62 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Lumpiasty	c5e1c8be24	Merge pull request 'chore(deps): update docker/dockerfile docker tag to v1.26.0' (#48) from renovate/docker-dockerfile-1.x into main ... Reviewed-on: #48	2026-08-22 22:46:37 +00:00
Lumpiasty	8363cfe970	Merge pull request 'chore(deps): update docker/dockerfile docker tag to v1.25.0' (#37) from renovate/docker-dockerfile-1.x into main ... Reviewed-on: #37	2026-06-21 01:49:00 +00:00
Lumpiasty	0fa1df814f	Merge pull request 'chore(deps): update quay.io/openbao/openbao docker tag to v2.5.5' (#36) from renovate/quay.io-openbao-openbao-2.x into main ... Reviewed-on: #36	2026-06-21 01:28:43 +00:00
Lumpiasty	a396d20a18	Merge pull request 'Pin only major version of renovate' (#39) from chore/renovate-autoupdate into main ... Reviewed-on: #39	2026-06-21 01:16:05 +00:00
Lumpiasty	0753c314a9	Pin only major version of renovate	2026-06-21 03:11:38 +02:00
Lumpiasty	8092d27cb9	Merge pull request 'chore(deps): update renovate/renovate docker tag to v43.224.1' (#27) from renovate/renovate-renovate-43.x into main ... Reviewed-on: #27	2026-06-16 22:54:14 +00:00
Lumpiasty	5bb34731cb	Merge pull request 'chore(deps): update alpine/git docker tag to v2.54.0' (#26) from renovate/alpine-git-2.x into main ... Reviewed-on: #26	2026-06-16 22:53:28 +00:00
Lumpiasty	2e2ccb4f3e	Merge pull request 'add peer api server to remedy DNS' (#33) from fix/add-peerapiserver into main ... Reviewed-on: #33	2026-06-16 22:34:43 +00:00
Lumpiasty	e009040cb4	add peer api server to remedy DNS	2026-06-17 00:30:46 +02:00
Lumpiasty	492230a746	Merge pull request 'Enable netstack to hopefully fix DNS' (#31) from fix/add-gvisor-netstack into main ... Reviewed-on: #31	2026-06-16 21:41:22 +00:00
Lumpiasty	0a8a40fdb8	add documentation on netstack decision	2026-06-16 23:37:53 +02:00
Lumpiasty	7482ddb832	Enable netstack to hopefully fix DNS	2026-06-16 23:32:03 +02:00
Lumpiasty	da2b3b5d3a	Merge pull request 'Remove docker build cache' (#32) from fix/remove-docker-build-cache into main ... Reviewed-on: #32	2026-06-16 21:31:26 +00:00
Lumpiasty	d03c7d3da7	Remove docker build cache	2026-06-16 23:18:18 +02:00
Lumpiasty	06083dcf58	Merge pull request 'Speed up build pipeline' (#29) from feat/busybox-crosscompile into main ... Reviewed-on: #29	2026-06-16 00:12:58 +00:00
Lumpiasty	ff60452758	Empty commit to trigger CI	2026-06-16 01:59:47 +02:00
Lumpiasty	524b83d911	Docker build caching	2026-06-16 01:57:20 +02:00
Lumpiasty	8fee49bf09	cross compile busybox instead of emulation	2026-06-16 01:50:50 +02:00
Lumpiasty	b8dd344a93	Merge pull request 'Add workaround for panic with ts_omit_netstack' (#28) from fix/invertgsochecksum into main ... Reviewed-on: #28	2026-06-15 23:24:55 +00:00
Lumpiasty	3ff4666495	Add workaround for panic with ts_omit_netstack	2026-06-16 01:16:45 +02:00
Lumpiasty	43f913cffc	Merge pull request 'Don't rebuild image on paths not included in image' (#25) from fix/skip-builds into main ... Reviewed-on: #25	2026-06-12 01:17:34 +00:00
Lumpiasty	43698b733d	Merge pull request 'Add restart policy' (#24) from feat/restart-policy into main ... Reviewed-on: #24	2026-06-12 01:11:38 +00:00
Lumpiasty	ee5ca68fc3	Don't rebuild image on non-included paths	2026-06-12 03:06:58 +02:00
Lumpiasty	8a550f23d8	Add restart policy	2026-06-12 03:02:50 +02:00
Lumpiasty	cae5aca3b3	Merge pull request 'Fix renovate identity' (#22) from fix/renovate-identity into main ... Reviewed-on: #22	2026-06-12 00:37:23 +00:00
Lumpiasty	16fd2170db	Merge pull request 'chore(deps): update busybox docker tag to v1.38.0' (#17) from renovate/busybox-1.x into main ... Reviewed-on: #17	2026-06-12 00:30:20 +00:00
Lumpiasty	b7f3bdbbc6	Merge pull request 'chore(deps): update alpine docker tag to v3.24.0' (#18) from renovate/alpine-3.x into main ... Reviewed-on: #18	2026-06-12 00:30:12 +00:00
Lumpiasty	c2fee4d239	Merge pull request 'chore(deps): update renovate/renovate docker tag to v43.220.0' (#12) from renovate/renovate-renovate-43.x into main ... Reviewed-on: #12	2026-06-12 00:30:02 +00:00
Lumpiasty	cb70afb345	Fix renovate identity	2026-06-12 02:27:47 +02:00
Lumpiasty	568f114c6e	Merge pull request 'State dir clarifications' (#21) from feat/state-dir-docs into main ... Reviewed-on: #21	2026-06-12 00:17:57 +00:00
Lumpiasty	6ba07dd23b	State dir clarifications	2026-06-12 02:09:51 +02:00
Lumpiasty	3ae0ab3075	Merge pull request 'Log verbosity filtering feature' (#20) from feat/verbosity-filter into main ... Reviewed-on: #20	2026-06-11 23:34:17 +00:00
Lumpiasty	ebf011908a	Log verbosity filtering feature	2026-06-12 01:25:44 +02:00
Lumpiasty	bd6c6cf4b2	Merge pull request 'fix: preserve v prefix for tailscale version' (#15) from fix/renovate-datasource into main ... Reviewed-on: #15	2026-06-02 21:47:13 +00:00
Lumpiasty	1a8b065283	fix: preserve v prefix for tailscale version	2026-06-02 23:46:51 +02:00
Lumpiasty	7dacdccc01	Merge pull request 'make renovate recognise Tailscale version' (#13) from fix/renovate-datasource into main ... Reviewed-on: #13	2026-06-02 21:33:31 +00:00
Lumpiasty	8a34988dd4	make renovate recognise Tailscale version	2026-06-02 23:33:05 +02:00
Lumpiasty	6e5004aa0e	Merge pull request 'chore(deps): update renovate/renovate docker tag to v43.207.4' (#10) from renovate/renovate-renovate-43.x into main ... Reviewed-on: #10	2026-06-02 15:25:55 +00:00
Lumpiasty	57df037137	Merge pull request 'Fix tailscale up by building ipnbus and enable ip forwarding in entrypoint' (#11) from fix/forwarding-and-ipnbus into main ... Reviewed-on: #11	2026-06-02 14:15:40 +00:00
Lumpiasty	315fd630e3	enable IP forwarding via entrypoint (fixes IPv6 subnet routes) ... tailscaled does not reliably enable IPv6 forwarding inside a container network namespace ('IPv6 forwarding is disabled'), so advertised IPv6 subnet routes silently fail. Add a tiny entrypoint.sh that sets net.ipv4.ip_forward and net.ipv6.conf.all.forwarding (writable inside a RouterOS container netns), then exec's tailscaled. Built in the builder stage so it stays in the single /usr/local/bin COPY layer. Verified: privileged run flips v6 forwarding 0->1 and exec's tailscaled with CMD args intact.	2026-06-02 16:06:10 +02:00
Lumpiasty	1bc10bcb6e	include ipnbus so 'tailscale up' waits and prints login URL ... Without ipnbus, 'tailscale up' fires config at the daemon and returns immediately ('built with ts_omit_ipnbus; not waiting for completion') without printing the auth URL or confirming success. Add it to the allowlist so interactive 'up' behaves normally.	2026-06-02 15:54:52 +02:00
Lumpiasty	9ff1623958	Merge pull request 'Refactor of docs' (#9) from refac/readme-cleanup into main ... Reviewed-on: #9	2026-06-01 18:41:46 +00:00
Lumpiasty	94427bd3f4	Merge pull request 'chore(deps): update renovate/renovate docker tag to v43.205.3' (#7) from renovate/renovate-renovate-43.x into main ... Reviewed-on: #7	2026-06-01 18:27:32 +00:00
Lumpiasty	37938ac471	Merge pull request 'chore(deps): update alpine/git docker tag to v2.52.0' (#6) from renovate/alpine-git-2.x into main ... Reviewed-on: #6	2026-06-01 18:27:24 +00:00
Lumpiasty	2ce364ea15	Merge pull request 'chore(deps): update alpine docker tag to v3.23.4' (#5) from renovate/alpine-3.x into main ... Reviewed-on: #5	2026-06-01 18:27:07 +00:00
Lumpiasty	3057685588	Merge pull request 'chore(deps): update woodpeckerci/plugin-docker-buildx docker tag to v6' (#8) from renovate/woodpeckerci-plugin-docker-buildx-6.x into main ... Reviewed-on: #8	2026-06-01 18:27:02 +00:00
Lumpiasty	3cf6a1faab	Manual refactor of docs	2026-06-01 20:23:28 +02:00
Lumpiasty	f69263c480	Merge pull request 'test pr-build' (#4) from test/pr-build-trigger into main ... Reviewed-on: #4	2026-05-29 14:25:00 +00:00
Lumpiasty	ae8c114109	trigger pr-build	2026-05-29 16:11:03 +02:00
Lumpiasty	ea0d90d8f0	automerge tailscale + component patch updates behind a PR build ... Add .woodpecker/pr-build.yaml: builds all three arches (dry-run, no push) on PRs and pushes to main, reporting status to Gitea. This is the gate for automerge. renovate.json automerge rules (platformAutomerge, merged only after the PR build passes): - tailscale stable patch AND minor - Go/Alpine/busybox PATCH only - base-image digest refreshes Minor/major of build deps and tooling stay manual. Move pinDigests into a dockerfile packageRule (top-level dockerfile.* is deprecated). Document the automerge policy and its caveat (PR build proves build-only, not runtime) in DESIGN.md.	2026-05-29 15:49:47 +02:00
Lumpiasty	7d1b9f99a5	correct extracted-size measurement guidance ... The ~7 MB seen via 'du' inside the container is RouterOS block-allocation rounding (a 3 MB file occupies ~6 MB of blocks), NOT layer duplication — verified: the published image carries tailscale.combined in exactly one layer, and the real flash cost is ~3.7 MiB (free-hdd-space delta). Fix the docs to measure on-flash footprint via free-hdd-space delta, not du; clarify the overlayfs section is about keeping the image clean (still valid best practice) and explicitly decouple it from the du number.	2026-05-29 04:49:54 +02:00
Lumpiasty	7a6efb52ec	include unixsocketidentity feature (fixes CLI access denied) ... The --extra-small baseline omits unixsocketidentity, but without it the localapi cannot verify a request came over the trusted unix socket, so PermitRead/PermitWrite are always false and every CLI call (status, up, set, ...) returns 'access denied' (tailscale/tailscale#17873). Add it to the opt-in allowlist. Negligible size cost (~3.55 MB unchanged); the CLI is non-functional without it.	2026-05-29 04:33:02 +02:00
Lumpiasty	e0cbaee48b	split docs into README + USAGE/DEVELOPMENT/DESIGN ... README shrinks to a repo intro with pointers. Separate the three audiences: - docs/USAGE.md deploy the prebuilt image on RouterOS + operate it - docs/DEVELOPMENT.md build, local test, version bump, cut releases - docs/DESIGN.md size optimizations, feature allowlist, why the updater and netmap disk-cache are removed, flash-wear protection, versioning/release architecture, the overlayfs layer-duplication gotcha, dependency pinning	2026-05-29 04:24:12 +02:00
Lumpiasty	01057e78b8	add RouterOS auto-update script ... Scheduled script that recreates the container only when the published :stable image digest actually changed — no wasteful re-pulls. Compares the registry manifest digest (anonymous Gitea token + :deserialize for the token JSON) against a stored digest; recreates + records on change. Verified end-to-end on RouterOS 7.21.2: - token URL omits &service= (& is RouterOS's AND operator and breaks url=) - header digest parsed case-insensitively from the flat http-headers string - container identified by name; mounts via mountlists (list=, not name=) - stop/start waits retry the operation (remove/start) rather than polling a status string, which never matched and forced full timeouts - no /container get ... status (status is a flag, not a gettable property) - installed as a named /system/script (NOT /import, which only executes once)	2026-05-29 04:24:03 +02:00
Lumpiasty	f7ddd164b3	drop cachenetmap feature, expand omission rationale ... cachenetmap only persists the netmap to disk for cold-start-during- control-outage; the in-memory map (the common case) is unaffected. Its cost is a flash write on every netmap delta, which is frequent on active tailnets — the opposite of this image's flash-conservation goal. Remove it from the allowlist. Also expand the clientupdate/cachenetmap comments to document why they're deliberately omitted, and fix the stale volume/ statedir comments that referenced the now-removed on-disk netmap cache.	2026-05-29 04:23:51 +02:00
Lumpiasty	082703a6b8	fix overlayfs layer duplication doubling extracted size ... Creating the tailscale argv[0] symlinks with RUN in the final scratch stage forced overlayfs to copy-up the whole /usr/local/bin directory, duplicating the ~3 MB binary into a second layer. RouterOS extracts overlay layers separately, so the on-disk rootfs measured ~7 MB instead of ~3.4 MB. Assemble /usr/local/bin in the builder stage and bring it in with a single COPY layer. Verified on RouterOS 7.21.2: du -sx / now ~3.4 MB.	2026-05-29 04:23:41 +02:00
Lumpiasty	864859a5a0	invalidate openbao token at the end of ci run	2026-05-29 01:07:06 +02:00
Lumpiasty	7bf9b2da4f	add releases	2026-05-29 00:54:56 +02:00
Lumpiasty	5e6573bdd7	add pipeline status	2026-05-28 23:49:14 +02:00
Lumpiasty	d5a32d13dd	don't use floating tags	2026-05-28 23:46:17 +02:00
Lumpiasty	dca233f9f2	add renovate cronjob	2026-05-28 23:37:02 +02:00
Lumpiasty	d912a450bf	Initial commit	2026-05-28 23:03:21 +02:00