7 Commits

Include renames

Author	SHA1	Message	Date
Lumpiasty	315fd630e3	enable IP forwarding via entrypoint (fixes IPv6 subnet routes) ... tailscaled does not reliably enable IPv6 forwarding inside a container network namespace ('IPv6 forwarding is disabled'), so advertised IPv6 subnet routes silently fail. Add a tiny entrypoint.sh that sets net.ipv4.ip_forward and net.ipv6.conf.all.forwarding (writable inside a RouterOS container netns), then exec's tailscaled. Built in the builder stage so it stays in the single /usr/local/bin COPY layer. Verified: privileged run flips v6 forwarding 0->1 and exec's tailscaled with CMD args intact.	2026-06-02 16:06:10 +02:00
Lumpiasty	1bc10bcb6e	include ipnbus so 'tailscale up' waits and prints login URL ... Without ipnbus, 'tailscale up' fires config at the daemon and returns immediately ('built with ts_omit_ipnbus; not waiting for completion') without printing the auth URL or confirming success. Add it to the allowlist so interactive 'up' behaves normally.	2026-06-02 15:54:52 +02:00
Lumpiasty	3cf6a1faab	Manual refactor of docs	2026-06-01 20:23:28 +02:00
Lumpiasty	ea0d90d8f0	automerge tailscale + component patch updates behind a PR build ... Add .woodpecker/pr-build.yaml: builds all three arches (dry-run, no push) on PRs and pushes to main, reporting status to Gitea. This is the gate for automerge. renovate.json automerge rules (platformAutomerge, merged only after the PR build passes): - tailscale stable patch AND minor - Go/Alpine/busybox PATCH only - base-image digest refreshes Minor/major of build deps and tooling stay manual. Move pinDigests into a dockerfile packageRule (top-level dockerfile.* is deprecated). Document the automerge policy and its caveat (PR build proves build-only, not runtime) in DESIGN.md.	2026-05-29 15:49:47 +02:00
Lumpiasty	7d1b9f99a5	correct extracted-size measurement guidance ... The ~7 MB seen via 'du' inside the container is RouterOS block-allocation rounding (a 3 MB file occupies ~6 MB of blocks), NOT layer duplication — verified: the published image carries tailscale.combined in exactly one layer, and the real flash cost is ~3.7 MiB (free-hdd-space delta). Fix the docs to measure on-flash footprint via free-hdd-space delta, not du; clarify the overlayfs section is about keeping the image clean (still valid best practice) and explicitly decouple it from the du number.	2026-05-29 04:49:54 +02:00
Lumpiasty	7a6efb52ec	include unixsocketidentity feature (fixes CLI access denied) ... The --extra-small baseline omits unixsocketidentity, but without it the localapi cannot verify a request came over the trusted unix socket, so PermitRead/PermitWrite are always false and every CLI call (status, up, set, ...) returns 'access denied' (tailscale/tailscale#17873). Add it to the opt-in allowlist. Negligible size cost (~3.55 MB unchanged); the CLI is non-functional without it.	2026-05-29 04:33:02 +02:00
Lumpiasty	e0cbaee48b	split docs into README + USAGE/DEVELOPMENT/DESIGN ... README shrinks to a repo intro with pointers. Separate the three audiences: - docs/USAGE.md deploy the prebuilt image on RouterOS + operate it - docs/DEVELOPMENT.md build, local test, version bump, cut releases - docs/DESIGN.md size optimizations, feature allowlist, why the updater and netmap disk-cache are removed, flash-wear protection, versioning/release architecture, the overlayfs layer-duplication gotcha, dependency pinning	2026-05-29 04:24:12 +02:00