Merge e26baadc8f into cb9a5d6d69

security/tailscale/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		tailscale
-PLUGIN_VERSION=		1.4
+PLUGIN_VERSION=		1.5
 PLUGIN_COMMENT=		VPN mesh securely connecting clients using WireGuard
 PLUGIN_DEPENDS=		tailscale
 PLUGIN_MAINTAINER=	sam@sheridan.uk

security/tailscale/pkg-descr

@@ -6,6 +6,12 @@ https://tailscale.com/
 Plugin Changelog
 ================
 
+1.5
+
+* add tailscale set command support
+* add relay server port setting (--relay-server-port)
+* add web client option (--webclient)
+
 1.4
 
 * set pre-auth key field in UI to optional, enables registration via pre-auth key or AuthURL from status page

security/tailscale/src/etc/rc.d/tailscaled_set

@@ -0,0 +1,37 @@
+#!/bin/sh
+
+# PROVIDE: tailscaled_set
+# REQUIRE: tailscaled
+#
+# Applies "tailscale set" configuration after tailscaled is running.
+# Sources tailscaled_set_args from /etc/rc.conf.d/tailscaled_set.
+
+. /etc/rc.subr
+
+name="tailscaled_set"
+rcvar="${name}_enable"
+start_cmd="${name}_start"
+stop_cmd=":"
+
+load_rc_config $name
+: ${tailscaled_set_enable:="NO"}
+
+tailscaled_set_start()
+{
+	# Wait for tailscaled to become ready (up to 15 seconds)
+	local i=0
+	while ! /usr/local/bin/tailscale status > /dev/null 2>&1; do
+		sleep 1
+		i=$((i + 1))
+		if [ $i -ge 15 ]; then
+			echo "tailscaled_set: tailscaled never became ready"
+			return 1
+		fi
+	done
+
+	/usr/local/bin/tailscale set ${tailscaled_set_args}
+}
+
+run_rc_command "$1"
+
+

security/tailscale/src/opnsense/mvc/app/controllers/OPNsense/Tailscale/forms/settings.xml

@@ -18,6 +18,20 @@
         <type>text</type>
         <help>UDP port to listen on for WireGuard and peer-to-peer traffic.</help>
     </field>
+    <field>
+        <id>settings.relayServerPort</id>
+        <label>Relay Server Port</label>
+        <type>text</type>
+        <advanced>true</advanced>
+        <help>Specify a UDP port to accept peer relay connections on. UDP port number (0 will pick a random unused port) for the relay server to bind to, on all interfaces, or empty string to disable relay server functionality.</help>
+    </field>
+    <field>
+        <id>settings.webclient</id>
+        <label>Web Client</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help>Expose the web interface to your tailnet persistently in the background on port :5252.</help>
+    </field>
     <field>
         <id>settings.acceptDNS</id>
         <label>Accept DNS</label>

security/tailscale/src/opnsense/mvc/app/models/OPNsense/Tailscale/Settings.xml

@@ -15,6 +15,13 @@
             <Default>41641</Default>
             <Required>Y</Required>
         </listenPort>
+        <relayServerPort type="PortField">
+            <Required>N</Required>
+        </relayServerPort>
+        <webclient type="BooleanField">
+            <Default>0</Default>
+            <Required>Y</Required>
+        </webclient>
         <acceptDNS type="BooleanField">
             <Default>1</Default>
             <Required>Y</Required>

security/tailscale/src/opnsense/service/conf/actions.d/actions_tailscale.conf

@@ -1,5 +1,5 @@
 [start]
-command:/usr/local/etc/rc.d/tailscaled start
+command:/usr/local/etc/rc.d/tailscaled start && /usr/local/etc/rc.d/tailscaled_set start; exit 0
 type: script
 message: starting tailscale service
 
@@ -14,7 +14,7 @@ type: script_output
 message: tailscaled status
 
 [restart]
-command:/usr/local/etc/rc.d/tailscaled restart
+command:/usr/local/etc/rc.d/tailscaled restart && /usr/local/etc/rc.d/tailscaled_set start; exit 0
 type: script
 message: restarting tailscale services
 

security/tailscale/src/opnsense/service/templates/OPNsense/Tailscale/+TARGETS

@@ -1 +1,2 @@
-rc.conf.d:/etc/rc.conf.d/tailscaled
+rc.conf-up.d:/etc/rc.conf.d/tailscaled
+rc.conf-set.d:/etc/rc.conf.d/tailscaled_set

security/tailscale/src/opnsense/service/templates/OPNsense/Tailscale/rc.conf-set.d

@@ -0,0 +1,17 @@
+# DO NOT EDIT
+# THIS FILE IS AUTOMATICALLY GENERATED - ANY CHANGES WILL BE OVERWRITTEN
+#
+{%  if not helpers.empty('OPNsense.tailscale.settings.enabled')  %}
+tailscaled_set_enable="YES"
+{%    set set_args = [] %}
+{%      do set_args.append("--relay-server-port=" + OPNsense.tailscale.settings.relayServerPort|default("")) %}
+{%    if helpers.exists('OPNsense.tailscale.settings.webclient') and OPNsense.tailscale.settings.webclient|default("0") == "1" %}
+{%      do set_args.append("--webclient") %}
+{%    else %}
+{%      do set_args.append("--webclient=false") %}
+{%    endif %}
+tailscaled_set_args="{{ set_args|join(' ') }}"
+{%  else %}
+tailscaled_set_enable="NO"
+{%  endif %}
+