Terraform Cloudinit Tailscale

https://github.com/tailscale/terraform-cloudinit-tailscale
Admin
A Terraform module that generates cloud-init configuration for deploying and configuring Tailscale...
Tokens:30,531
Snippets:366
Trust Score:10
License:BSD-3-Clause
Update:1 month ago
Show doc for...
Tokens:
Raw
### Basic Tailscale Setup on AWS EC2 with Auth Key

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/usage-examples.md

This example shows how to provision an Ubuntu instance on AWS EC2 and configure Tailscale using a pre-generated authentication key. It includes Terraform configuration for AWS, Tailscale cloud-init module, security group setup, and instance launch.

```hcl
terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    cloudinit = {
      source  = "hashicorp/cloudinit"
      version = ">= 2.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

variable "tailscale_auth_key" {
  description = "Tailscale auth key"
  type        = string
  sensitive   = true
}

# Use the Tailscale cloud-init module
module "tailscale_init" {
  source = "github.com/tailscale/terraform-cloudinit-tailscale"

  auth_key = var.tailscale_auth_key
  hostname = "web-server-1"
  enable_ssh = true
}

# Get the latest Ubuntu 22.04 AMI
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"] # Canonical

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# Create security group for Tailscale
resource "aws_security_group" "tailscale" {
  name_prefix = "tailscale-"
  description = "Tailscale access"

  ingress {
    from_port   = 41641
    to_port     = 41641
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Launch the instance
resource "aws_instance" "web" {
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = "t3.micro"
  security_groups        = [aws_security_group.tailscale.id]
  user_data_base64       = module.tailscale_init.rendered
  associate_public_ip_address = true

  tags = {
    Name = "tailscale-web-1"
  }
}

output "instance_id" {
  value = aws_instance.web.id
}

output "public_ip" {
  value = aws_instance.web.public_ip
}
```

```bash
terraform apply -var="tailscale_auth_key=tskey-abc123..."
```

--------------------------------

### Minimal Terraform Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/README.md

This example shows the basic Terraform setup required to use the Tailscale cloud-init module. It includes provider requirements and module instantiation with an authentication key.

```hcl
terraform {
  required_version = ">= 1.0"
  required_providers {
    cloudinit = {
      source  = "hashicorp/cloudinit"
      version = ">= 2.0"
    }
  }
}

module "tailscale_init" {
  source = "github.com/tailscale/terraform-cloudinit-tailscale"

  auth_key = "tskey-abc123..."  # Get from Tailscale admin console
  hostname = "my-server"
}

# Pass the output to your cloud resource
resource "aws_instance" "example" {
  ami              = "ami-0c55b159cbfafe1f0"
  instance_type    = "t3.micro"
  user_data_base64 = module.tailscale_init.rendered
}
```

--------------------------------

### Complete Terraform Cloud-Init Tailscale Module Usage

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

This example demonstrates a full configuration of the Tailscale Cloud-Init module, including authentication, node identity, routing, connectivity, daemon configuration, installation, and output settings. It also shows how to integrate with AWS EC2 using the `user_data_base64` field.

```hcl
module "tailscale_cloud_init" {
  source = "github.com/tailscale/terraform-cloudinit-tailscale"

  # Authentication (choose one method)
  auth_key = var.tailscale_auth_key

  # Node identity
  hostname       = "prod-server-1"
  enable_ssh     = true
  advertise_tags = ["tag:prod", "tag:web"]

  # Routing
  advertise_routes = ["192.168.1.0/24"]
  accept_dns       = true
  accept_routes    = true

  # Connectivity
  login_server = "https://controlplane.tailscale.com"

  # Daemon configuration
  tailscaled_flag_port    = 41641
  tailscaled_flag_verbose = 1

  # Installation
  track       = "stable"
  max_retries = 3
  retry_delay = 5

  # Output
  base64_encode = true
}

# Use with AWS EC2
resource "aws_instance" "server" {
  user_data_base64 = module.tailscale_cloud_init.rendered
  # ... other configuration
}
```

--------------------------------

### Configure Tailscale Setup Script

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

This snippet shows how to use the `templatefile` function to render a shell script for Tailscale setup. It passes various configuration variables, including sensitive authentication credentials, to the template.

```hcl
part {
  filename     = "setup_tailscale.sh"
  content_type = "text/x-shellscript"
  content = templatefile("${path.module}/templates/setup_tailscale.sh.tmpl", {
    ADVERTISE_ROUTES           = join(",", var.advertise_routes)
    ADVERTISE_TAGS             = join(",", var.advertise_tags)
    ACCEPT_DNS                 = var.accept_dns
    ACCEPT_ROUTES              = var.accept_routes
    ADVERTISE_CONNECTOR        = var.advertise_connector
    ADVERTISE_EXIT_NODE        = var.advertise_exit_node
    HOSTNAME                   = var.hostname
    TAILSCALE_SSH              = var.enable_ssh
    AUTH_KEY                   = sensitive(var.auth_key)
    EXIT_NODE                  = var.exit_node
    EXIT_NODE_ALLOW_LAN_ACCESS = var.exit_node_allow_lan_access
    FORCE_REAUTH               = var.force_reauth
    JSON                        = var.json
    LOGIN_SERVER               = var.login_server
    OPERATOR                   = var.operator
    RESET                      = var.reset
    SHIELDS_UP                 = var.shields_up
    TIMEOUT                    = var.timeout
    SNAT_SUBNET_ROUTES         = var.snat_subnet_routes
    NETFILTER_MODE             = var.netfilter_mode
    STATEFUL_FILTERING         = var.stateful_filtering
    MAX_RETRIES                = var.max_retries
    RETRY_DELAY                = var.retry_delay
    RELAY_SERVER_PORT          = var.relay_server_port == null ? "" : tostring(var.relay_server_port)
    ID_TOKEN                   = sensitive(var.id_token)
    CLIENT_ID                  = var.client_id
    CLIENT_SECRET              = sensitive(var.client_secret)
    AUDIENCE                   = var.audience
  })
}
```

--------------------------------

### Terraform Example: Tailscale Initialization with OAuth Audience

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

A complete Terraform module example for initializing Tailscale using OAuth with audience and client ID.

```hcl
module "tailscale_init" {
  source    = "github.com/tailscale/terraform-cloudinit-tailscale"
  
  audience  = "https://tailscale.com/api/v2"
  client_id = "my-oauth-client"
}
```

--------------------------------

### Define a cloud-init part with filename, content type, and content

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

Defines a single part of a cloud-init MIME multipart document. This example specifies a shell script for IP forwarding setup.

```hcl
part {
  filename     = "ip_forwarding.sh"
  content_type = "text/x-shellscript"
  content      = file("${path.module}/files/ip_forwarding.sh")
}
```

--------------------------------

### Define cloud-init part for Tailscale installation

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

Defines a shell script part to download and install the Tailscale client. It uses a template file and accepts variables for release track, max retries, and retry delay.

```hcl
part {
  filename     = "install_tailscale.sh"
  content_type = "text/x-shellscript"
  content = templatefile("${path.module}/templates/install_tailscale.sh.tmpl", {
    TRACK       = var.track
    MAX_RETRIES = var.max_retries
    RETRY_DELAY = var.retry_delay
  })
}
```

--------------------------------

### Tailscale Installation Script with Retries

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/template-scripts.md

This script downloads and installs the Tailscale client using curl and sh. It includes retry logic for download and verification steps, with configurable maximum retries and delay. The TRACK environment variable can be set to 'stable' or 'unstable'.

```bash
#!/bin/sh

# Verify we have internet connectivity
max_retries=${MAX_RETRIES}
retry_delay=${RETRY_DELAY}
i=1

# Function to log messages
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
}

# Export the TRACK variable
TRACK="${TRACK}"
export TRACK

log "Starting Tailscale installation with TRACK=$TRACK"

while [ $i -le $max_retries ]
do
    # Download and run the Tailscale install script
    if curl -fsSL https://tailscale.com/install.sh | sh; then
        log "Tailscale installation script executed successfully"
    else
        log "Error: Tailscale installation script failed. Retry attempt $i"
        sleep $retry_delay
        i=$((i + 1))
        continue
    fi

    # Check if Tailscale is installed correctly
    if command -v tailscale >/dev/null 2>&1; then
        log "Tailscale installed successfully"
        tailscale version
        exit 0
    else
        log "Error: Tailscale installation could not be verified. Retry attempt $i"
        sleep $retry_delay
        i=$((i + 1))
    fi
done

log "Tailscale installation completed"
exit 0

```

--------------------------------

### Check Cloud-Init Output Log

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

View the last 50 lines of the cloud-init output log to diagnose installation failures or hangs. Look for specific error messages related to Tailscale.

```bash
sudo cat /var/log/cloud-init-output.log | tail -50
```

--------------------------------

### Main Tailscale Cloud-Init Script

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/template-scripts.md

This script automates the installation and configuration of Tailscale on a new instance. It handles service enablement, dynamic command construction for `tailscale up` with multiple authentication methods, and applies various `tailscale set` configurations. The script includes retry logic for the `tailscale up` command.

```bash
#!/bin/sh

# Helper function to resolve file: or command: prefixes
resolve_value() {
  local value="$1"
  
  case "$value" in
    file:*) 
      cat "$${value#file:}" | tr -d '\n'
      ;; 
    command:*) 
      eval "$${value#command:}" | tr -d '\n'
      ;; 
    *)
      printf '%s' "$value"
      ;; 
  esac
}

# Helper function to add flag with resolved value
add_flag_with_value() {
  local flag_name="$1"
  local value="$2"
  
  if [ -n "$value" ]; then
    resolved_value=$(resolve_value "$value")
    tailscale_cmd="$tailscale_cmd --$flag_name=\"$resolved_value\""
  fi
}

max_retries=${MAX_RETRIES}
retry_delay=${RETRY_DELAY}
i=1

while [ $i -le $max_retries ]
do
  sudo systemctl enable --now tailscaled
  
  # Construct the tailscale up command
  tailscale_cmd="tailscale up \
    --json=\"${JSON}\" \
    --login-server=\"${LOGIN_SERVER}\" \
    --reset=\"${RESET}\" \
    --timeout=\"${TIMEOUT}\" \
    --force-reauth=\"${FORCE_REAUTH}\""
  
  # Add authentication
  add_flag_with_value "authkey" "${AUTH_KEY}"
  add_flag_with_value "id-token" "${ID_TOKEN}"
  add_flag_with_value "client-id" "${CLIENT_ID}"
  add_flag_with_value "client-secret" "${CLIENT_SECRET}"

  if [ -n "${AUDIENCE}" ]; then
    tailscale_cmd="$tailscale_cmd --audience=\"${AUDIENCE}\""
  fi
  
  # Add optional hostname
  if [ -n "${HOSTNAME}" ]; then
    tailscale_cmd="$tailscale_cmd --hostname=\"${HOSTNAME}\""
  fi
  
  # Add advertise settings
  if [ -n "${ADVERTISE_TAGS}" ]; then
    tailscale_cmd="$tailscale_cmd --advertise-tags=\"${ADVERTISE_TAGS}\""
  fi
  
  if [ -n "${ADVERTISE_ROUTES}" ]; then
    tailscale_cmd="$tailscale_cmd --advertise-routes=\"${ADVERTISE_ROUTES}\""
  fi
  
  # Execute the tailscale up command
  eval "$tailscale_cmd"
  
  # Check success
  if [ $? -eq 0 ]; then
    echo "Tailscale up succeeded, now configuring settings..."
    
    # Configure settings using tailscale set
    tailscale set --accept-dns="${ACCEPT_DNS}"
    tailscale set --accept-routes="${ACCEPT_ROUTES}"
    tailscale set --advertise-exit-node="${ADVERTISE_EXIT_NODE}"
    tailscale set --advertise-connector="${ADVERTISE_CONNECTOR}"
    tailscale set --shields-up="${SHIELDS_UP}"
    tailscale set --ssh="${TAILSCALE_SSH}"
    tailscale set --snat-subnet-routes="${SNAT_SUBNET_ROUTES}"
    tailscale set --netfilter-mode="${NETFILTER_MODE}"
    tailscale set --stateful-filtering="${STATEFUL_FILTERING}"
    
    # Optional settings
    if [ -n "${EXIT_NODE}" ]; then
      tailscale set --exit-node="${EXIT_NODE}"
    fi
    
    if [ -n "${EXIT_NODE_ALLOW_LAN_ACCESS}" ] && [ "${EXIT_NODE_ALLOW_LAN_ACCESS}" = "true" ]; then
      tailscale set --exit-node-allow-lan-access="${EXIT_NODE_ALLOW_LAN_ACCESS}"
    fi
    
    if [ -n "${OPERATOR}" ]; then
      tailscale set --operator="${OPERATOR}"
    fi

    if [ -n "${RELAY_SERVER_PORT}" ]; then
      tailscale set --relay-server-port="${RELAY_SERVER_PORT}"
    fi
    
    echo "Tailscale installation and configuration succeeded"
    exit 0
  else
    echo "Tailscale up failed. Retry attempt $i"
    sleep $retry_delay
  fi
  
  i=$((i + 1))
done

```

--------------------------------

### Check Operating System Distribution

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Determine the operating system distribution and version running on the instance. Ensure it is a supported OS for Tailscale installation.

```bash
lsb_release -a
```

```bash
cat /etc/os-release
```

--------------------------------

### Verify Exit Node and IP Forwarding Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

This solution verifies the exit node setup and IP forwarding on the exit node, and applies the necessary client-side configurations. It includes checking kernel support for IP forwarding and ensuring the client is set up to accept routes and use the specified exit node.

```bash
# On exit node
tailscale status
sudo sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding
```

```bash
# On client
tailscale set --accept-routes=true
tailscale set --exit-node=<exit-node-ip>
curl ifconfig.me  # Verify IP changed
```

```bash
# Check on exit node
cat /proc/sys/net/ipv4/ip_forward
# Should output: 1
```

```bash
# Enable (already done by cloud-init)
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
```

--------------------------------

### Direct Authorization Key - File Loading with Variable

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

This example demonstrates loading the Tailscale authorization key from a file specified by a Terraform variable. The 'file:' prefix indicates that the value should be read from the specified path.

```hcl
variable "auth_key_file" {
  type = string
  # Value: "/etc/secrets/tailscale.key"
}

module "tailscale_init" {
  source   = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = "file:${var.auth_key_file}"
}
```

--------------------------------

### Check Disk Space Usage

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Monitor disk space usage on the instance using the `df -h` command. Insufficient disk space can cause installation failures.

```bash
df -h
```

--------------------------------

### GCP Workload Identity Example with Command

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

This HCL configures Tailscale initialization on GCP using a command to fetch the ID token. The ID token is loaded via the 'command:' prefix, and the client ID is specified.

```hcl
module "tailscale_init" {
  source    = "github.com/tailscale/terraform-cloudinit-tailscale"
  
  # Command to fetch GCP ID token for Tailscale
  id_token  = "command:gcloud auth identity-token --audiences https://tailscale.com/api/v2"
  
  client_id = "my-gcp-client-id"
}
```

--------------------------------

### Reinstall Tailscale

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Reinstall Tailscale using the official installation script. This can resolve issues caused by missing dependencies or corrupted installations.

```bash
curl -fsSL https://tailscale.com/install.sh | sh
```

--------------------------------

### Inspect Tailscale Daemon Journal Logs

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Examine the systemd journal logs for the `tailscaled` service to identify errors preventing it from starting. Use `-xe` for detailed error information.

```bash
sudo journalctl -xe -u tailscaled
```

--------------------------------

### Direct Authorization Key - Vault Command Loading

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

This example shows how to retrieve a Tailscale authorization key using a Vault CLI command. The 'command:' prefix tells the script to execute the provided Vault command and use its output as the key.

```hcl
module "tailscale_init" {
  source   = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = "command:vault read -field=key secret/data/tailscale"
}
```

--------------------------------

### Get System Information

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Collect kernel and distribution information to provide context for system-specific issues. This includes the kernel version and the Linux distribution details.

```bash
uname -a
lsb_release -a
```

--------------------------------

### Accept Advertised Routes

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

If true, this node will accept and install routes advertised by other nodes on the Tailscale network.

```hcl
accept_routes = true
```

--------------------------------

### GCP Workload Identity Federation Example

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

This snippet shows how to authenticate Tailscale on GCP Compute Engine using a command to fetch an ID token. The ID token is loaded using the 'command:' prefix.

```hcl
module "tailscale_init" {
  source    = "github.com/tailscale/terraform-cloudinit-tailscale"
  id_token  = "command:gcloud auth identity-token --audiences https://tailscale.com/api/v2"
  client_id = var.tailscale_client_id
}
```

--------------------------------

### Temporarily Disable SELinux

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

For testing purposes only, temporarily set SELinux to permissive mode. If Tailscale starts working, SELinux policies are likely the cause.

```bash
sudo setenforce 0
```

--------------------------------

### Test Tailscale.com Connectivity

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Use curl to test network connectivity and DNS resolution to tailscale.com. This helps diagnose issues where the instance cannot reach the Tailscale installation server.

```bash
curl -v https://tailscale.com/install.sh
```

--------------------------------

### Terraform: Correcting Invalid Advertise Tags

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Ensure all advertise tags are prefixed with 'tag:'. This example shows the incorrect and correct format.

```hcl
# WRONG
advertise_tags = ["marketing", "ops"]

# CORRECT
advertise_tags = ["tag:marketing", "tag:ops"]
```

--------------------------------

### Kubernetes Workload Identity Federation Example

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

Use this snippet to authenticate Tailscale in Kubernetes using a service account token. The ID token is loaded from a file path automatically mounted by Kubernetes.

```hcl
module "tailscale_init" {
  source    = "github.com/tailscale/terraform-cloudinit-tailscale"
  id_token  = "file:/var/run/secrets/kubernetes.io/serviceaccount/token"
  client_id = var.tailscale_client_id
}
```

--------------------------------

### Extract Terraform Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Use this command to get your Terraform configuration in JSON format, redacting sensitive values. This is useful for understanding your setup when reporting issues.

```bash
terraform show -json | jq '.values.outputs'
```

--------------------------------

### View Cloud-Init Output Log

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Display the contents of the cloud-init output log to review the initialization process. Use `tail -f` to follow the log in real-time.

```bash
sudo cat /var/log/cloud-init-output.log
```

```bash
sudo tail -f /var/log/cloud-init-output.log
```

--------------------------------

### View Cloud-Init Data and Logs

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

Commands to inspect the rendered Cloud-Init user data and view Cloud-Init logs on a running instance. Also includes commands to check Cloud-Init and Tailscale status.

```bash
# View the rendered cloud-init data
sudo cat /var/lib/cloud/instance/user-data.txt

# View cloud-init logs
sudo tail -f /var/log/cloud-init-output.log

# Check cloud-init status
sudo cloud-init status

# Verify tailscale status
sudo systemctl status tailscaled
sudo tailscale status
```

--------------------------------

### Tailscale Auth Key Loading Mechanisms

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Demonstrates the three ways to load an authentication key: directly, from a file, or via a command execution.

```hcl
auth_key = "tskey-abc123..."
# or
auth_key = "file:/etc/tailscale/auth.key"
# or
auth_key = "command:aws secretsmanager get-secret-value --secret-id tailscale-key --query SecretString"
```

--------------------------------

### Check Tailscale Daemon Status

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Verify the status of the `tailscaled` systemd service. If it's inactive after installation, further investigation is needed.

```bash
sudo systemctl status tailscaled
```

--------------------------------

### Configure Maximum Connection Retries

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Set the maximum number of retries for connecting to the control server during installation. Defaults to 3.

```hcl
max_retries = 5
```

--------------------------------

### Monitor Cloud-Init Output for Tailscale Up

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Continuously monitor the cloud-init output log in real-time to observe Tailscale up process and capture any immediate errors.

```bash
sudo tail -f /var/log/cloud-init-output.log
```

--------------------------------

### Inspect Rendered Cloud-Init Output

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/outputs-reference.md

Use this command to debug or review the cloud-init configuration before deployment. It decodes the base64 output and shows the first 50 lines.

```bash
terraform output -raw rendered | base64 -d | head -50
```

--------------------------------

### Advertise ACL Tags for Node

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Request specific ACL tags for this node. All tags must start with the 'tag:' prefix.

```hcl
advertise_tags = ["tag:eng", "tag:prod", "tag:monitor"]
```

--------------------------------

### Deploy Tailscale on AWS with Terraform

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/usage-examples.md

Initialize and apply a Terraform configuration for AWS. Ensure you have a Tailscale auth key.

```bash
cd examples/aws-ubuntu
terraform init
terraform apply -var="tailscale_auth_key=tskey-..."
```

--------------------------------

### Add Additional Cloud-Init Parts

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Use `additional_parts` to include custom scripts or configurations as additional cloud-init parts. Specify the filename, content type, content, and merge type.

```hcl
additional_parts = [
  {
    filename     = "custom-setup.sh"
    content_type = "text/x-shellscript"
    content      = file("${path.module}/scripts/custom-setup.sh")
  }
]
```

--------------------------------

### Configure Tailscale Module Retries

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Adjust the `max_retries` and `retry_delay` parameters in the Tailscale Terraform module to increase the number of installation attempts and the delay between them. This can help overcome transient network issues.

```hcl
module "tailscale_init" {
  source      = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key    = var.auth_key
  max_retries = 10           # Increase from default 3
  retry_delay = 10           # Increase from default 5 seconds
}
```

--------------------------------

### View Cloud-Init Logs

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Access the cloud-init output log to diagnose issues during the instance initialization phase. This log contains information about services and scripts executed by cloud-init.

```bash
sudo cat /var/log/cloud-init-output.log
```

--------------------------------

### Deploy Tailscale on DigitalOcean with Terraform

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/usage-examples.md

Initialize and apply a Terraform configuration for DigitalOcean. Requires a Tailscale auth key and a DigitalOcean token.

```bash
cd examples/do-ubuntu
terraform init
terraform apply -var="tailscale_auth_key=tskey-..." -var="digitalocean_token=dop_v1-..."
```

--------------------------------

### Optional Client Secret Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

Configure an optional client secret for authentication, which may be required depending on your identity provider setup. Supports plain value, file, or command loading.

```hcl
client_secret = "file:/etc/oauth/client-secret"
# or
client_secret = "command:vault read -field=secret secret/oauth/tailscale"
```

--------------------------------

### AWS EC2 Instance with Tailscale Initialization

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/outputs-reference.md

Use this snippet to deploy an AWS EC2 instance with Tailscale pre-configured. The `rendered` output from the module is directly compatible with `user_data_base64`.

```hcl
module "tailscale_init" {
  source = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = var.auth_key
  hostname = "my-instance"
}

resource "aws_instance" "example" {
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = "t3.micro"
  user_data_base64       = module.tailscale_init.rendered
  iam_instance_profile   = aws_iam_instance_profile.tailscale.name

  tags = {
    Name = "tailscale-client"
  }
}
```

--------------------------------

### Check Cloud-Init Status

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Examine the current status of cloud-init and analyze its execution details to identify any errors or issues during system initialization.

```bash
sudo cloud-init status
```

```bash
sudo cloud-init analyze show
```

--------------------------------

### Verify Auth Key Length

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Check the character count of your Tailscale authentication key to ensure it is complete and not truncated. A valid key should be approximately 64 characters long and start with 'tskey-'.

```bash
echo -n $TSK_KEY | wc -c  # Should be ~64 characters
```

--------------------------------

### View Systemd Drop-in Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Inspect the systemd drop-in configuration file for the Tailscale service to ensure it has been correctly applied by Terraform.

```bash
sudo cat /etc/systemd/system/tailscaled.service.d/terraform-cloudinit-tailscale.conf
```

--------------------------------

### Tailscale ID Token Loading Mechanisms

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Shows how to load an ID token from a file or by executing a command, used for workload identity federation.

```hcl
id_token = "file:/var/run/secrets/kubernetes.io/serviceaccount/token"
id_token = "command:gcloud auth identity-token"
```

--------------------------------

### Add Outbound HTTPS Rule to Security Group

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Configure an egress rule in your security group to permit outbound traffic on TCP port 443. This is a common solution when network connectivity prevents Tailscale installation.

```hcl
egress {
  from_port   = 443
  to_port     = 443
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
}
```

--------------------------------

### GCP Compute Engine Instance with Tailscale

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/README.md

Set up a GCP Compute Engine instance to join Tailscale using an identity token obtained via gcloud. The rendered cloud-init script is base64 decoded and applied to the instance's user-data.

```hcl
module "tailscale" {
  source    = "github.com/tailscale/terraform-cloudinit-tailscale"
  id_token  = "command:gcloud auth identity-token --audiences https://tailscale.com/api/v2"
  client_id = var.tailscale_client_id
}

resource "google_compute_instance" "vm" {
  metadata = {
    user-data = base64decode(module.tailscale.rendered)
  }
}
```

--------------------------------

### Define a cloud-init part for UDP offload optimization

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

Defines a shell script part for optimizing UDP handling on kernel 6.2+. The content is loaded from a file within the module.

```hcl
part {
  filename     = "udp_offloads.sh"
  content_type = "text/x-shellscript"
  content      = file("${path.module}/files/udp_offloads.sh")
}
```

--------------------------------

### Inspect Network Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Examine the system's routing table for both IPv4 and IPv6, and check for listening sockets related to Tailscale. This is useful for diagnosing network routing and port issues.

```bash
ip route show
ip -6 route show
ss -tlnup | grep -E "(tailscale|41641)"
```

--------------------------------

### Verify EC2 Security Group Egress Rules

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Check EC2 security group egress rules to ensure outbound HTTPS traffic on port 443 is allowed. This is crucial for the Tailscale installer script to download successfully.

```bash
# On EC2, verify outbound rule allows port 443
aws ec2 describe-security-groups --group-ids sg-xxxxx
```

--------------------------------

### Configure Custom Login Server

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Specify a custom or self-hosted Tailscale control server URL. This is useful for private deployments.

```hcl
login_server = "https://controlplane.example.com"
```

--------------------------------

### AWS Secrets Manager Example with Terraform

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

This Terraform configuration demonstrates retrieving a Tailscale auth key from AWS Secrets Manager using a command-based approach. It defines data sources for the secret and then uses the secret's name in the module invocation.

```hcl
data "aws_secretsmanager_secret" "tailscale_auth" {
  name = "tailscale/auth-key"
}

data "aws_secretsmanager_secret_version" "tailscale_auth" {
  secret_id = data.aws_secretsmanager_secret.tailscale_auth.id
}

module "tailscale_init" {
  source   = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = "command:aws secretsmanager get-secret-value --secret-id ${data.aws_secretsmanager_secret.tailscale_auth.name} --query SecretString --output text"
}
```

--------------------------------

### Check Tailscale State Directory Permissions

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Verify the ownership and permissions of the Tailscale state directory (`/var/lib/tailscale/`). Incorrect permissions can prevent the daemon from accessing necessary files.

```bash
ls -la /var/lib/tailscale/
```

--------------------------------

### Add User-Defined Cloud-Init Parts

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

This snippet demonstrates how to use a dynamic block to append custom parts to the cloud-init configuration. It iterates over a variable `additional_parts` to define filenames, content types, and content for each part.

```hcl
dynamic "part" {
  for_each = var.additional_parts
  content {
    filename     = part.value.filename
    content_type = part.value.content_type
    content      = part.value.content
  }
}
```

--------------------------------

### Module Composition Structure

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/module-overview.md

Illustrates the directory structure and main files within the terraform-cloudinit-tailscale module. This helps understand the organization of Terraform code, scripts, and templates.

```HCL
terraform-cloudinit-tailscale/
├── main.tf               # Cloud-init config composition with locals validation
├── variables.tf          # All input variables and validation rules
├── outputs.tf            # Output: rendered cloud-init data
├── versions.tf           # Terraform >= 1.0, cloudinit >= 2.0
├── files/
│   ├── ip_forwarding.sh
│   └── udp_offloads.sh
├── templates/
│   ├── install_tailscale.sh.tmpl
│   ├── configure_tailscaled.sh.tmpl
│   └── setup_tailscale.sh.tmpl
└── examples/
    ├── aws-ubuntu/       # Complete AWS EC2 + security group + VPC example
    └── do-ubuntu/        # DigitalOcean Ubuntu example
```

--------------------------------

### Script Flags for Tailscale Initialization

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

These bash commands add flags with values for ID token, client ID, and client secret to a script. Use this for setting up Tailscale via script.

```bash
add_flag_with_value "id-token" "${ID_TOKEN}"
add_flag_with_value "client-id" "${CLIENT_ID}"
add_flag_with_value "client-secret" "${CLIENT_SECRET}"
```

--------------------------------

### Configure gzip compression for cloud-init output

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

Set whether to gzip-compress the cloud-init output before base64 encoding. This is often inherited from a variable.

```hcl
gzip = var.gzip
```

--------------------------------

### Configure Tailscaled Daemon with Systemd Drop-in

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/template-scripts.md

This script configures the tailscaled daemon by creating a systemd drop-in file. It dynamically builds flags based on template variables and restarts the service if it's active. Use this to apply daemon-level settings like port, socket path, and state location.

```bash
#!/bin/sh

# Configure tailscaled daemon preferences using systemd drop-in
echo "Configuring tailscaled daemon preferences..."

# Create systemd drop-in directory
sudo mkdir -p /etc/systemd/system/tailscaled.service.d

# Build FLAGS string from provided configuration
FLAGS=""

# Conditionally add each flag based on template variable values
# ...

# Create systemd drop-in configuration
cat << EOF | sudo tee /etc/systemd/system/tailscaled.service.d/terraform-cloudinit-tailscale.conf
[Service]
ExecStart=
ExecStart=/usr/sbin/tailscaled $STATE_FLAG $SOCKET_FLAG $FLAGS
$STATEDIR_OVERRIDE
EOF

# Reload systemd and restart tailscaled if it was already running
sudo systemctl daemon-reload

if sudo systemctl is-active --quiet tailscaled; then
  echo "Restarting tailscaled with new configuration..."
  sudo systemctl restart tailscaled
else
  echo "tailscaled configuration updated, will be applied on next start"
fi

```

--------------------------------

### Resolve Value Prefixes

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/template-scripts.md

Demonstrates how the `resolve_value` helper function handles different input prefixes. It can return a direct string, the content of a file, or the output of a command.

```bash
resolve_value "my-auth-key"           # Returns: my-auth-key
resolve_value "file:/etc/auth.key"    # Returns: Content of /etc/auth.key
resolve_value "command:aws get-key"   # Returns: Output of `aws get-key`
```

--------------------------------

### Configure Tailscale SOCKS5 Server

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Sets the listen address for an optional SOCKS5 server. Format: "[ip]:port".

```hcl
tailscaled_flag_socks5_server = "localhost:1080"
```

--------------------------------

### Configure Tailscale Configuration File

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Sets the path to a configuration file or uses the EC2 VM's user-data as the config.

```hcl
tailscaled_flag_config = "/etc/tailscale/config.yaml"
tailscaled_flag_config = "vm:user-data"
```

--------------------------------

### Define cloud-init part for Tailscaled daemon configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/cloudinit-data-source.md

Defines a shell script part to configure the tailscaled systemd service using a template file. It accepts various TAILSCALED_FLAG variables to customize the daemon's behavior.

```hcl
part {
  filename     = "configure_tailscaled.sh"
  content_type = "text/x-shellscript"
  content = templatefile("${path.module}/templates/configure_tailscaled.sh.tmpl", {
    TAILSCALED_FLAG_BIRD_SOCKET                = var.tailscaled_flag_bird_socket
    TAILSCALED_FLAG_CONFIG                     = var.tailscaled_flag_config
    TAILSCALED_FLAG_DEBUG                      = var.tailscaled_flag_debug
    TAILSCALED_FLAG_ENCRYPT_STATE              = var.tailscaled_flag_encrypt_state
    TAILSCALED_FLAG_NO_LOGS_NO_SUPPORT         = var.tailscaled_flag_no_logs_no_support
    TAILSCALED_FLAG_OUTBOUND_HTTP_PROXY_LISTEN = var.tailscaled_flag_outbound_http_proxy_listen
    TAILSCALED_FLAG_PORT                       = var.tailscaled_flag_port
    TAILSCALED_FLAG_SOCKET                     = var.tailscaled_flag_socket
    TAILSCALED_FLAG_SOCKS5_SERVER              = var.tailscaled_flag_socks5_server
    TAILSCALED_FLAG_STATE                      = var.tailscaled_flag_state
    TAILSCALED_FLAG_STATEDIR                   = var.tailscaled_flag_statedir
    TAILSCALED_FLAG_TUN                        = var.tailscaled_flag_tun
    TAILSCALED_FLAG_VERBOSE                    = var.tailscaled_flag_verbose
  })
}
```

--------------------------------

### Check Tailscale Socket Directory

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

List the contents of the Tailscale socket directory to verify its presence and permissions.

```bash
ls -la /run/tailscale/
```

--------------------------------

### Manually Retry Tailscale Up

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Execute the `tailscale up` command manually with your authentication key. This is useful for testing fixes after diagnosing issues in the cloud-init logs.

```bash
sudo tailscale up --authkey=$AUTHKEY
```

--------------------------------

### Tailscale Client Secret Loading Mechanisms

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Illustrates loading a client secret from a file or via a command, used for OAuth authkey generation.

```hcl
client_secret = "file:/etc/oauth/secret"
client_secret = "command:vault read -field=password secret/oauth/tailscale"
```

--------------------------------

### AWS EC2 Instance with Tailscale

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/README.md

Configure an AWS EC2 instance to automatically join Tailscale using an auth key. The rendered cloud-init script is passed via user_data_base64.

```hcl
module "tailscale" {
  source   = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = var.auth_key
  hostname = "web-server"
}

resource "aws_instance" "server" {
  user_data_base64 = module.tailscale.rendered
  # ... other config
}
```

--------------------------------

### Optimize UDP Offload for Kernel 6.2+

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/template-scripts.md

Optimizes UDP GRO forwarding for kernel 6.2+ using ethtool. It checks for ethtool, detects the kernel version and network device, and applies optimizations if the kernel is 6.2 or later. The script gracefully skips if ethtool is not found or the kernel is older.

```shell
#!/bin/sh

# Ensure ethtool is installed
if ! command -v ethtool >/dev/null 2>&1;
then
    echo "ethtool not found. Skipping network optimizations."
    exit 0
fi

# Get the current kernel version
current_version=$(uname -r | cut -d'-' -f1 | cut -d'.' -f1,2)

# Define the minimum required version
required_version="6.2"

# Detect the default network device. See https://tailscale.com/s/ethtool-config-udp-grow for more information.
get_default_netdev() {
    # Try ip route show first
    NETDEV=$(ip route show default | awk '/default/ {print $5}' | head -n1)
    
    # If ip route show didn't work, try using /sys/class/net
    if [ -z "$NETDEV" ]; then
        for dev in /sys/class/net/*;
        do
            if [ "$dev" != "/sys/class/net/lo" ]; then
                NETDEV=$(basename "$dev")
                break
            fi
        done
    fi
    
    # If we still don't have a network device, use a fallback
    if [ -z "$NETDEV" ]; then
        echo "eth0"  # Fallback to a common default
    else
        echo "$NETDEV"
    fi
}

# Compare versions
if [ "$(printf '%s
' "$current_version" "$required_version" | sort -V | tail -n1)" = "$current_version" ]; then
    echo "Kernel version is 6.2 or later. Enabling optimizations..."
    NETDEV=$(get_default_netdev)
    if [ -n "$NETDEV" ]; then
        echo "Using network device: $NETDEV"
        sudo ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off
    else
        echo "Error: Unable to determine network device. Exiting."
        exit 1
    fi
else
    echo "Kernel version is less than 6.2. Exiting."
    exit 0
fi
```

--------------------------------

### Tailscale Authentication Methods

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/README.md

Demonstrates different methods for authenticating Tailscale within the module. Choose one option based on your environment.

```hcl
# Option 1: Direct auth key
auth_key = "tskey-abc123..."

# Option 2: Workload identity (Kubernetes)
id_token  = "file:/var/run/secrets/kubernetes.io/serviceaccount/token"
client_id = "my-k8s-client-id"

# Option 3: OAuth with audience
audience  = "https://tailscale.com/api/v2"
client_id = "my-oauth-client-id"
```

--------------------------------

### Check DNS Resolution Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Inspect the contents of /etc/resolv.conf to verify the DNS server configuration on the instance. Incorrect DNS settings can prevent the instance from resolving Tailscale's domain.

```bash
cat /etc/resolv.conf
```

--------------------------------

### Apply Terraform Configuration

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/usage-examples.md

Execute this bash command to deploy the AWS EC2 instance configured as a Tailscale exit node. Ensure you replace the placeholder with your actual Tailscale authentication key.

```bash
terraform apply -var="tailscale_auth_key=tskey-abc123..."
```

--------------------------------

### Direct Authorization Key - File Loading

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

Load the authorization key from a file by prefixing the path with 'file:'. This is useful for integrating with secret management systems that expose keys as files.

```hcl
module "tailscale_init" {
  source   = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = "file:/path/to/auth.key"
}
```

--------------------------------

### Google Cloud Compute Engine Instance with Tailscale

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/outputs-reference.md

Deploy a Google Cloud Compute Engine instance with Tailscale. The `user-data` metadata requires the base64-decoded output from the module.

```hcl
module "tailscale_init" {
  source = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = var.auth_key
  hostname = "my-gce-instance"
}

resource "google_compute_instance" "example" {
  name         = "tailscale-client"
  machine_type = "e2-medium"

  metadata = {
    user-data = base64decode(module.tailscale_init.rendered)
  }

  boot_disk {
    initialize_params {
      image = data.google_compute_image.ubuntu.self_link
    }
  }
}
```

--------------------------------

### Terraform Apply Command for GCP Deployment

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/usage-examples.md

This command applies the Terraform configuration to create the GCP resources. Ensure you replace placeholder values with your actual project ID and Tailscale client ID.

```bash
terraform apply \
  -var="gcp_project=my-project" \
  -var="tailscale_client_id=my-gcp-client-id"
```

--------------------------------

### Kubernetes Pod with Tailscale

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/README.md

Integrate Tailscale into a Kubernetes pod using an ID token for authentication. The cloud-init script is intended to be decoded and executed within the pod's spec.

```hcl
module "tailscale" {
  source    = "github.com/tailscale/terraform-cloudinit-tailscale"
  id_token  = "file:/var/run/secrets/kubernetes.io/serviceaccount/token"
  client_id = var.tailscale_client_id
}

resource "kubernetes_pod" "app" {
  spec {
    # Decode and execute the cloud-init script
  }
}
```

--------------------------------

### Configure Tailscale TUN Interface

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/inputs-reference.md

Sets the tunnel interface name. Use 'userspace-networking' for beta userspace networking.

```hcl
tailscaled_flag_tun = "userspace-networking"
```

--------------------------------

### Cloud-Init Script - Auth Key Flag

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

This bash snippet shows how the 'authkey' flag is added with the resolved authorization key value within the cloud-init script. It utilizes a helper function to handle different loading methods.

```bash
add_flag_with_value "authkey" "${AUTH_KEY}"
```

--------------------------------

### Cloud-Init Script - Value Resolution Helper

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/authentication-methods.md

The 'resolve_value' function in the cloud-init script handles different authorization key input formats: 'file:' for file loading and 'command:' for command execution. It strips newline characters from the output.

```bash
resolve_value() {
  local value="$1"
  case "$value" in
    file:*) 
      cat "$${value#file:}" | tr -d '\n'
      ;;
    command:*) 
      eval "$${value#command:}" | tr -d '\n'
      ;;
    *) 
      printf '%s' "$value"
      ;;
  esac
}
```

--------------------------------

### Enable IP Forwarding

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/template-scripts.md

Enables IPv4 and IPv6 packet forwarding at the kernel level. This is required for nodes acting as route advertisers or exit nodes. It runs as root via cloud-init and sets persistent sysctl values.

```shell
#!/bin/sh
echo "set required IP forwarding kernel values"
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
```

--------------------------------

### DigitalOcean Droplet with Gzip Compression for Tailscale

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/outputs-reference.md

Deploy a DigitalOcean droplet with Tailscale using gzip compression. Set `gzip = true` in the module and pass the `rendered` output directly to `user_data`.

```hcl
module "tailscale_init" {
  source = "github.com/tailscale/terraform-cloudinit-tailscale"
  auth_key = var.auth_key
  gzip     = true      # Enable gzip compression
  hostname = "my-droplet"
}

resource "digitalocean_droplet" "example" {
  name      = "tailscale-client"
  region    = "nyc3"
  size      = "s-1vcpu-512mb-10gb"
  image     = "ubuntu-22-04-x64"
  user_data = module.tailscale_init.rendered
}
```

--------------------------------

### Diagnose Exit Node Not Working

Source: https://github.com/tailscale/terraform-cloudinit-tailscale/blob/main/_autodocs/troubleshooting-guide.md

Verify exit node status and settings. These commands help check if the exit node is correctly configured and if traffic is being routed through it. Ensure 'advertise_exit_node' is true on the exit node and 'accept_routes' is true on the client.

```bash
# Check exit node status
tailscale status | grep -i exit
```

```bash
# Verify setting applied
sudo tailscale set --exit-node=""  # Disable to test
sudo tailscale set --exit-node=<ip>  # Re-enable
```

```bash
# Check if traffic is routing
curl ifconfig.me  # Should show exit node's IP
```

```hcl
advertise_exit_node = true
```

```hcl
accept_routes = true
```

```bash
# Get correct IP
tailscale status | grep exit
```
Tokens:
Raw