GitHub - juanfont/headscale: An open source, self-hosted implementation of the Tailscale control server
An open source, self-hosted implementation of the Tailscale control server - juanfont/headscale
juanfontWhat is headscale?
- Tailscale 제어 서버의 오픈 소스 포크 버전으로, WireGuard 프로토콜을 사용하여 VPN(Virtual Private Network) 연결을 제공해주는 서비스
| Name | headscale (tailscale fork) |
|---|---|
| Star | 18.3k stars |
| Version | v0.22.3 (Latest, May 12, 2023) |
Features
- Tailscale’s 모든 기본기능 지원
- DNS 지원
- 노드 등록
- SSO (Via Open ID Connect) 등록 방식
- 인증키 등록 방식
- Taildrop (파일 공유)
- 액세스 제어 목록
- MagicDNS
- 여러 IP 범위 지원
- 듀얼 스택 지원(IPv4, IPv6) 등
Hands-on
Prerequire
- VM 1EA (headscale service)
- docker
- docker compose
Server configuration
| host_name | server_ip | cname | role |
|---|---|---|---|
| headscale-node | 222.99.150.1xx | vpn.taking.kr | - |
| oracle-kubernetes | 152.69.228.2xx | controller plane | |
| IDC-kubernetes | 101.79.1.1xx | worker | |
| gcp-kubernetes | 34.16.112.6x | worker |
Install & Setting
headscale 서버 설정
- node
- [NODE] headscale-node (non kubernetes)
# 폴더 생성 및 파일 초기 설정
mkdir -p $HOME/headscale/headscale_data/config
touch $HOME/headscale/headscale_data/config/db.sqlite
wget -O $HOME/headscale/headscale_data/config/config.yaml https://raw.githubusercontent.com/juanfont/headscale/main/config-example.yaml
# 도메인 및 production export 설정
sed -i 's/server_url: http:\/\/127.0.0.1:8080/server_url: https:\/\/vpn.taking.kr/g' $HOME/headscale/headscale_data/config/config.yaml
sed -i 's/listen_addr: 127.0.0.1:8080/listen_addr: 0.0.0.0:8080/g' $HOME/headscale/headscale_data/config/config.yaml
# docker-compose.yml 생성
cat <<EOF > $HOME/headscale/docker-compose.yml
version: '3'
services:
headscale:
image: 'headscale/headscale:0.23.0'
restart: unless-stopped
command: serve
ports:
- '8080:8080'
- '9090:9090'
volumes:
- ./headscale_data/config:/etc/headscale
- ./headscale_data/data/lib:/var/lib/headscale
- ./headscale_data/data/run:/var/run/headscale
EOF
# docker compose 서비스 업
docker compose up -d폴더 및 custom 도메인, docker-compose 설정
taking@headscale:~/headscale$ docker compose logs -f
headscale-1 | 2024-02-20T01:44:31Z INF Setting up a DERPMap update worker frequency=86400000
headscale-1 | 2024-02-20T01:44:31Z WRN Listening without TLS but ServerURL does not start with http://
headscale-1 | 2024-02-20T01:44:31Z INF listening and serving HTTP on: 0.0.0.0:8080
headscale-1 | 2024-02-20T01:44:31Z INF listening and serving metrics on: 127.0.0.1:9090headscale 정상 실행 로그
headscale 사용자 생성
docker compose exec headscale \
headscale users create kuberneteskubernetes 사용자 생성
taking@headscale:~/headscale$ docker compose exec headscale headscale users create kubernetes
User created실 서비스 용도라면 ZITADEL • Identity infrastructure, simplified for you 등을 통해 oidc로 구성가능하여 진행하는 것을 권장함
현재는 테스트 용도이므로 인증키를 발급받아 진행하기로 함
docker compose exec headscale \
headscale --user kubernetes preauthkeys create --reusable --expiration 24hkubernetes 사용자에 대한 인증키 발급 (24h)
headscale VPN 노드 구성
- node
- [NODE] oracle-kubernetes (152.69.228.2xx)
- [NODE] IDC-kubernetes (101.79.1.1xx)
- [NODE] oracle-kubernetes (34.16.112.6x)
curl -fsSL https://tailscale.com/install.sh | shtailscale 설치
sudo tailscale up --login-server https://vpn.taking.kr --authkey 08fd776270d5d9b62177aaa37879a14637e128595743dfa4
headscale-node에서 구축하여 생성된 kubernetes authkey로 노드 조인
