homeio

1import "server-only";
2
3import { execFile } from "node:child_process";
4import { access, unlink, writeFile } from "node:fs/promises";
5import { randomBytes } from "node:crypto";
6import { tmpdir } from "node:os";
7import { join } from "node:path";
8import { promisify } from "node:util";
9import type {
10  TailscaleInstallResult,
11  TailscaleStatusPublic,
12} from "@/lib/shared/contracts/tailscale";
13
14const execFileAsync = promisify(execFile);
15
16async function hasTunDevice() {
17  try {
18    await access("/dev/net/tun");
19    return true;
20  } catch {
21    return false;
22  }
23}
24
25type TailscaleStatusJson = {
26  BackendState?: string;
27  Self?: {
28    HostName?: string;
29    DNSName?: string;
30    TailscaleIPs?: string[];
31    Online?: boolean;
32  };
33};
34
35function isMissingCommand(error: unknown) {
36  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
37}
38
39async function toStatus(data: TailscaleStatusJson): Promise<TailscaleStatusPublic> {
40  const backendState = data.BackendState ?? null;
41  const connected = backendState === "Running" || data.Self?.Online === true;
42  const tunAvailable = await hasTunDevice();
43
44  return {
45    installed: true,
46    tunAvailable,
47    running: backendState !== null && backendState !== "NoState",
48    connected,
49    backendState,
50    hostname: data.Self?.HostName ?? null,
51    dnsName: data.Self?.DNSName ?? null,
52    tailscaleIps: data.Self?.TailscaleIPs ?? [],
53    issue: tunAvailable ? null : "missing_tun",
54    error: null,
55  };
56}
57
58export async function getLocalTailscaleStatus(): Promise<TailscaleStatusPublic> {
59  const tunAvailable = await hasTunDevice();
60
61  try {
62    const { stdout } = await execFileAsync("tailscale", ["status", "--json"], {
63      timeout: 5000,
64      maxBuffer: 1024 * 1024,
65    });
66    return toStatus(JSON.parse(stdout) as TailscaleStatusJson);
67  } catch (error) {
68    if (isMissingCommand(error)) {
69      return {
70        installed: false,
71        tunAvailable,
72        running: false,
73        connected: false,
74        backendState: null,
75        hostname: null,
76        dnsName: null,
77        tailscaleIps: [],
78        issue: tunAvailable ? null : "missing_tun",
79        error: "Tailscale CLI is not installed.",
80      };
81    }
82
83    const message = error instanceof Error ? error.message : "Unable to read Tailscale status.";
84    const missingTun = !tunAvailable || message.includes("/dev/net/tun") || message.includes("CreateTUN");
85
86    return {
87      installed: true,
88      tunAvailable,
89      running: false,
90      connected: false,
91      backendState: null,
92      hostname: null,
93      dnsName: null,
94      tailscaleIps: [],
95      issue: missingTun ? "missing_tun" : "service_unavailable",
96      error: message,
97    };
98  }
99}
100
101let installLock = false;
102
103export async function installTailscale(authKey?: string): Promise<TailscaleInstallResult> {
104  if (installLock) {
105    throw new Error("Tailscale installation already in progress. Please wait.");
106  }
107  installLock = true;
108  try {
109    return await runInstall(authKey);
110  } finally {
111    installLock = false;
112  }
113}
114
115async function runInstall(authKey?: string): Promise<TailscaleInstallResult> {
116  const currentStatus = await getLocalTailscaleStatus();
117  let stdout = "";
118  let stderr = "";
119
120  if (!currentStatus.installed) {
121    try {
122      const installResult = await execFileAsync("sh", [
123        "-c",
124        "curl -fsSL https://tailscale.com/install.sh | sh",
125      ], {
126        timeout: 120_000,
127        maxBuffer: 4 * 1024 * 1024,
128      });
129      stdout += installResult.stdout;
130      stderr += installResult.stderr;
131    } catch (err) {
132      const e = err as { stderr?: string; stdout?: string; message?: string };
133      const detail = (e.stderr || e.stdout || e.message || "Unknown error").slice(0, 3000);
134      throw new Error(`Tailscale install script failed:\n${detail}`);
135    }
136  }
137
138  const nextStatus = await getLocalTailscaleStatus();
139  if (!nextStatus.tunAvailable) {
140    throw new Error("Tailscale requires /dev/net/tun. In Proxmox LXC, pass through dev/net/tun before activating.");
141  }
142
143  if (!authKey) {
144    return {
145      installed: true,
146      activated: nextStatus.connected,
147      stdout,
148      stderr: stderr || "Tailscale is installed. Provide an auth key to activate this server.",
149    };
150  }
151
152  await execFileAsync("systemctl", ["reset-failed", "tailscaled"], { timeout: 10_000 });
153  await execFileAsync("systemctl", ["enable", "--now", "tailscaled"], { timeout: 30_000 });
154
155  const tmpKeyFile = join(tmpdir(), `ts-key-${randomBytes(8).toString("hex")}`);
156  await writeFile(tmpKeyFile, authKey, { mode: 0o600 });
157  try {
158    const upResult = await execFileAsync("tailscale", [
159      "up",
160      `--auth-key=file:${tmpKeyFile}`,
161      "--accept-dns=true",
162    ], {
163      timeout: 120_000,
164      maxBuffer: 1024 * 1024,
165    });
166    stdout += upResult.stdout;
167    stderr += upResult.stderr;
168  } finally {
169    await unlink(tmpKeyFile).catch(() => {});
170  }
171
172  return {
173    installed: true,
174    activated: true,
175    stdout,
176    stderr,
177  };
178}
179