archipelago
fc68c5b680
Demo images / Build & push demo images (push) Failing after 36s
Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home now carry full manifests: the app gate fronts their web ports (TLS on the same port, node login where appropriate), installs run through the orchestrator, and pins live in the signed catalog. Tailscale mirrors its legacy shape exactly (userspace networking, web console on 8240, plain HTTP for the gate to front). Ollama stays loopback-only — the assistant's local model backend, not a web app. Retires the four already-removed apps for good (FIPS, Nostr VPN, Routstr, Penpot pins dropped from image-versions.sh, the generator map, and image_versions.rs), fixes Cuprate's duplicated metadata block that strict YAML parsers reject, and updates the port-inventory review gates for the new open (3 own-login consoles) and exempt (2 DNS) ports.
79 lines
2.2 KiB
YAML
79 lines
2.2 KiB
YAML
app:
|
|
id: tailscale
|
|
name: Tailscale
|
|
version: 1.78.0
|
|
upstream:
|
|
kind: github
|
|
repo: tailscale/tailscale
|
|
description: Zero-config VPN with WireGuard mesh networking.
|
|
|
|
container:
|
|
image: source.archipelago-foundation.org/lfg2025/tailscale:stable
|
|
pull_policy: if-not-present
|
|
network: pasta
|
|
# Mirrors the legacy curated install exactly: tailscaled in userspace
|
|
# networking (no host TUN device needed — the rootless container cannot
|
|
# have one anyway), then `tailscale web` serving the console on :8240 as
|
|
# plain HTTP the app gate can front (TLS on the same port via the node
|
|
# certificate, framing-header fixes, retry page, Tor).
|
|
entrypoint: ["sh", "-c", "tailscaled --tun=userspace-networking & for i in $(seq 1 30); do [ -S /var/run/tailscale/tailscaled.sock ] && break; sleep 1; done; tailscale web --listen 0.0.0.0:8240 & wait"]
|
|
|
|
dependencies:
|
|
- storage: 1Gi
|
|
|
|
resources:
|
|
memory_limit: 512Mi
|
|
disk_limit: 1Gi
|
|
|
|
security:
|
|
capabilities: []
|
|
readonly_root: false
|
|
no_new_privileges: true
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
- host: 8240
|
|
container: 8240
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
# open, not gated: the web console requires the tailnet's own login for
|
|
# every administrative action — the gate fronts the port without adding
|
|
# a second login in front of it.
|
|
auth: open
|
|
auth_rationale: >-
|
|
Tailscale's web console authenticates against the tailnet account for
|
|
all administrative actions; the node's cookie challenge would be a
|
|
second, redundant login.
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/tailscale
|
|
target: /var/lib/tailscale
|
|
options: [rw]
|
|
|
|
environment:
|
|
- TS_STATE_DIR=/var/lib/tailscale
|
|
|
|
health_check:
|
|
type: tcp
|
|
endpoint: localhost:8240
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
interfaces:
|
|
main:
|
|
name: Web console
|
|
description: Tailscale web console
|
|
type: ui
|
|
port: 8240
|
|
protocol: http
|
|
path: /
|
|
|
|
metadata:
|
|
author: Tailscale
|
|
category: networking
|
|
icon: /assets/img/app-icons/tailscale.webp
|
|
repo: https://github.com/tailscale/tailscale
|
|
tier: recommended
|