Docker版headscale&derp&tailscale配合npm反向代理回家的方法

~/data/docker_data/
├── headscale及headscale-UI/ # 服务端与配置
├── derps/              # 中继服务器
└── tailscale/          # 网关节点
|—— Nginx Proxy Manager / # 反向代理服务 后面引用会简称npm

# 开启 IPv4 转发
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

nano docker-compose.yaml

services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale-node
    hostname: home-gateway
    restart: always
    network_mode: "host"  # 必须使用 host 模式获取真实物理网卡权限
    cap_add:
      - NET_ADMIN
      - NET_RAW
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./tailscale-state:/var/lib/tailscale
      - /lib/modules:/lib/modules:ro  # 允许容器读取宿主机内核模块（对 Alpine 必须，对 Ubuntu 无害）
    environment:
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false            # 禁用用户态，强制使用内核驱动建立物理级路由
    # 强制监听固定入站端口，为外部 P2P 打洞提供明确入口
    command: tailscaled --port=7829

nano docker-compose.yaml

services:
  derper:
    image: fredliang/derper
    container_name: derper
    restart: always
    ports:
      - "8082:80"    # 专门用于接收 NPM 的反代流量
    # 核心修正：保持后端 HTTP 监听，坚决关闭 STUN 避免内网 IP 污染
    command: /app/derper --a :80 --http-port 80 --stun=false --verify-clients=false
    environment:
      - DERP_ADDR=:80
      - DERP_HTTP_PORT=80

nano docker-compose.yaml

services:
  # 服务 1：Headscale 主程序
  headscale:
    image: headscale/headscale:latest
    container_name: headscale-server
    restart: always
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
    ports:
      - "8080:8080"
    command: serve

  # 服务 2：Headscale UI 界面 (注意：现在它和上面的 headscale 对齐了)
  headscale-ui:
    image: ghcr.io/gurucomputing/headscale-ui:latest
    container_name: headscale-ui
    restart: always
    # 建议映射一个端口，方便你在 NPM 还没配好时先用内网 IP 验证一下
    ports:
      - "9443:8080"

# 进入目录
cd ~/data/docker_data/headscale/config

nano config.yaml

# Headscale 容器版完整配置 (更改你的域名）
server_url: https://hs.jgaga.xyz:12335

# 容器内必须监听 0.0.0.0 才能接收来自 NPM 的转发
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 0.0.0.0:9090
grpc_listen_addr: 0.0.0.0:50443
grpc_allow_insecure: false

noise:
  # 路径映射到容器内的 /var/lib/headscale
  private_key_path: /var/lib/headscale/noise_private.key

prefixes:
  v4: 100.64.0.0/10
  allocation: sequential

derp:
  server:
    enabled: false # 独立容器运行 DERP，此处关闭
    automatically_add_embedded_derp_region: false

  urls: [] # 禁用官方节点，专注自建
  paths:
    - /etc/headscale/derp.yaml # 映射在 config 目录下的文件
  auto_update_enabled: true
  update_frequency: 1h

database:
  type: sqlite
  sqlite:
    path: /var/lib/headscale/db.sqlite
    write_ahead_log: true

# 日志级别设为 info，确保能看到 DERP 加载记录
log:
  level: info
  format: text

dns:
  magic_dns: false
  base_domain: i.love.you
  override_local_dns: true
# 下面更改为你的内网的 DNS 
  nameservers:
    global:
      - 10.20.20.6.           # 优先级最高，所有解析全部扔进隧道，交给内网 MosDNS 处理
      - 1.1.1.1               # 救命稻草，负责在隧道断开时解析控制端域名

unix_socket: /var/run/headscale/headscale.sock
unix_socket_permission: "0770"

randomize_client_port: false
taildrop:
  enabled: true

# 进入目录
cd ~/data/docker_data/headscale/config

nvim derp.yaml

regions:
  900:
    regionid: 900
    regioncode: Gary
    regionname: Gary Home Network
    nodes:
      - name: 900a
        regionid: 900
        hostname: derps.jgaga.xyz
        derpport: 12335
        stunport: -1
        stunonly: false
        derponly: true
      - name: 900b
        regionid: 900
        hostname: stun.miwifi.com
        stunport: 3478
        stunonly: true
        derponly: false

nano docker-compose.yaml

services:
  app:
    image: 'docker.io/jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '12332:80'
      - '81:81'
      - '12335:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

4. RouterOS (ROS) 核心防火墙恢复指令
确保外网探测包和内网回环（Hairpin NAT）均能准确到达 10.20.20.8 宿主机。在 ROS 终端直接粘贴执行：

代码段
# 放行 Tailscale 固定入站端口 (核心打洞入口) 
/ip firewall nat add action=dst-nat chain=dstnat comment="Tailscale_Inbound_Fixed" dst-port=7829 protocol=udp dst-address-type=local to-addresses=10.20.20.8 to-ports=7829

# 放行 DERP TCP/UDP 中转端口 npm的对外的https端口
/ip firewall nat add action=dst-nat chain=dstnat comment="https-tcp" dst-port=12335 protocol=tcp dst-address-type=local to-addresses=10.20.20.8 to-ports=12335

location / {
    proxy_pass http://10.20.20.8:8082;
    proxy_http_version 1.1;

    # --- 关键修正：去掉端口号，仅透传域名 ---
    # 这样可以匹配 DERP 容器内部的证书/域名校验
    proxy_set_header Host $host; 
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # --- 保持长连接稳定性 ---
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_socket_keepalive on;
    tcp_nodelay on;

    # 超时设置，防止感叹号
    proxy_connect_timeout 60s;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;

    # --- 必须：WebSocket 协议升级 ---
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

# 1. 针对 UI 的 API 请求，允许跨域
location ~ ^/(admin|web|api) {
    proxy_pass http://10.20.20.8:8080;
    proxy_http_version 1.1;
    proxy_set_header Host $http_host;

    # 跨域头只在这些路径生效
    add_header Access-Control-Allow-Origin * always;
    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE" always;
    add_header Access-Control-Allow-Headers * always;

    if ($request_method = OPTIONS) {
        return 204;
    }
}

# 2. 针对手机客户端的 Noise 协议通讯，保持纯净（解决 Out of sync）
location / {
    proxy_pass http://10.20.20.8:8080;
    proxy_http_version 1.1;

    # 核心：必须使用动态 Upgrade，不要硬编码 Connection "upgrade"
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_upgrade; 

    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # 实时性优化
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_socket_keepalive on;
    tcp_nodelay on;

    # 延长超时
    proxy_connect_timeout 60s;
    proxy_read_timeout 600s;
    proxy_send_timeout 600s;
}

docker exec tailscale-node tailscale up \
  --login-server https://hs.jgaga.xyz:12335 \
  --advertise-routes=10.20.20.0/24 \
  --advertise-exit-node \
  --accept-routes \
  --accept-dns=false \
  --force-reauth \
  --reset