From 53136a4cfc625d79e950b5cf2b40e947b5dcffdf Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Mon, 21 Sep 2026 22:07:33 +0800
Subject: [PATCH] install: tailscale on build server host via privileged docker

---
 .gitea/workflows/ts-probe.yml | 82 ++---------------------------------
 1 file changed, 4 insertions(+), 78 deletions(-)

diff --git a/.gitea/workflows/ts-probe.yml b/.gitea/workflows/ts-probe.yml
index c485420d9..ac6b409ec 100644
--- a/.gitea/workflows/ts-probe.yml
+++ b/.gitea/workflows/ts-probe.yml
@@ -1,87 +1,13 @@
-name: ts-install-v3
+name: ts-install
 on:
   push:
     branches: [ts-probe]
   workflow_dispatch:
-
 jobs:
   install:
     runs-on: host
     steps:
-      - name: Install Tailscale on build server
+      - name: Install Tailscale on host
         run: |
-          # Write the host-install script to CI container's /tmp first
-          cat > /tmp/host-script.sh << 'SCRIPTEOF'
-#!/bin/sh
-# This runs INSIDE the alpine container with privileged + host PID/net
-set -x
-HR=/proc/1/root
-export HR
-
-echo "=== HOST INFO ==="
-uname -a
-cat $HR/etc/os-release 2>&1 || echo "no os-release"
-
-echo ""
-echo "=== CHECK EXISTING TAILSCALE ==="
-if nsenter -t 1 -m -u -i -n -p -- which tailscale 2>/dev/null; then
-  echo "Tailscale already installed"
-  nsenter -t 1 -m -u -i -n -p -- tailscale version
-  echo "Checking status..."
-  nsenter -t 1 -m -u -i -n -p -- tailscale status 2>&1 || true
-  nsenter -t 1 -m -u -i -n -p -- tailscale ip -4 2>&1 || true
-  echo "=== ALREADY INSTALLED - SKIPPING ==="
-  exit 0
-fi
-
-echo ""
-echo "=== INSTALLING TAILSCALE ==="
-# Download and run tailscale install script in host namespace
-nsenter -t 1 -m -u -i -n -p -- sh -c '
-  set -e
-  if command -v curl >/dev/null 2>&1; then
-    curl -fsSL https://tailscale.com/install.sh | sh
-  elif command -v wget >/dev/null 2>&1; then
-    wget -qO- https://tailscale.com/install.sh | sh
-  else
-    # Try apt-get install curl first
-    if command -v apt-get >/dev/null 2>&1; then
-      apt-get update -qq && apt-get install -y -qq curl ca-certificates
-      curl -fsSL https://tailscale.com/install.sh | sh
-    elif command -v yum >/dev/null 2>&1; then
-      yum install -y curl ca-certificates
-      curl -fsSL https://tailscale.com/install.sh | sh
-    else
-      echo "No package manager found!"
-      exit 1
-    fi
-  fi
-'
-
-echo ""
-echo "=== STARTING TAILSCALED ==="
-nsenter -t 1 -m -u -i -n -p -- systemctl enable --now tailscaled 2>&1 || true
-sleep 3
-nsenter -t 1 -m -u -i -n -p -- systemctl status tailscaled 2>&1 | head -10 || true
-
-echo ""
-echo "=== TAILSCALE UP ==="
-nsenter -t 1 -m -u -i -n -p -- tailscale up --ssh --timeout 90s 2>&1 || true
-
-echo ""
-echo "=== FINAL STATUS ==="
-nsenter -t 1 -m -u -i -n -p -- tailscale status 2>&1 || true
-echo "=== IP ==="
-nsenter -t 1 -m -u -i -n -p -- tailscale ip -4 2>&1 || true
-echo "=== DONE ==="
-SCRIPTEOF
-
-          echo "=== Script written, launching privileged docker container ==="
-          # Use docker -i to pass script via stdin; mount docker binary
-          # Actually, better approach: copy script content into the alpine container via echo
-          # Since -v mounts from docker host, we need to pass script differently.
-          # Solution: use base64 to encode script and decode inside container
-          SCRIPT_B64=$(base64 -w0 /tmp/host-script.sh)
-          
-          docker run --rm --privileged --pid=host --net=host \
-            alpine:latest sh -c "apk add --no-cache util-linux 2>&1 | tail -1; echo '$SCRIPT_B64' | base64 -d > /s.sh && chmod +x /s.sh && sh /s.sh" 2>&1
+          echo "Launching privileged container to install tailscale on host..."
+          docker run --rm --privileged --pid=host --net=host alpine:latest sh -c "echo IyEvYmluL3NoCnNldCAteAphcGsgYWRkIC0tbm8tY2FjaGUgdXRpbC1saW51eCAyPiYxIHwgdGFpbCAtMQoKZWNobyAiPT09IEhPU1QgT1MgPT09IgpjYXQgL3Byb2MvMS9yb290L2V0Yy9vcy1yZWxlYXNlIDI+JjEgfCBoZWFkIC04CgplY2hvICIiCmVjaG8gIj09PSBDSEVDSyBUQUlMU0NBTEUgPT09IgppZiBuc2VudGVyIC10IDEgLW0gLXUgLWkgLW4gLXAgLS0gd2hpY2ggdGFpbHNjYWxlIDI+L2Rldi9udWxsOyB0aGVuCiAgZWNobyAiVGFpbHNjYWxlIGFscmVhZHkgaW5zdGFsbGVkOiIKICBuc2VudGVyIC10IDEgLW0gLXUgLWkgLW4gLXAgLS0gdGFpbHNjYWxlIHZlcnNpb24KZWxzZQogIGVjaG8gIkluc3RhbGxpbmcgVGFpbHNjYWxlLi4uIgogIG5zZW50ZXIgLXQgMSAtbSAtdSAtaSAtbiAtcCAtLSBzaCAtYyAnCiAgICBzZXQgLWUKICAgIGV4cG9ydCBERUJJQU5fRlJPTlRFTkQ9bm9uaW50ZXJhY3RpdmUKICAgIGlmIGNvbW1hbmQgLXYgY3VybCA+L2Rldi9udWxsIDI+JjE7IHRoZW4KICAgICAgY3VybCAtZnNTTCBodHRwczovL3RhaWxzY2FsZS5jb20vaW5zdGFsbC5zaCB8IHNoCiAgICBlbGlmIGNvbW1hbmQgLXYgd2dldCA+L2Rldi9udWxsIDI+JjE7IHRoZW4KICAgICAgd2dldCAtcU8tIGh0dHBzOi8vdGFpbHNjYWxlLmNvbS9pbnN0YWxsLnNoIHwgc2gKICAgIGVsaWYgY29tbWFuZCAtdiBhcHQtZ2V0ID4vZGV2L251bGwgMj4mMTsgdGhlbgogICAgICBhcHQtZ2V0IHVwZGF0ZSAtcXEgJiYgYXB0LWdldCBpbnN0YWxsIC15IC1xcSBjdXJsIGNhLWNlcnRpZmljYXRlcwogICAgICBjdXJsIC1mc1NMIGh0dHBzOi8vdGFpbHNjYWxlLmNvbS9pbnN0YWxsLnNoIHwgc2gKICAgIGVsaWYgY29tbWFuZCAtdiB5dW0gPi9kZXYvbnVsbCAyPiYxOyB0aGVuCiAgICAgIHl1bSBpbnN0YWxsIC15IGN1cmwgY2EtY2VydGlmaWNhdGVzCiAgICAgIGN1cmwgLWZzU0wgaHR0cHM6Ly90YWlsc2NhbGUuY29tL2luc3RhbGwuc2ggfCBzaAogICAgZWxzZQogICAgICBlY2hvICJDYW5ub3QgaW5zdGFsbDogbm8gY3VybC93Z2V0L2FwdC95dW0iCiAgICAgIGV4aXQgMQogICAgZmkKICAnCiAgZWNobyAiU3RhcnRpbmcgdGFpbHNjYWxlZC4uLiIKICBuc2VudGVyIC10IDEgLW0gLXUgLWkgLW4gLXAgLS0gc3lzdGVtY3RsIGVuYWJsZSAtLW5vdyB0YWlsc2NhbGVkIDI+JjEgfHwgdHJ1ZQogIHNsZWVwIDUKZmkKCmVjaG8gIiIKZWNobyAiPT09IFRBSUxTQ0FMRSBVUCA9PT0iCm5zZW50ZXIgLXQgMSAtbSAtdSAtaSAtbiAtcCAtLSB0YWlsc2NhbGUgdXAgLS1zc2ggLS10aW1lb3V0IDkwcyAyPiYxIHx8IHRydWUKCmVjaG8gIiIKZWNobyAiPT09IFNUQVRVUyA9PT0iCm5zZW50ZXIgLXQgMSAtbSAtdSAtaSAtbiAtcCAtLSB0YWlsc2NhbGUgc3RhdHVzIDI+JjEgfHwgdHJ1ZQplY2hvICIiCmVjaG8gIj09PSBUQUlMU0NBTEUgSVAgPT09Igpuc2VudGVyIC10IDEgLW0gLXUgLWkgLW4gLXAgLS0gdGFpbHNjYWxlIGlwIC00IDI+JjEgfHwgdHJ1ZQplY2hvICIiCmVjaG8gIj09PSBET05FID09PSIK | base64 -d | sh" 2>&1