🌴 Sync 2026-03-05 23:51:42

luci-app-tailscale-community/root/etc/init.d/tailscale-settings

@@ -0,0 +1,158 @@
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+START=99
+STOP=10
+
+NAME=tailscale-settings
+
+# Compare version strings: return 0 (true) if $1 >= $2
+version_gte() {
+	awk -v a="${1%%-*}" -v b="${2%%-*}" 'BEGIN {
+		split(a, av, ".")
+		split(b, bv, ".")
+		for (i=1; i<=3; i++) {
+			ai = int(av[i]+0); bi = int(bv[i]+0)
+			if (ai > bi) { exit 0 }
+			if (ai < bi) { exit 1 }
+		}
+		exit 0
+	}'
+	return $?
+}
+
+apply_settings() {
+	local ts_bin
+	if [ -x /usr/sbin/tailscale ]; then
+		ts_bin=/usr/sbin/tailscale
+	elif [ -x /usr/bin/tailscale ]; then
+		ts_bin=/usr/bin/tailscale
+	else
+		logger -t "$NAME" "tailscale binary not found, skipping settings apply"
+		return 0
+	fi
+
+	config_load tailscale
+
+	local accept_routes advertise_exit_node exit_node exit_node_allow_lan_access
+	local ssh disable_magic_dns shields_up runwebclient nosnat hostname
+	local enable_relay relay_server_port
+
+	config_get accept_routes              settings accept_routes              '0'
+	config_get advertise_exit_node        settings advertise_exit_node        '0'
+	config_get exit_node                  settings exit_node                  ''
+	config_get exit_node_allow_lan_access settings exit_node_allow_lan_access '0'
+	config_get ssh                        settings ssh                        '0'
+	config_get disable_magic_dns          settings disable_magic_dns          '0'
+	config_get shields_up                 settings shields_up                 '0'
+	config_get runwebclient               settings runwebclient               '0'
+	config_get nosnat                     settings nosnat                     '0'
+	config_get hostname                   settings hostname                   ''
+	config_get enable_relay               settings enable_relay               '0'
+	config_get relay_server_port          settings relay_server_port          '40000'
+
+	# Collect advertise_routes UCI list into comma-separated string
+	local routes=""
+	append_route() {
+		if [ -z "$routes" ]; then
+			routes="$1"
+		else
+			routes="$routes,$1"
+		fi
+	}
+	config_list_foreach settings advertise_routes append_route
+
+	# Build argument list for 'tailscale set'
+	set -- set
+
+	# --accept-routes
+	[ "$accept_routes" = "1" ] \
+		&& set -- "$@" --accept-routes=true \
+		|| set -- "$@" --accept-routes=false
+
+	# --advertise-exit-node (only when no exit node is selected)
+	if [ "$advertise_exit_node" = "1" ] && [ -z "$exit_node" ]; then
+		set -- "$@" --advertise-exit-node=true
+	else
+		set -- "$@" --advertise-exit-node=false
+	fi
+
+	# --exit-node-allow-lan-access (only when no exit node is selected)
+	if [ -z "$exit_node" ]; then
+		[ "$exit_node_allow_lan_access" = "1" ] \
+			&& set -- "$@" --exit-node-allow-lan-access=true \
+			|| set -- "$@" --exit-node-allow-lan-access=false
+	fi
+
+	# --ssh
+	[ "$ssh" = "1" ] \
+		&& set -- "$@" --ssh=true \
+		|| set -- "$@" --ssh=false
+
+	# --accept-dns (inverse of disable_magic_dns)
+	[ "$disable_magic_dns" = "1" ] \
+		&& set -- "$@" --accept-dns=false \
+		|| set -- "$@" --accept-dns=true
+
+	# --shields-up
+	[ "$shields_up" = "1" ] \
+		&& set -- "$@" --shields-up=true \
+		|| set -- "$@" --shields-up=false
+
+	# --webclient
+	[ "$runwebclient" = "1" ] \
+		&& set -- "$@" --webclient=true \
+		|| set -- "$@" --webclient=false
+
+	# --snat-subnet-routes (inverse of nosnat)
+	[ "$nosnat" = "1" ] \
+		&& set -- "$@" --snat-subnet-routes=false \
+		|| set -- "$@" --snat-subnet-routes=true
+
+	# --advertise-routes (comma-separated, empty clears routes)
+	set -- "$@" "--advertise-routes=$routes"
+
+	# --exit-node (empty clears the exit node)
+	set -- "$@" "--exit-node=$exit_node"
+
+	# when an exit node is configured, always allow LAN access
+	[ -n "$exit_node" ] && set -- "$@" --exit-node-allow-lan-access=true
+
+	# --hostname (only set if non-empty)
+	[ -n "$hostname" ] && set -- "$@" "--hostname=$hostname"
+
+	# --relay-server-port (requires tailscale >= 1.90.5)
+	local ts_ver
+	ts_ver=$("$ts_bin" version 2>/dev/null | head -n1)
+	if version_gte "$ts_ver" "1.90.5"; then
+		if [ "$enable_relay" = "1" ]; then
+			set -- "$@" "--relay-server-port=${relay_server_port:-40000}"
+		else
+			set -- "$@" "--relay-server-port="
+		fi
+	fi
+
+	logger -t "$NAME" "Applying settings"
+	"$ts_bin" "$@"
+	local ret=$?
+	[ $ret -eq 0 ] \
+		&& logger -t "$NAME" "Settings applied successfully" \
+		|| logger -t "$NAME" "Failed to apply settings (exit code: $ret)"
+	return $ret
+}
+
+start_service() {
+	apply_settings
+    procd_open_instance
+    procd_set_param command /bin/true
+    procd_set_param respawn 3600 1 3
+    procd_close_instance
+}
+
+service_triggers() {
+	procd_add_reload_trigger "tailscale"
+}
+
+reload_service() {
+	apply_settings
+}

luci-app-tailscale-community/root/usr/share/luci/menu.d/luci-app-tailscale-community.json

@@ -0,0 +1,10 @@
+{
+	"admin/services/tailscale": {
+		"title": "Tailscale",
+		"order": 90,
+		"action": {
+			"type": "view",
+			"path": "tailscale"
+		}
+	}
+}

luci-app-tailscale-community/root/usr/share/rpcd/acl.d/luci-app-tailscale-community.json

@@ -0,0 +1,25 @@
+{
+	"luci-app-tailscale-community": {
+		"description": "Allow user access to tailscale",
+		"read": {
+			"ubus": {
+				"tailscale": [
+					"get_status",
+					"get_settings",
+					"get_subroutes"
+				]
+			},
+			"uci": [ "tailscale" ]
+		},
+		"write": {
+			"ubus": {
+				"tailscale": [
+					"do_login",
+					"do_logout",
+					"setup_firewall"
+				]
+			},
+			"uci": [ "tailscale" ]
+		}
+	}
+}

luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc

@@ -0,0 +1,350 @@
+#!/usr/bin/env ucode
+
+'use strict';
+
+import { access, popen, readfile, writefile, unlink } from 'fs';
+import { cursor } from 'uci';
+
+const uci = cursor();
+
+function exec(command) {
+	let stdout_content = '';
+	let p = popen(command, 'r');
+	sleep(100);
+	if (p == null) {
+		return { code: -1, stdout: '', stderr: `Failed to execute: ${command}` };
+	}
+	for (let line = p.read('line'); length(line); line = p.read('line')) {
+		stdout_content = stdout_content+line;
+	}
+	stdout_content = rtrim(stdout_content);
+	stdout_content = split(stdout_content, '\n');
+
+	let exit_code = p.close();
+	let stderr_content = '';
+	if (exit_code != 0) {
+		stderr_content = stdout_content;
+	}
+	return { code: exit_code, stdout: stdout_content, stderr: stderr_content };
+}
+
+function shell_quote(s) {
+	if (s == null || s == '') return "''";
+	return "'" + replace(s, "'", "'\\''") + "'";
+}
+
+const methods = {};
+
+methods.get_status = {
+	call: function() {
+		let data = {
+			status: '',
+			version: '',
+			TUNMode: '',
+			health: '',
+			ipv4: "Not running",
+			ipv6: null,
+			domain_name: '',
+			peers: []
+		};
+		if (access('/usr/sbin/tailscale')==true || access('/usr/bin/tailscale')==true){ }else{
+			data.status = 'not_installed';
+			return data;
+		}
+
+		let status_json_output = exec('tailscale status --json');
+		let peer_map = {};
+		if (status_json_output.code == 0 && length(status_json_output.stdout) > 0) {
+			try {
+				let status_data = json(join('',status_json_output.stdout));
+				data.version = status_data?.Version || 'Unknown';
+				data.health = status_data?.Health || '';
+				data.TUNMode = status_data?.TUN || 'true';
+				if (status_data?.BackendState == 'Running') { data.status =  'running'; }
+				if (status_data?.BackendState == 'NeedsLogin') { data.status =  'logout'; }
+
+				data.ipv4 = status_data?.Self?.TailscaleIPs?.[0] || 'No IP assigned';
+				data.ipv6 = status_data?.Self?.TailscaleIPs?.[1] || null;
+				data.domain_name = status_data?.CurrentTailnet?.Name || '';
+
+				// peers list
+				for (let p in status_data?.Peer) {
+					p = status_data.Peer[p];
+					peer_map[p.ID] = {
+						ip: join('<br>', p?.TailscaleIPs) || '',
+						hostname: split(p?.DNSName || '','.')[0] || '',
+						ostype: p?.OS,
+						online: p?.Online,
+						linkadress: (!p?.CurAddr) ? p?.Relay : p?.CurAddr,
+						lastseen: p?.LastSeen,
+						exit_node: !!p?.ExitNode,
+						exit_node_option: !!p?.ExitNodeOption,
+						tx: p?.TxBytes || '',
+						rx: p?.RxBytes || ''
+					};
+				}
+			} catch (e) { /* ignore */ }
+		}
+
+		data.peers = peer_map;
+		return data;
+	}
+};
+
+methods.get_settings = {
+	call: function() {
+		let settings = {};
+		uci.load('tailscale');
+		let state_file_path = uci.get('tailscale', 'settings', 'state_file') || "/etc/tailscale/tailscaled.state";
+		if (access(state_file_path)) {
+			try {
+				let state_content = readfile(state_file_path);
+				if (state_content != null) {
+					let state_data = json(state_content);
+					let profiles_b64 = state_data?._profiles;
+					if (!profiles_b64) return settings;
+
+					let profiles_data = json(b64dec(profiles_b64));
+					let profiles_key = null;
+					for (let key in profiles_data) {
+						profiles_key = key;
+						break;
+					}
+				profiles_key = 'profile-'+profiles_key;
+
+				let status_data = json(b64dec(state_data?.[profiles_key]));
+				if (status_data != null) {
+					settings.accept_routes = status_data?.RouteAll || false;
+					settings.advertise_exit_node = status_data?.AdvertiseExitNode || false;
+					settings.advertise_routes = status_data?.AdvertiseRoutes || [];
+					settings.exit_node = status_data?.ExitNodeID || "";
+					settings.exit_node_allow_lan_access = status_data?.ExitNodeAllowLANAccess || false;
+					settings.shields_up = status_data?.ShieldsUp || false;
+					settings.ssh = status_data?.RunSSH || false;
+					settings.runwebclient = status_data?.RunWebClient || false;
+					settings.nosnat = status_data?.NoSNAT || false;
+					settings.disable_magic_dns = !status_data?.CorpDNS || false;
+					settings.fw_mode = split(uci.get('tailscale', 'settings', 'fw_mode'),' ')[0] || 'nftables';
+				}
+				}
+			} catch (e) { /* ignore */ }
+		}
+		return settings;
+	}
+};
+
+
+methods.do_login = {
+	args: { form_data: {} },
+	call: function(request) {
+		const form_data = request.args.form_data;
+		let loginargs = [];
+		if (form_data == null || length(form_data) == 0) {
+			return { error: 'Missing or invalid form_data parameter. Please provide login data.' };
+		}
+
+		let status=methods.get_status.call();
+		if (status.status != 'logout') {
+			return { error: 'Tailscale is already logged in and running.' };
+		}
+
+		// --- 1. Prepare and Run Login Command (Once) ---
+		const loginserver = trim(form_data.loginserver) || '';
+		const loginserver_authkey = trim(form_data.loginserver_authkey) || '';
+
+		if (loginserver!='') {
+			push(loginargs,'--login-server '+shell_quote(loginserver));
+			if (loginserver_authkey!='') {
+				push(loginargs,'--auth-key '+shell_quote(loginserver_authkey));
+			}
+		}
+
+		// Run the command in the background using /bin/sh -c to handle the '&' correctly
+		let login_cmd = 'tailscale login '+join(' ', loginargs);
+		popen('/bin/sh -c "' + login_cmd + ' &"', 'r');
+
+		// --- 2. Loop to Check Status for URL ---
+		let max_attempts = 15;
+		let interval = 2000;
+
+		for (let i = 0; i < max_attempts; i++) {
+			let tresult = exec('tailscale status');
+			for (let line in tresult.stdout) {
+				let trline = trim(line);
+				if (index(trline, 'http') != -1) {
+					let parts = split(trline, ' ');
+					for (let part in parts) {
+						if (index(part, 'http') != -1) {
+							return { url: part };
+						}
+					}
+				}
+			}
+			sleep(interval);
+		}
+		return { error: 'Could not retrieve login URL from tailscale command after 30 seconds.' };
+	}
+};
+
+methods.do_logout = {
+	call: function() {
+		let status=methods.get_status.call();
+		if (status.status != 'running') {
+			return { error: 'Tailscale is not running. Cannot perform logout.' };
+		}
+
+		let logout_result = exec('tailscale logout');
+		if (logout_result.code != 0) {
+			return { error: 'Failed to logout: ' + logout_result.stderr };
+		}
+		return { success: true };
+	}
+};
+
+methods.get_subroutes = {
+	call: function() {
+		try {
+			let cmd = 'ip -j route';
+			let result = exec(cmd);
+			let subnets = [];
+
+			if (result.code == 0 && length(result.stdout) > 0) {
+				let routes_json = json(join('',result.stdout));
+
+				for (let route in routes_json) {
+					// We need to filter out local subnets
+					// 1. 'dst' (target address) is not' default' (default gateway)
+					// 2. 'scope' is' link' (indicating directly connected network)
+					// 3. It is an IPv4 address (simple judgment: including'.')
+					if (route?.dst && route.dst != 'default' && route?.scope == 'link' && index(route.dst,'.') != -1) {
+						push(subnets,route.dst);
+					}
+				}
+			}
+			return { routes: subnets };
+		}
+		catch(e) {
+			return { routes: [] };
+		}
+	}
+};
+
+methods.setup_firewall = {
+	call: function() {
+		try {
+			uci.load('network');
+			uci.load('firewall');
+
+			let changed_network = false;
+			let changed_firewall = false;
+
+			// 1. config Network Interface
+			let net_ts = uci.get('network', 'tailscale');
+			if (net_ts == null) {
+				uci.set('network', 'tailscale', 'interface');
+				uci.set('network', 'tailscale', 'proto', 'none');
+				uci.set('network', 'tailscale', 'device', 'tailscale0');
+				changed_network = true;
+			} else {
+				let current_dev = uci.get('network', 'tailscale', 'device');
+				if (current_dev != 'tailscale0') {
+					uci.set('network', 'tailscale', 'device', 'tailscale0');
+					changed_network = true;
+				}
+			}
+
+			// 2. config Firewall Zone
+			let fw_all = uci.get_all('firewall');
+			let ts_zone_section = null;
+			let fwd_lan_to_ts = false;
+			let fwd_ts_to_lan = false;
+
+			for (let sec_key in fw_all) {
+				let s = fw_all[sec_key];
+				if (s['.type'] == 'zone' && s['name'] == 'tailscale') {
+					ts_zone_section = sec_key;
+				}
+				if (s['.type'] == 'forwarding') {
+					if (s.src == 'lan' && s.dest == 'tailscale') fwd_lan_to_ts = true;
+					if (s.src == 'tailscale' && s.dest == 'lan') fwd_ts_to_lan = true;
+				}
+			}
+
+			if (ts_zone_section == null) {
+				let zid = uci.add('firewall', 'zone');
+				uci.set('firewall', zid, 'name', 'tailscale');
+				uci.set('firewall', zid, 'input', 'ACCEPT');
+				uci.set('firewall', zid, 'output', 'ACCEPT');
+				uci.set('firewall', zid, 'forward', 'ACCEPT');
+				uci.set('firewall', zid, 'masq', '1');
+				uci.set('firewall', zid, 'mtu_fix', '1');
+				uci.set('firewall', zid, 'network', ['tailscale']);
+				changed_firewall = true;
+			} else {
+				let nets = uci.get('firewall', ts_zone_section, 'network');
+				let net_list = [];
+				let has_ts_net = false;
+
+				if (type(nets) == 'array') {
+					net_list = nets;
+				} else if (type(nets) == 'string') {
+					net_list = [nets];
+				}
+
+				// check if 'tailscale' is already in the list
+				for (let n in net_list) {
+					if (net_list[n] == 'tailscale') {
+						has_ts_net = true;
+						break;
+					}
+				}
+
+				if (!has_ts_net) {
+					push(net_list, 'tailscale');
+					uci.set('firewall', ts_zone_section, 'network', net_list);
+					changed_firewall = true;
+				}
+			}
+
+			// 3. config Forwarding
+			if (!fwd_lan_to_ts) {
+				let fid = uci.add('firewall', 'forwarding');
+				uci.set('firewall', fid, 'src', 'lan');
+				uci.set('firewall', fid, 'dest', 'tailscale');
+				changed_firewall = true;
+			}
+
+			if (!fwd_ts_to_lan) {
+				let fid = uci.add('firewall', 'forwarding');
+				uci.set('firewall', fid, 'src', 'tailscale');
+				uci.set('firewall', fid, 'dest', 'lan');
+				changed_firewall = true;
+			}
+
+			// 4. save
+			if (changed_network) {
+				uci.save('network');
+				uci.commit('network');
+				exec('/etc/init.d/network reload');
+			}
+
+			if (changed_firewall) {
+				uci.save('firewall');
+				uci.commit('firewall');
+				exec('/etc/init.d/firewall reload');
+			}
+
+			return {
+				success: true,
+				changed_network: changed_network,
+				changed_firewall: changed_firewall,
+				message: (changed_network || changed_firewall) ? 'Tailscale firewall/interface configuration applied.' : 'Tailscale firewall/interface already configured.'
+			};
+
+		} catch (e) {
+			return { error: 'Exception in setup_firewall: ' + e + '\nStack: ' + (e.stacktrace || '') };
+		}
+	}
+};
+
+return { 'tailscale': methods };