Add support for advertising Tailscale Services #715
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -52,6 +52,7 @@ options: | |
| login_server: "https://controlplane.tailscale.com" | ||
| share_homeassistant: disabled | ||
| share_on_port: 443 | ||
| services: [] | ||
| snat_subnet_routes: true | ||
| stateful_filtering: false | ||
| tags: [] | ||
|
|
@@ -78,6 +79,12 @@ schema: | |
| login_server: url | ||
| share_homeassistant: list(disabled|serve|funnel) | ||
| share_on_port: match(^(?:443|8443|10000)$) | ||
| services: | ||
| - name: "match(^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$)" | ||
| target: "match(^(?:https?|tcp)://127\\.0\\.0\\.1:([1-9]\\d{0,3}|[1-5]\\d{4}|6[0-4]\\d{3}|65[0-4]\\d{2}|655[0-2]\\d|6553[0-5])$)" | ||
| protocol: "list(http|https|tcp|tls-terminated-tcp)" | ||
| port: "match(^([1-9]\\d{0,3}|[1-5]\\d{4}|6[0-4]\\d{3}|65[0-4]\\d{2}|655[0-2]\\d|6553[0-5])$)" | ||
|
Collaborator
There was a problem hiding this comment. there is a "port" type, see https://developers.home-assistant.io/docs/apps/configuration#options--schema |
||
| path: "match(^/.*$)?" | ||
| snat_subnet_routes: bool | ||
| stateful_filtering: bool | ||
| tags: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| #!/command/with-contenv bashio | ||
| # shellcheck shell=bash | ||
| export LOG_FD | ||
|
Collaborator
There was a problem hiding this comment. This line is not needed with the new base image with the new bashio. Will be removed in all other places later, with all the temporary workarounds. |
||
| # ============================================================================== | ||
| # Home Assistant Community App: Tailscale | ||
| # Advertises configured Tailscale Services from this host | ||
| # ============================================================================== | ||
|
|
||
| declare current_config | ||
|
|
||
| declare service | ||
| declare name | ||
| declare service_name | ||
|
|
||
| declare protocol | ||
|
|
||
| declare port | ||
|
|
||
| declare target | ||
|
|
||
| declare path | ||
|
|
||
| declare -a options=() | ||
| declare -a configured_services=() | ||
| declare -a configured_names=() | ||
| declare -a current_names=() | ||
|
|
||
| # Nothing to do when no services are configured | ||
|
Collaborator
There was a problem hiding this comment. nope, we still have to remove removed services!!! |
||
| if ! bashio::config 'services' | jq -e '. | length > 0' > /dev/null 2>&1; then | ||
| exit 0 | ||
| fi | ||
|
|
||
| # Read configured services | ||
| # Note: bashio::config emits one JSON object per line for array options | ||
| readarray -t configured_services < <(bashio::config 'services') | ||
|
|
||
| # Build a list of configured service names (without the svc: prefix) | ||
| for service in "${configured_services[@]}"; do | ||
| name=$(jq -re '.name' <<< "${service}") | ||
|
|
||
| name="${name#svc:}" | ||
|
Collaborator
There was a problem hiding this comment. do we have svc: prefix there?
Author
There was a problem hiding this comment. That will be not necessary anymore, when we make
Collaborator
There was a problem hiding this comment. I mean |
||
| configured_names+=("${name}") | ||
|
Collaborator
There was a problem hiding this comment. One more thing, to get configured_names, you can use bashio::config 'services.names' (if I remember correctly), and add some jq or grep to delete the svc: prefixes if needed, so this whole loop can be a one-liner I think. |
||
| done | ||
|
|
||
| bashio::log.info "Configured service hosts: ${configured_names[*]}" | ||
|
|
||
| # Wait for tailscaled to be available | ||
|
Collaborator
There was a problem hiding this comment. post-tailscaled already waited for this |
||
| while ! bashio::fs.socket_exists "/var/run/tailscale/tailscaled.sock"; do | ||
| sleep 1 | ||
| done | ||
|
|
||
| while ! /opt/tailscale status --json --peers=false --self=false \ | ||
|
Collaborator
There was a problem hiding this comment. post-tailscaled already waited for this
Author
There was a problem hiding this comment. Ah, okay that's useful. I haven't caught this. |
||
| | jq --exit-status '.BackendState == "Running"' > /dev/null; do | ||
| sleep 2 | ||
| done | ||
|
|
||
| # Read currently advertised services from the tailscale serve config | ||
| if ! current_config=$(/opt/tailscale serve get-config --all 2>/dev/null); then | ||
| current_config='{}' | ||
| fi | ||
|
|
||
| # Build a list of currently configured service names | ||
| readarray -t current_names < <(jq -re '.services | keys[]' <<< "${current_config}" 2>/dev/null || true) | ||
|
Collaborator
There was a problem hiding this comment. why not use bashio::jq() ? |
||
|
|
||
| # Remove services that are no longer configured in this app | ||
| for service_name in "${current_names[@]}"; do | ||
| if [[ "${service_name}" != svc:* ]]; then | ||
|
Collaborator
There was a problem hiding this comment. why do wee need this? just asking! what else can be there?
Author
There was a problem hiding this comment. It was ment as a safe guard agains when Tailscale should decide to put other things in the .service section then actual services. But you are questioning this correctly. Why should they do it. I'll remove that guard. |
||
| continue | ||
| fi | ||
| # Compare without the svc: prefix | ||
| if ! printf '%s\n' "${configured_names[@]}" | grep -qx "${service_name#svc:}"; then | ||
| bashio::log.info "Removing stale service host configuration for ${service_name}" | ||
| /opt/tailscale serve drain "${service_name}" >/dev/null 2>&1 || true | ||
|
Collaborator
There was a problem hiding this comment. we should log at least a warning on error (an exit.nok would stop the app, so let it start up, but don't hide the error) |
||
| /opt/tailscale serve clear "${service_name}" >/dev/null 2>&1 || true | ||
| fi | ||
| done | ||
|
|
||
| # Configure and advertise each service | ||
| for service in "${configured_services[@]}"; do | ||
| name=$(jq -re '.name' <<< "${service}") | ||
|
|
||
| name="${name#svc:}" | ||
| service_name="svc:${name}" | ||
| protocol=$(jq -re '.protocol' <<< "${service}") | ||
| port=$(jq -re '.port' <<< "${service}") | ||
|
Collaborator
There was a problem hiding this comment. My last question: can we use the same eg. 443 port here, as the share_homeassistant service uses? Services are running on a virtual tailnet name/IP, so it shouldn't be a problem. I'm asking, because I'm lazy to test it myself. :D
Author
There was a problem hiding this comment. Yes that should be possible. I will test this once i have implemented the changes. |
||
| target=$(jq -re '.target' <<< "${service}") | ||
| path=$(jq -re '.path // empty' <<< "${service}") | ||
|
|
||
| options=() | ||
| case "${protocol}" in | ||
|
Collaborator
There was a problem hiding this comment. protocol's value is restricted by the config schema, validate only that it is in the accepted list, exit.nok if not (fail during development), then use it directly in a single line
Collaborator
There was a problem hiding this comment. if ! "${protocol}" = @(http|https|tcp|tls-terminated-tcp); then
Author
There was a problem hiding this comment. I'm not very good in bash. Thanks for the advice.
Collaborator
There was a problem hiding this comment. Another idea. If https or tls-terminated-tcp is used, shouldn't we check once (!!!) that https support is enabled? Like in Though we can say, that share_homeassistant is for the less experienced users, with more checks. :D |
||
| http) | ||
| options+=("--http=${port}") | ||
| ;; | ||
| https) | ||
| options+=("--https=${port}") | ||
| ;; | ||
| tcp) | ||
| options+=("--tcp=${port}") | ||
| ;; | ||
| tls-terminated-tcp) | ||
| options+=("--tls-terminated-tcp=${port}") | ||
| ;; | ||
| esac | ||
|
|
||
| if [[ -n "${path}" ]]; then | ||
|
|
||
| options+=("--set-path=${path}") | ||
| fi | ||
|
|
||
| # Clean any existing configuration for this service before reconfiguring | ||
| /opt/tailscale serve drain "${service_name}" >/dev/null 2>&1 || true | ||
|
Collaborator
There was a problem hiding this comment. at least a warning should be logged when removing, otherwise when the serve below fails during recreation, nobody will know the root cause |
||
| /opt/tailscale serve clear "${service_name}" >/dev/null 2>&1 || true | ||
|
|
||
| bashio::log.info "Advertising service host for ${service_name}" | ||
| if ! /opt/tailscale serve --service="${service_name}" --yes "${options[@]}" "${target}"; then | ||
|
Collaborator
There was a problem hiding this comment. I would add "serve" and "target" to the options array above, this is how it is implemented everywhere else
Author
There was a problem hiding this comment. No it's not anymore. Earlier
Collaborator
There was a problem hiding this comment. Don't they use it to check if https is enabled and ask whether they should enable it if not? AFAIK they don't do it in a non-interactive cli and just emit an error, but I'm not 100% sure about this. :( |
||
| bashio::exit.nok "Failed to advertise service host for ${service_name}" | ||
| fi | ||
| done | ||
|
|
||
| exit 0 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| oneshot |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| /etc/s6-overlay/s6-rc.d/share-services/run |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
At all other places in DOCS the reference to the TS docs is in a separate line as "More information: ..." This is "important", because the device must to use tags!