From e497561c8b376cffa9e5867396c09018d11060f1 Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Thu, 11 Jun 2026 00:38:55 -0700
Subject: [PATCH] feat: tailscale in compose, replacing the truenas app
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

closes #27

same node identity — state copied from the ix-apps mount into
${APP_ROOT}/tailscale, so no reauth, and the tailnet still sees
'zenith' offering an exit node. host networking + /dev/net/tun like
the original. the truenas app is stopped; delete it from the truenas
ui at leisure.
---
 compose.yaml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/compose.yaml b/compose.yaml
index f4cdec4262e2ff90ad3ed7ed11b8a048623e97f8..0f44e3c2348d8821ce9634cc42eeaa82f4fbc404 100755
--- a/compose.yaml
+++ b/compose.yaml
@@ -766,6 +766,31 @@ services:
       caddy:
         condition: service_started
   # administration
+  tailscale:
+    container_name: tailscale
+    image: tailscale/tailscale:latest
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      TS_HOSTNAME: truenas-scale
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_USERSPACE: "false"
+      TS_AUTH_ONCE: "true"
+      TS_ACCEPT_DNS: "false"
+      TS_EXTRA_ARGS: "--advertise-exit-node"
+    volumes:
+      - "${APP_ROOT}/tailscale:/var/lib/tailscale"
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "tailscale status >/dev/null"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
   openspeedtest: # port 3000
     restart: unless-stopped
     container_name: openspeedtest
-- 
2.54.0