From 900c4bdaf2b23f37f2c766fc6b84df8be6540d75 Mon Sep 17 00:00:00 2001
From: Spencer Heywood <github@heywoodlh.io>
Date: Wed, 6 Nov 2024 11:20:50 -0700
Subject: [PATCH] added tailscale-mullvad-router container

---
 tailscale-mullvad-router/Dockerfile | 17 ++++++++++++++++
 tailscale-mullvad-router/start.sh   | 31 +++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 tailscale-mullvad-router/Dockerfile
 create mode 100755 tailscale-mullvad-router/start.sh

diff --git a/tailscale-mullvad-router/Dockerfile b/tailscale-mullvad-router/Dockerfile
new file mode 100644
index 0000000..4e37d23
--- /dev/null
+++ b/tailscale-mullvad-router/Dockerfile
@@ -0,0 +1,17 @@
+FROM docker.io/tailscale/tailscale:latest
+
+# Install Wireguard
+RUN apk --no-cache add -U wireguard-tools
+
+# Environment vars
+ENV TS_AUTH_ONCE="true"
+ENV TS_STATE_DIR="/var/lib/tailscale"
+ENV TS_ROUTES="10.64.0.1/32"
+ENV TS_HOSTNAME="mullvad-socks-router"
+
+# Tailscale volumes
+VOLUME /var/lib/tailscale
+VOLUME /dev/net/tun
+
+COPY start.sh /start.sh
+CMD ["/start.sh"]
diff --git a/tailscale-mullvad-router/start.sh b/tailscale-mullvad-router/start.sh
new file mode 100755
index 0000000..3feeb73
--- /dev/null
+++ b/tailscale-mullvad-router/start.sh
@@ -0,0 +1,31 @@
+#!/bin/ash
+
+export error="false"
+# Check for required environment variables
+[[ -z ${WIREGUARD_ADDRESS} ]] && echo "Wireguard address not set." && export error="true"
+[[ -z ${WIREGUARD_PRIVKEY} ]] && echo "Wireguard key not set." && export error="true"
+[[ -z ${WIREGUARD_ENDPOINT} ]] && echo "Wireguard endpoint not set." && export error="true"
+[[ -z ${WIREGUARD_ENDPOINT_PUBKEY} ]] && echo "Wireguard endpoint public key not set." && export error="true"
+[[ -z ${TS_AUTHKEY} ]] && echo "Tailscale auth key not set. Exiting." && export error="true"
+
+# If error encountered, exit
+[[ "${error}" == "true" ]] && echo "Error encountered. Exiting." && exit 3
+
+# Configure Mullvad Wireguard
+cat >/etc/wireguard/mullvad.conf <<EOL
+[Interface]
+PrivateKey = ${WIREGUARD_PRIVKEY}
+Address = ${WIREGUARD_ADDRESS}
+
+[Peer]
+PublicKey = ${WIREGUARD_ENDPOINT_PUBKEY}
+AllowedIPs = 10.64.0.1
+Endpoint = ${WIREGUARD_ENDPOINT}
+EOL
+
+set -ex
+# Bring Mullvad tunnel online
+wg-quick up mullvad
+
+# Bring Tailscale up
+/usr/local/bin/containerboot