
+      SKIP_STEP=false
+      echo ""
+      echo -e "${BOLD}── $1 ──${NC}"
+    else
+      SKIP_STEP=true
+    fi
+    return
+  fi
+
  if grep -qxF "$1" "$PROGRESS_FILE" 2>/dev/null; then
    echo -e "   ${GREEN}SKIP${NC}: $1 (already done)"
    SKIP_STEP=true
@@ -100,6 +117,9 @@ step() {
 skip() { [[ "$SKIP_STEP" == true ]]; }

 step_ok() {
+  # A single step run on its own is not progress through the script, and
+  # recording it would make the next full run skip it.
+  [[ -n "$ONLY_STEP" ]] && return 0
  echo "$CURRENT_STEP" >>"$PROGRESS_FILE"
 }

@@ -0,0 +1,108 @@
+#!/bin/bash
+# =============================================================================
+# machine-setup — Tailscale
+# =============================================================================
+#
+# Definitions only, like the other lib/ files.
+#
+# ── Why this runs early ──
+#
+# It is a second way into the machine. The section that can lock you out is SSH
+# hardening, and everything after this one can break networking in some smaller
+# way; having the tailnet up first means a mistake is recoverable rather than a
+# trip to a rescue console.
+#
+# ── Why it matters to Officer specifically ──
+#
+# The platform's CLAUDE.md is explicit: the perimeter IS the tailnet.
+# ALLOW_ANY_ORIGIN defaults ON, and that is only defensible because the machine is
+# not reachable from the open internet in the first place — a valid token plus the
+# tailnet is the lock. An Officer install with no tailnet is an Officer install
+# with one fewer layer than it was designed around.
+#
+# ── Why the original hung ──
+#
+# It passed --authkey unconditionally, and its prompt accepted an empty answer.
+# `tailscale up --authkey ""` falls back to interactive login: it prints a URL and
+# blocks, with no timeout, forever. Nothing here passes an empty key, every call
+# has a timeout, and the state is read before anything is run.
+
+[[ -n "${MACHINE_SETUP_TAILSCALE_LOADED:-}" ]] && return 0
+MACHINE_SETUP_TAILSCALE_LOADED=1
+
+TS_EXIT_SYSCTL=/etc/sysctl.d/99-tailscale-exit.conf
+TS_DISPATCHER=/etc/networkd-dispatcher/routable.d/50-tailscale-exit
+
+tailscale_is_installed() { command -v tailscale &>/dev/null; }
+
+# NeedsLogin, Running, Stopped, NoState… Read before acting, because the original's
+# failure was running `up` blindly against a node that was already up.
+tailscale_state() {
+  tailscale status --json 2>/dev/null | awk -F'"' '/"BackendState"/ { print $4; exit }'
+}
+
+tailscale_ip() { tailscale ip -4 2>/dev/null | head -1; }
+
+# Which control plane this node is talking to. Empty means Tailscale's own.
+tailscale_control_url() {
+  tailscale debug prefs 2>/dev/null | awk -F'"' '/"ControlURL"/ { print $4; exit }'
+}
+
+tailscale_install() { curl -fsSL https://tailscale.com/install.sh | sh; }
+
+# Routing has to be on before this machine can forward anyone else's packets,
+# whether as an exit node or as a subnet router. Written as a drop-in so it is
+# visible as this script's doing.
+enable_ip_forwarding() {
+  cat >"$TS_EXIT_SYSCTL" <<'EOF'
+# Written by machine-setup: required to forward traffic for other tailnet nodes,
+# as an exit node or as a subnet router.
+net.ipv4.ip_forward = 1
+net.ipv6.conf.all.forwarding = 1
+EOF
+  sysctl --system >/dev/null 2>&1
+}
+
+# UDP GRO forwarding, which Tailscale documents as roughly doubling throughput on
+# a node that forwards for others. Applied on every routable event rather than
+# once, because the settings are per-interface and do not survive the link going
+# down and back up.
+install_exit_node_tuning() {
+  pkg_is_installed networkd-dispatcher || pkg_install_now networkd-dispatcher
+
+  mkdir -p "$(dirname "$TS_DISPATCHER")"
+  cat >"$TS_DISPATCHER" <<'EOF'
+#!/usr/bin/env bash
+# Written by machine-setup. NIC offload settings for a Tailscale exit node or
+# subnet router — Tailscale's own recommendation for forwarding throughput.
+set -Eeuo pipefail
+
+IF="${IFACE:-}"
+if [[ -z "${IF}" ]]; then
+  IF="$(ip -o route get 8.8.8.8 2>/dev/null | awk '{for (i = 1; i <= NF; i++) if ($i == "dev") {print $(i + 1); exit}}')"
+fi
+
+[[ -n "${IF}" ]] || exit 0
+command -v ethtool >/dev/null 2>&1 || exit 0
+
+ethtool -k "${IF}" 2>/dev/null | grep -q "^generic-receive-offload: " && ethtool -K "${IF}" gro on || true
+ethtool -k "${IF}" 2>/dev/null | grep -q "^rx-udp-gro-forwarding: " && ethtool -K "${IF}" rx-udp-gro-forwarding on || true
+ethtool -k "${IF}" 2>/dev/null | grep -q "^large-receive-offload: " && ethtool -K "${IF}" lro off || true
+
+exit 0
+EOF
+  chmod 755 "$TS_DISPATCHER"
+  systemctl enable --now networkd-dispatcher >/dev/null 2>&1 || true
+
+  # And once now, for the interface that is already up.
+  IFACE="$(default_iface)" bash "$TS_DISPATCHER" >/dev/null 2>&1 || true
+}
+
+# The LAN this machine sits on, as a CIDR — the useful default for a subnet
+# router, and the number nobody remembers offhand.
+lan_cidr() {
+  local iface
+  iface="$(default_iface)"
+  ip -4 route show dev "$iface" 2>/dev/null |
+    awk '$1 ~ /\// && $1 !~ /^default/ { print $1; exit }'
+}