From eef08fc034ab6453fed56877ded8046f52b1aa8b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?c=C4=83t=C4=83lin?= <catalin@roboces.dev>
Date: Mon, 27 Jul 2026 14:16:21 +0200
Subject: [PATCH] feat: migrate tailscale to k8s

---
 docker/tailscale/docker-compose.yml       | 18 ------------
 docker/tailscale/sample.env               |  5 ----
 k8s/argo-apps/tailscale.yaml              | 36 +++++++++++++++++++++++
 k8s/services/argo/project-fuku.yaml       |  1 +
 k8s/services/tailscale/sealedsecrets.yaml | 13 ++++++++
 5 files changed, 50 insertions(+), 23 deletions(-)
 delete mode 100644 docker/tailscale/docker-compose.yml
 delete mode 100644 docker/tailscale/sample.env
 create mode 100644 k8s/argo-apps/tailscale.yaml
 create mode 100644 k8s/services/tailscale/sealedsecrets.yaml

diff --git a/docker/tailscale/docker-compose.yml b/docker/tailscale/docker-compose.yml
deleted file mode 100644
index 314273a..0000000
--- a/docker/tailscale/docker-compose.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-services:
-  tailscale:
-    image: tailscale/tailscale:v1.98.9
-    hostname: tailscale
-    environment:
-      TS_AUTHKEY: ${TS_AUTHKEY}
-      TS_HOSTNAME: ${TS_HOSTNAME:-docker-exit-node}
-      TS_EXTRA_ARGS: ${TS_EXTRA_ARGS:---advertise-exit-node}
-      TS_ROUTES: ${TS_ROUTES:-192.168.1.0/24}
-      TS_STATE_DIR: /var/lib/tailscale
-    volumes:
-      - ${TS_VOLUME:-/mnt/nas1/shared/tailscale}:/var/lib/tailscale
-    devices:
-      - /dev/net/tun:/dev/net/tun
-    cap_add:
-      - net_admin
-    restart: unless-stopped
diff --git a/docker/tailscale/sample.env b/docker/tailscale/sample.env
deleted file mode 100644
index 83646d5..0000000
--- a/docker/tailscale/sample.env
+++ /dev/null
@@ -1,5 +0,0 @@
-TS_AUTHKEY=
-TS_HOSTNAME=docker-exit-node
-TS_EXTRA_ARGS=--advertise-exit-node
-TS_ROUTES=192.168.1.0/24
-TS_VOLUME=/mnt/nas1/shared/tailscale
diff --git a/k8s/argo-apps/tailscale.yaml b/k8s/argo-apps/tailscale.yaml
new file mode 100644
index 0000000..797a89e
--- /dev/null
+++ b/k8s/argo-apps/tailscale.yaml
@@ -0,0 +1,36 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: tailscale
+  namespace: argocd
+spec:
+  destination:
+    name: ''
+    namespace: apps-fuku
+    server: https://kubernetes.default.svc
+  project: fuku
+  syncPolicy:
+    automated: {}
+  sources:
+    - chart: tailscale
+      repoURL: https://harish2k01.github.io/helm-charts/
+      targetRevision: 0.1.2
+      helm:
+        valuesObject:
+          service:
+            enabled: true
+          persistence:
+            enabled: true
+            mountPath: /var/lib/tailscale
+            accessModes:
+              - ReadWriteMany
+            size: 1Gi
+            storageClassName: "truenas-nfs-csi"
+          tailscale:
+            hostname: exit-node
+            advertiseExitNode: true
+            routes:
+              - 192.168.1.0/24
+          authKey:
+            existingSecret: tailscale-auth
diff --git a/k8s/services/argo/project-fuku.yaml b/k8s/services/argo/project-fuku.yaml
index 6af2731..b58c913 100644
--- a/k8s/services/argo/project-fuku.yaml
+++ b/k8s/services/argo/project-fuku.yaml
@@ -35,3 +35,4 @@ spec:
         - ghcr.io/antoniolago/charts
         - https://helm.elastic.co
         - https://repo.helmforge.dev
+        - https://harish2k01.github.io/helm-charts/
diff --git a/k8s/services/tailscale/sealedsecrets.yaml b/k8s/services/tailscale/sealedsecrets.yaml
new file mode 100644
index 0000000..fb24156
--- /dev/null
+++ b/k8s/services/tailscale/sealedsecrets.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: tailscale-auth
+  namespace: apps-fuku
+spec:
+  encryptedData:
+    TS_AUTHKEY: AgCF36HLW1YCdfhJHHEMk7Gpo3aMbgcRB4MNogepukZwha2O9AMH/egQohnZG9On4BMMAXe1NHWptAU0e72yD3QA6/4sOML1w95TOKQY0mvx4HNBhfFnOnVh3Lhx81C8vMYXnRazhqyWx5w7o3rQaiiO0UtL4thqfEzk++TFEwYCmFyREPSMktePaQRhQ5QCfuyZkaq+e8V+7DB1M1tVr1KriOPy6lMvd7M+Wv5JZlnOO0ii1Wc54mFox73wOI7TLzJuPtUHB8iMo/Hh+HPCwTcW8x2dMuZVPy89my8spKp28WBGMiLHB95aToAOIGnzTLhTHoo3Fd2ylzx7PvWTtE6mnIYQ6nMVGq8z9ZjkpJTfrZMPiHvBZZyIE6dtlSG5fZQ0tsY6Mf+SnXeUn4nhEvwA5YjOyIuSDK43METIEQ/3N+EdvXELMDzG+t922wV5ja2pHRzE+CyotzP4IhL+8ANcnWst3UlL+Hn+p0BEzx7btBMW7t2reIF8ieXSNgeSUgcFf0nmLe1yEFXO/u99PW+a2qbheFYwUQnsm9lTvLtQ/4P7rrK849aCKKkAH5tJbGx9S/fmxbud1RmCwuiDIbHX+NAiO/BOLW99ap7w8Agf87rjxLZjBaYxkADW8Y28OvNMFa7eUa0tvszB3NlFPRr7xHs3paihIBZ29QZD9ut2K0XEMSqiVaM9sv9OntlhAh4c9jcn5CBSRN82/yZMml3mn8Pyrv50d8rZ0ctVRSVtYbLheVZyzl80sP26f33MSwNmukoHCZoAAJcnkKHy  # yamllint disable rule:line-length
+  template:
+    metadata:
+      name: tailscale-auth
+      namespace: apps-fuku