Tailscale docker自建derp服务器 自定义端口

一、安装需求

1. 需要一台固定ip服务器和域名,把域名解析到服务器，然后安装tailscale

2. 在服务器生成SSL证书,证书获取：Let's Encrypt 公益证书 Certbot Instructions | Certbot

    2.1 安装snapd,安装certbot需要

sudo apt update
sudo apt install snapd

  2.2安装certbot

sudo snap install --classic certbot

   2.3获取证书，下面方法只针对下面命令有效：域名需要能访问，比如你的域名是example.com，那么它会在域名的根目录生成一个文件，然后能访问，访问地址类似于：http://www.example.com/.well-known/acme-challenge/rSBeoZjsO3JkCGP2IrGZ9T3POjQDml95Uzl2KjBjkuY

sudo certbot certonly --webroot

   回车后填入域名，填入域名根目录

    完成后显示类似下面的页面，在目录中fullchain.pem就是crt,privkey.pem就是key：

  

3.安装docker服务（小白最好弄个宝塔服务器面板，一键全能部署及管理，方便）

二、安装derp

国内服务商有防火墙的记得开放端口3478，8443，3478需要开放udp协议：

docker run -d \
--name derp \
--restart=always \
-p 0.0.0.0:3478:3478/udp \
-p 0.0.0.0:8443:8443 \
-v /etc/letsencrypt/live/derper.example.com/fullchain.pem:/app/certs/example.com.crt \
-v /etc/letsencrypt/live/derper.example.com/privkey.pem:/app/certs/example.com.key \
-v /var/run/tailscale/tailscaled.sock:/var/run/tailscale/tailscaled.sock \
-e DERP_DOMAIN=derper.example.com \
-e DERP_ADDR=:8443 \
-e DERP_CERT_MODE=manual \
-e DERP_VERIFY_CLIENTS=true \
fredliang/derper:latest

然后去tailscale Access controls 修改配置，增加下面一项即可：

代码：

// Example/default ACLs for unrestricted connections.
{
	// Declare static groups of users. Use autogroups for all users or users with a specific role.
	// "groups": {
	//  	"group:example": ["alice@example.com", "bob@example.com"],
	// },

	// Define the tags which can be applied to devices and by which users.
	// "tagOwners": {
	//  	"tag:example": ["autogroup:admin"],
	// },

	// Define access control lists for users, groups, autogroups, tags,
	// Tailscale IP addresses, and subnet ranges.
	"acls": [
		// Allow all connections.
		// Comment this section out if you want to define specific restrictions.
		{"action": "accept", "src": ["*"], "dst": ["*:*"]},
	],

	// Define users and devices that can use Tailscale SSH.
	"ssh": [
		// Allow all users to SSH into their own devices in check mode.
		// Comment this section out if you want to define specific restrictions.
		{
			"action": "check",
			"src":    ["autogroup:member"],
			"dst":    ["autogroup:self"],
			"users":  ["autogroup:nonroot", "root"],
		},
	],
	"derpMap": {
		"Regions": {
			"900": {
				"RegionID":   900,
				"RegionCode": "myderp",
				"Nodes": [
					{
						"Name":     "1",
						"RegionID": 900,
						"HostName": "derper.example.com",
						"DERPPort": 8443,
					},
				],
			},
		},
	},
	// Test access rules every time they're saved.
	// "tests": [
	//  	{
	//  		"src": "alice@example.com",
	//  		"accept": ["tag:example"],
	//  		"deny": ["100.101.102.103:443"],
	//  	},
	// ],
}

 保存后去admin machines 点开服务器查看，有900表示成功了