diff --git a/CLIENT_CONNECTION_TEST.md b/CLIENT_CONNECTION_TEST.md new file mode 100644 index 0000000..ed13c9c --- /dev/null +++ b/CLIENT_CONNECTION_TEST.md @@ -0,0 +1,295 @@ +# ๐Ÿ”— Tailscale ํด๋ผ์ด์–ธํŠธ ์—ฐ๊ฒฐ ๋ฐ ํ…Œ์ŠคํŠธ ๊ฐ€์ด๋“œ + +## ๐Ÿ“‹ ํ…Œ์ŠคํŠธ ๊ฐœ์š” +- **๋ชฉ์ **: Headscale ์„œ๋ฒ„์— Tailscale ํด๋ผ์ด์–ธํŠธ ์—ฐ๊ฒฐ ๋ฐ VPN ๊ธฐ๋Šฅ ๊ฒ€์ฆ +- **ํ™˜๊ฒฝ**: Ubuntu 24.04 LTS, Tailscale 1.86.2 +- **์„œ๋ฒ„**: Headscale (http://localhost:8070) + +## ๐Ÿ› ๏ธ ์‚ฌ์ „ ์ค€๋น„์‚ฌํ•ญ +- Headscale ์„œ๋ฒ„๊ฐ€ ์ •์ƒ ์ž‘๋™ ์ค‘ (8070 ํฌํŠธ) +- ์‚ฌ์šฉ์ž ๋ฐ Pre-auth ํ‚ค ์ƒ์„ฑ ์™„๋ฃŒ +- ํ…Œ์ŠคํŠธํ•  ํด๋ผ์ด์–ธํŠธ ์žฅ์น˜ ์ค€๋น„ + +## ๐Ÿ“Š ๊ธฐ๋ณธ ์ •๋ณด ํ™•์ธ + +### Headscale ์„œ๋ฒ„ ์ƒํƒœ +```bash +# API ํ—ฌ์Šค ์ฒดํฌ +curl -s http://localhost:8070/health +# ์‘๋‹ต: {"status":"pass"} + +# ์ปจํ…Œ์ด๋„ˆ ์ƒํƒœ ํ™•์ธ +docker-compose ps +# STATUS: Up (healthy ๋˜๋Š” running) +``` + +### ์‚ฌ์šฉ์ž ๋ฐ ํ‚ค ์ •๋ณด +```bash +# ์‚ฌ์šฉ์ž ๋ชฉ๋ก +docker-compose exec headscale headscale users list +# ๊ฒฐ๊ณผ: myuser (ID: 1) + +# Pre-auth ํ‚ค ํ™•์ธ +echo "Pre-auth Key: fc4f2dc55ee00c5352823d156129b9ce2df4db02f1d76a21" +``` + +## ๐Ÿš€ Tailscale ํด๋ผ์ด์–ธํŠธ ์„ค์น˜ + +### Ubuntu/Debian ์„ค์น˜ +```bash +# ๊ณต์‹ ์„ค์น˜ ์Šคํฌ๋ฆฝํŠธ ์‚ฌ์šฉ +curl -fsSL https://tailscale.com/install.sh | sh + +# ์„ค์น˜ ํ™•์ธ +tailscale version +# ๊ฒฐ๊ณผ: 1.86.2 +``` + +### ์„ค์น˜ ํ›„ ์„œ๋น„์Šค ์ƒํƒœ ํ™•์ธ +```bash +# Tailscale ๋ฐ๋ชฌ ์ƒํƒœ ํ™•์ธ +sudo systemctl status tailscaled +# Active: active (running) + +# Tailscale ๋ช…๋ น์–ด ํ™•์ธ +which tailscale +# /usr/bin/tailscale +``` + +## ๐Ÿ”— Headscale ์„œ๋ฒ„ ์—ฐ๊ฒฐ + +### ์—ฐ๊ฒฐ ๋ช…๋ น์–ด ์‹คํ–‰ +```bash +# Pre-auth ํ‚ค๋ฅผ ์‚ฌ์šฉํ•œ ์ž๋™ ์—ฐ๊ฒฐ +tailscale up --login-server=http://localhost:8070 --authkey=fc4f2dc55ee00c5352823d156129b9ce2df4db02f1d76a21 +``` + +### ์—ฐ๊ฒฐ ์„ฑ๊ณต ํ™•์ธ +```bash +# ์—ฐ๊ฒฐ ์ƒํƒœ ํ™•์ธ +tailscale status +``` + +**์„ฑ๊ณต์ ์ธ ์ถœ๋ ฅ ์˜ˆ์‹œ:** +``` +100.64.0.1 0bin-ubuntu-vm myuser linux - +``` + +## ๐Ÿ“ก ๋„คํŠธ์›Œํฌ ์ธํ„ฐํŽ˜์ด์Šค ํ™•์ธ + +### Tailscale ์ธํ„ฐํŽ˜์ด์Šค ์ƒ์„ฑ ํ™•์ธ +```bash +# tailscale0 ์ธํ„ฐํŽ˜์ด์Šค ํ™•์ธ +ip addr show tailscale0 +``` + +**์ถœ๋ ฅ ๊ฒฐ๊ณผ:** +``` +214: tailscale0: mtu 1280 qdisc pfifo_fast state UNKNOWN group default qlen 500 + link/none + inet 100.64.0.1/32 scope global tailscale0 + valid_lft forever preferred_lft forever + inet6 fd7a:115c:a1e0::1/128 scope global + valid_lft forever preferred_lft forever + inet6 fe80::a49:8d96:4244:2fcf/64 scope link stable-privacy + valid_lft forever preferred_lft forever +``` + +### IP ์ฃผ์†Œ ํ• ๋‹น ํ™•์ธ +- **IPv4**: `100.64.0.1/32` +- **IPv6**: `fd7a:115c:a1e0::1/128` +- **๋งํฌ๋กœ์ปฌ**: `fe80::a49:8d96:4244:2fcf/64` + +## ๐ŸŒ Headscale ์„œ๋ฒ„์—์„œ ๋…ธ๋“œ ํ™•์ธ + +### ์—ฐ๊ฒฐ๋œ ๋…ธ๋“œ ๋ชฉ๋ก ํ™•์ธ +```bash +docker-compose exec headscale headscale nodes list +``` + +**์ถœ๋ ฅ ๊ฒฐ๊ณผ:** +``` +ID | Hostname | Name | MachineKey | NodeKey | User | IP addresses | Ephemeral | Last seen | Expiration | Connected | Expired +1 | 0bin-Ubuntu-VM | 0bin-ubuntu-vm| [rzOhs] | [SbpbT] | myuser | 100.64.0.1, fd7a:115c:a1e0::1| false | 2025-09-09 05:42:25 | N/A | online | no +``` + +### ๋…ธ๋“œ ์„ธ๋ถ€ ์ •๋ณด +- **ID**: 1 +- **ํ˜ธ์ŠคํŠธ๋ช…**: 0bin-Ubuntu-VM +- **๋…ธ๋“œ๋ช…**: 0bin-ubuntu-vm +- **์‚ฌ์šฉ์ž**: myuser +- **IP ์ฃผ์†Œ**: 100.64.0.1 (IPv4), fd7a:115c:a1e0::1 (IPv6) +- **์ƒํƒœ**: online +- **์ž„์‹œ ๋…ธ๋“œ**: false +- **๋งŒ๋ฃŒ**: ์—†์Œ + +## ๐Ÿงช ์—ฐ๊ฒฐ ํ…Œ์ŠคํŠธ + +### 1. ์ž๊ธฐ ์ž์‹  ํ•‘ ํ…Œ์ŠคํŠธ +```bash +# IPv4 ํ•‘ ํ…Œ์ŠคํŠธ +ping -c 3 100.64.0.1 +``` + +**์„ฑ๊ณต ๊ฒฐ๊ณผ:** +``` +PING 100.64.0.1 (100.64.0.1) 56(84) bytes of data. +64 bytes from 100.64.0.1: icmp_seq=1 ttl=64 time=0.032 ms +64 bytes from 100.64.0.1: icmp_seq=2 ttl=64 time=0.044 ms +64 bytes from 100.64.0.1: icmp_seq=3 ttl=64 time=0.050 ms + +--- 100.64.0.1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2080ms +rtt min/avg/max/mdev = 0.032/0.042/0.050/0.007 ms +``` + +### 2. IPv6 ํ•‘ ํ…Œ์ŠคํŠธ +```bash +# IPv6 ํ•‘ ํ…Œ์ŠคํŠธ +ping6 -c 3 fd7a:115c:a1e0::1 +``` + +### 3. DNS ํ™•์ธ (Magic DNS) +```bash +# Magic DNS ํ…Œ์ŠคํŠธ (์„ค์ •๋œ ๊ฒฝ์šฐ) +nslookup 0bin-ubuntu-vm.headscale.local +``` + +## ๐Ÿ“‹ ์ถ”๊ฐ€ ํด๋ผ์ด์–ธํŠธ ์—ฐ๊ฒฐ ๋ฐฉ๋ฒ• + +### ๋‹ค๋ฅธ ์žฅ์น˜์—์„œ ์—ฐ๊ฒฐํ•˜๊ธฐ + +#### Windows +```cmd +# PowerShell ๋˜๋Š” Command Prompt์—์„œ +tailscale up --login-server=http://YOUR_SERVER_IP:8070 --authkey=fc4f2dc55ee00c5352823d156129b9ce2df4db02f1d76a21 +``` + +#### macOS +```bash +# Terminal์—์„œ +sudo tailscale up --login-server=http://YOUR_SERVER_IP:8070 --authkey=fc4f2dc55ee00c5352823d156129b9ce2df4db02f1d76a21 +``` + +#### ๋‹ค๋ฅธ Linux ์žฅ์น˜ +```bash +# ๋™์ผํ•œ ๋ช…๋ น์–ด ์‚ฌ์šฉ +tailscale up --login-server=http://YOUR_SERVER_IP:8070 --authkey=fc4f2dc55ee00c5352823d156129b9ce2df4db02f1d76a21 +``` + +### ์ƒˆ๋กœ์šด Pre-auth ํ‚ค ์ƒ์„ฑ (ํ•„์š”์‹œ) +```bash +# ์ƒˆ๋กœ์šด 24์‹œ๊ฐ„ ์œ ํšจ ํ‚ค ์ƒ์„ฑ +docker-compose exec headscale headscale preauthkeys create --user 1 --reusable --expiration 24h +``` + +## ๐Ÿ” ๋ชจ๋‹ˆํ„ฐ๋ง ๋ฐ ๊ด€๋ฆฌ + +### ์‹ค์‹œ๊ฐ„ ์—ฐ๊ฒฐ ์ƒํƒœ ๋ชจ๋‹ˆํ„ฐ๋ง +```bash +# ์‹ค์‹œ๊ฐ„ ๋กœ๊ทธ ํ™•์ธ +docker-compose logs -f headscale + +# Tailscale ์ƒํƒœ ์ง€์† ํ™•์ธ +watch -n 5 'tailscale status' +``` + +### ๋„คํŠธ์›Œํฌ ํŠธ๋ž˜ํ”ฝ ๋ชจ๋‹ˆํ„ฐ๋ง +```bash +# tailscale0 ์ธํ„ฐํŽ˜์ด์Šค ํŠธ๋ž˜ํ”ฝ ํ™•์ธ +iftop -i tailscale0 + +# ๋˜๋Š” ๊ฐ„๋‹จํ•œ ํ†ต๊ณ„ +ip -s link show tailscale0 +``` + +## ๐Ÿšจ ๋ฌธ์ œ ํ•ด๊ฒฐ + +### ์—ฐ๊ฒฐ ์‹คํŒจ ์‹œ ์ฒดํฌ๋ฆฌ์ŠคํŠธ + +#### 1. Headscale ์„œ๋ฒ„ ์ƒํƒœ ํ™•์ธ +```bash +curl -f http://localhost:8070/health || echo "Headscale not responding" +``` + +#### 2. ๋ฐฉํ™”๋ฒฝ ์„ค์ • ํ™•์ธ +```bash +# 8070 ํฌํŠธ ์˜คํ”ˆ ํ™•์ธ +sudo ufw status | grep 8070 + +# ํ•„์š”์‹œ ํฌํŠธ ๊ฐœ๋ฐฉ +sudo ufw allow 8070 +``` + +#### 3. Pre-auth ํ‚ค ์œ ํšจ์„ฑ ํ™•์ธ +```bash +# ํ‚ค ๋ชฉ๋ก ํ™•์ธ +docker-compose exec headscale headscale preauthkeys list +``` + +#### 4. Tailscale ์„œ๋น„์Šค ์žฌ์‹œ์ž‘ +```bash +sudo systemctl restart tailscaled +``` + +### ์—ฐ๊ฒฐ ํ•ด์ œ ๋ฐ ์žฌ์—ฐ๊ฒฐ +```bash +# ์—ฐ๊ฒฐ ํ•ด์ œ +tailscale down + +# ์žฌ์—ฐ๊ฒฐ +tailscale up --login-server=http://localhost:8070 --authkey=fc4f2dc55ee00c5352823d156129b9ce2df4db02f1d76a21 +``` + +## ๐Ÿ“Š ์„ฑ๋Šฅ ํ…Œ์ŠคํŠธ + +### ๋Œ€์—ญํญ ํ…Œ์ŠคํŠธ (2๊ฐœ ์ด์ƒ ํด๋ผ์ด์–ธํŠธ ์—ฐ๊ฒฐ ์‹œ) +```bash +# iperf3 ์„ค์น˜ +sudo apt install iperf3 + +# ์„œ๋ฒ„ ๋ชจ๋“œ (์ฒซ ๋ฒˆ์งธ ํด๋ผ์ด์–ธํŠธ) +iperf3 -s + +# ํด๋ผ์ด์–ธํŠธ ๋ชจ๋“œ (๋‘ ๋ฒˆ์งธ ํด๋ผ์ด์–ธํŠธ) +iperf3 -c 100.64.0.1 +``` + +### ์ง€์—ฐ์‹œ๊ฐ„ ํ…Œ์ŠคํŠธ +```bash +# ์ง€์†์ ์ธ ํ•‘ ํ…Œ์ŠคํŠธ +ping -i 0.1 100.64.0.1 +``` + +## ๐ŸŽฏ ํ…Œ์ŠคํŠธ ๊ฒฐ๊ณผ ์š”์•ฝ + +### โœ… ์„ฑ๊ณต์ ์œผ๋กœ ํ™•์ธ๋œ ๊ธฐ๋Šฅ +1. **ํด๋ผ์ด์–ธํŠธ ์„ค์น˜**: Tailscale 1.86.2 ์„ค์น˜ ์™„๋ฃŒ +2. **์„œ๋ฒ„ ์—ฐ๊ฒฐ**: Pre-auth ํ‚ค๋ฅผ ํ†ตํ•œ ์ž๋™ ์ธ์ฆ ์„ฑ๊ณต +3. **IP ํ• ๋‹น**: IPv4(100.64.0.1), IPv6(fd7a:115c:a1e0::1) ์ •์ƒ ํ• ๋‹น +4. **๋„คํŠธ์›Œํฌ ํ†ต์‹ **: ํ•‘ ํ…Œ์ŠคํŠธ ์„ฑ๊ณต (0% ํŒจํ‚ท ์†์‹ค) +5. **์ธํ„ฐํŽ˜์ด์Šค ์ƒ์„ฑ**: tailscale0 ์ธํ„ฐํŽ˜์ด์Šค ์ •์ƒ ์ƒ์„ฑ +6. **์„œ๋ฒ„ ์ธ์‹**: Headscale์—์„œ ๋…ธ๋“œ ์ •์ƒ ์ธ์‹ + +### ๐Ÿ“ˆ ๋„คํŠธ์›Œํฌ ์„ฑ๋Šฅ +- **ํ•‘ ์ง€์—ฐ์‹œ๊ฐ„**: ํ‰๊ท  0.042ms (๋กœ์ปฌ) +- **ํŒจํ‚ท ์†์‹ค**: 0% +- **MTU**: 1280 bytes +- **์ƒํƒœ**: UNKNOWN (์ •์ƒ ๋™์ž‘) + +### ๐Ÿ”’ ๋ณด์•ˆ ํ™•์ธ์‚ฌํ•ญ +- **์•”ํ˜ธํ™”**: WireGuard ํ”„๋กœํ† ์ฝœ ์‚ฌ์šฉ +- **์ธ์ฆ**: Pre-auth ํ‚ค ๊ธฐ๋ฐ˜ ์ž๋™ ์ธ์ฆ +- **ํ‚ค ๊ด€๋ฆฌ**: 24์‹œ๊ฐ„ ๋งŒ๋ฃŒ, ์žฌ์‚ฌ์šฉ ๊ฐ€๋Šฅ ์„ค์ • + +## ๐Ÿš€ ๊ฒฐ๋ก  + +Headscale ์„œ๋ฒ„์™€ Tailscale ํด๋ผ์ด์–ธํŠธ ๊ฐ„์˜ ์—ฐ๊ฒฐ์ด ์™„๋ฒฝํ•˜๊ฒŒ ์„ฑ๊ณตํ–ˆ์Šต๋‹ˆ๋‹ค. + +**์ฃผ์š” ์„ฑ๊ณผ:** +- โœ… VPN ํ„ฐ๋„ ๊ตฌ์„ฑ ์™„๋ฃŒ +- โœ… IP ์ฃผ์†Œ ์ž๋™ ํ• ๋‹น ์„ฑ๊ณต +- โœ… ์‹ค์‹œ๊ฐ„ ํ†ต์‹  ํ™•์ธ +- โœ… Headscale ๊ด€๋ฆฌ ์ธํ„ฐํŽ˜์ด์Šค ์ •์ƒ ๋™์ž‘ + +์ด์ œ **Tailscale์„ ์™„์ „ํžˆ ๋Œ€์ฒด**ํ•  ์ˆ˜ ์žˆ๋Š” ์ž์ฒด ํ˜ธ์ŠคํŒ… VPN ์†”๋ฃจ์…˜์ด ๊ตฌ์ถ•๋˜์—ˆ์Šต๋‹ˆ๋‹ค! \ No newline at end of file diff --git a/INSTALLATION_GUIDE.md b/INSTALLATION_GUIDE.md new file mode 100644 index 0000000..2cf679e --- /dev/null +++ b/INSTALLATION_GUIDE.md @@ -0,0 +1,340 @@ +# ๐Ÿš€ Headscale + Headplane ์™„์ „ ์„ค์น˜ ๊ฐ€์ด๋“œ + +## ๐Ÿ“‹ ํ”„๋กœ์ ํŠธ ๊ฐœ์š” +- **๋ชฉํ‘œ**: Tailscale์„ ์™„์ „ํžˆ ๋Œ€์ฒดํ•˜๋Š” ์ž์ฒด ํ˜ธ์ŠคํŒ… VPN ์†”๋ฃจ์…˜ ๊ตฌ์ถ• +- **๊ธฐ์ˆ  ์Šคํƒ**: Docker, Docker Compose, Headscale, Headplane +- **ํ™˜๊ฒฝ**: Ubuntu 24.04 LTS, Docker 27.2.0 + +## ๐Ÿ› ๏ธ ์‚ฌ์ „ ์š”๊ตฌ์‚ฌํ•ญ +- Docker ๋ฐ Docker Compose ์„ค์น˜ +- 8070, 3000 ํฌํŠธ ์‚ฌ์šฉ ๊ฐ€๋Šฅ +- root ๊ถŒํ•œ ๋˜๋Š” sudo ๊ถŒํ•œ + +## ๐Ÿ“ ํ”„๋กœ์ ํŠธ ๊ตฌ์กฐ +``` +headscale-setup/ +โ”œโ”€โ”€ docker-compose.yml # Docker Compose ์„ค์ • +โ”œโ”€โ”€ .env # ํ™˜๊ฒฝ๋ณ€์ˆ˜ (API ํ‚ค ํฌํ•จ) +โ”œโ”€โ”€ .env.example # ํ™˜๊ฒฝ๋ณ€์ˆ˜ ํ…œํ”Œ๋ฆฟ +โ”œโ”€โ”€ config/ +โ”‚ โ””โ”€โ”€ config.yaml # Headscale ์ตœ์‹  ์„ค์ • +โ”œโ”€โ”€ headplane-config/ +โ”‚ โ””โ”€โ”€ config.yaml # Headplane ์„ค์ • +โ”œโ”€โ”€ data/ # SQLite ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค (์ž๋™ ์ƒ์„ฑ) +โ”œโ”€โ”€ run/ # ๋Ÿฐํƒ€์ž„ ํŒŒ์ผ (์ž๋™ ์ƒ์„ฑ) +โ””โ”€โ”€ start.sh # ์ž๋™ ์„ค์น˜ ์Šคํฌ๋ฆฝํŠธ +``` + +## ๐Ÿ”ง ์ƒ์„ธ ์„ค์น˜ ๊ณผ์ • + +### 1๋‹จ๊ณ„: ํ™˜๊ฒฝ ์ค€๋น„ +```bash +# ์ž‘์—… ๋””๋ ‰ํ† ๋ฆฌ ์ƒ์„ฑ +mkdir -p headscale-setup +cd headscale-setup + +# ํ•„์š”ํ•œ ํ•˜์œ„ ๋””๋ ‰ํ† ๋ฆฌ ์ƒ์„ฑ +mkdir -p config data run headplane-config +``` + +### 2๋‹จ๊ณ„: Docker Compose ์„ค์ • + +#### docker-compose.yml ์ž‘์„ฑ +```yaml +version: '3.8' + +services: + headscale: + image: headscale/headscale:latest + container_name: headscale + restart: unless-stopped + command: serve + environment: + - TZ=Asia/Seoul + volumes: + - ./config:/etc/headscale + - ./data:/var/lib/headscale + - ./run:/var/run/headscale + ports: + - "8070:8080" # ์™ธ๋ถ€:๋‚ด๋ถ€ (ํฌํŠธ ์ถฉ๋Œ ๋ฐฉ์ง€) + - "9090:9090" # ๋ฉ”ํŠธ๋ฆญ์Šค + networks: + - headscale-net + healthcheck: + test: ["CMD-SHELL", "nc -z localhost 8080 || exit 1"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s + + headplane: + image: ghcr.io/tale/headplane:latest + container_name: headplane + restart: unless-stopped + environment: + - TZ=Asia/Seoul + - HOST=0.0.0.0 + - PORT=3000 + - HEADSCALE_URL=http://headscale:8080 + - ROOT_API_KEY=${HEADSCALE_API_KEY} + - HEADSCALE_INTEGRATION=docker + - HEADSCALE_CONTAINER=headscale + - COOKIE_SECRET=headscale-ui-secret-key-change-me + - COOKIE_SECURE=false + - DISABLE_API_KEY_LOGIN=false + volumes: + - ./headplane-config:/etc/headplane + ports: + - "3000:3000" + depends_on: + - headscale + networks: + - headscale-net + +networks: + headscale-net: + driver: bridge +``` + +### 3๋‹จ๊ณ„: Headscale ์„ค์ • ํŒŒ์ผ + +#### config/config.yaml (์ตœ์‹  ํ˜•์‹) +```yaml +--- +server_url: http://localhost:8070 +listen_addr: 0.0.0.0:8080 +metrics_listen_addr: 0.0.0.0:9090 + +private_key_path: /var/lib/headscale/private.key +noise: + private_key_path: /var/lib/headscale/noise_private.key + +# ์ตœ์‹  ํ˜•์‹: prefixes ์‚ฌ์šฉ +prefixes: + v4: 100.64.0.0/10 + v6: fd7a:115c:a1e0::/48 + +derp: + server: + enabled: false + urls: + - https://controlplane.tailscale.com/derpmap/default + +disable_check_updates: false +ephemeral_node_inactivity_timeout: 30m + +database: + type: sqlite3 + sqlite: + path: /var/lib/headscale/db.sqlite + +# ์ตœ์‹  DNS ์„ค์ • ํ˜•์‹ +dns: + override_local_dns: true + nameservers: + global: + - 1.1.1.1 + - 8.8.8.8 + search_domains: [] + magic_dns: true + base_domain: headscale.local + +# ์ตœ์‹  ์ •์ฑ… ์„ค์ • +policy: + path: "" + +log: + format: text + level: info + +unix_socket: /var/run/headscale/headscale.sock +unix_socket_permission: "0770" + +logtail: + enabled: false + +randomize_client_port: false + +# ๊ฐ„์†Œํ™”๋œ OIDC ์„ค์ • +oidc: + only_start_if_oidc_is_available: false + issuer: "" + client_id: "" + client_secret: "" + scope: ["openid", "profile", "email"] + extra_params: {} + allowed_domains: [] + allowed_users: [] +``` + +### 4๋‹จ๊ณ„: ํ™˜๊ฒฝ๋ณ€์ˆ˜ ์„ค์ • + +#### .env.example +```bash +# Headscale API Key (์„ค์น˜ ํ›„ ์ž๋™ ์ƒ์„ฑ๋จ) +HEADSCALE_API_KEY=your_api_key_here + +# ์„œ๋ฒ„ ์„ค์ • +SERVER_URL=http://localhost:8070 +LISTEN_ADDR=0.0.0.0:8080 + +# ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค (SQLite ๊ธฐ๋ณธ) +DB_TYPE=sqlite3 +DB_PATH=/var/lib/headscale/db.sqlite + +# Magic DNS +MAGIC_DNS=true +BASE_DOMAIN=headscale.local + +# ๋„คํŠธ์›Œํฌ ์„ค์ • +IP_PREFIXES=100.64.0.0/10 + +# ์‹œ๊ฐ„๋Œ€ +TZ=Asia/Seoul +``` + +### 5๋‹จ๊ณ„: ์„ค์น˜ ์‹คํ–‰ + +#### ํ™˜๊ฒฝ๋ณ€์ˆ˜ ํŒŒ์ผ ๋ณต์‚ฌ +```bash +cp .env.example .env +``` + +#### ์ž๋™ ์„ค์น˜ ์Šคํฌ๋ฆฝํŠธ ์‹คํ–‰ +```bash +chmod +x start.sh +./start.sh +``` + +#### ๋˜๋Š” ์ˆ˜๋™ ์„ค์น˜ +```bash +# 1. Headscale ์‹œ์ž‘ +docker-compose up -d headscale + +# 2. API ํ‚ค ์ƒ์„ฑ (์•ฝ 30์ดˆ ๋Œ€๊ธฐ ํ›„) +sleep 30 +API_KEY=$(docker-compose exec -T headscale headscale apikeys create) +echo "Generated API Key: $API_KEY" + +# 3. .env ํŒŒ์ผ์— API ํ‚ค ์ž…๋ ฅ +sed -i "s/HEADSCALE_API_KEY=your_api_key_here/HEADSCALE_API_KEY=$API_KEY/" .env + +# 4. Headplane ์‹œ์ž‘ +docker-compose up -d headplane +``` + +## ๐ŸŽฏ ์ค‘์š”ํ•œ ์„ค์ • ๋ณ€๊ฒฝ์‚ฌํ•ญ + +### ํฌํŠธ ์ถฉ๋Œ ํ•ด๊ฒฐ +- **๊ธฐ์กด**: 8080:8080 (์ถฉ๋Œ ๋ฐœ์ƒ) +- **๋ณ€๊ฒฝ**: 8070:8080 (์™ธ๋ถ€ 8070 ํฌํŠธ ์‚ฌ์šฉ) + +### ์ตœ์‹  Headscale ์„ค์ • ํ˜•์‹ ์ ์šฉ +- `ip_prefixes` โ†’ `prefixes` (v4/v6 ๋ถ„๋ฆฌ) +- `dns_config` โ†’ `dns` (๊ตฌ์กฐ ๋ณ€๊ฒฝ) +- `acl_policy_path` โ†’ `policy.path` +- OIDC `strip_email_domain` ์ œ๊ฑฐ + +### Docker ํ—ฌ์Šค์ฒดํฌ ๊ฐœ์„  +- `curl` โ†’ `nc` (netcat ์‚ฌ์šฉ) +- Headplane ์˜์กด์„ฑ ์กฐ๊ฑด ์™„ํ™” + +## ๐Ÿ” ์„ค์น˜ ํ™•์ธ ๋ฐ ๊ฒ€์ฆ + +### 1. ์ปจํ…Œ์ด๋„ˆ ์ƒํƒœ ํ™•์ธ +```bash +docker-compose ps +``` + +### 2. Headscale API ํ…Œ์ŠคํŠธ +```bash +curl -s http://localhost:8070/health +# ์‘๋‹ต: {"status":"pass"} +``` + +### 3. ๋กœ๊ทธ ํ™•์ธ +```bash +docker-compose logs headscale +docker-compose logs headplane +``` + +### 4. ์‚ฌ์šฉ์ž ์ƒ์„ฑ +```bash +docker-compose exec headscale headscale users create myuser +``` + +### 5. ์‚ฌ์šฉ์ž ๋ชฉ๋ก ํ™•์ธ +```bash +docker-compose exec headscale headscale users list +``` + +### 6. Pre-auth ํ‚ค ์ƒ์„ฑ +```bash +docker-compose exec headscale headscale preauthkeys create --user 1 --reusable --expiration 24h +``` + +## ๐Ÿšจ ๋ฌธ์ œ ํ•ด๊ฒฐ + +### ํฌํŠธ ์ถฉ๋Œ ๋ฌธ์ œ +```bash +# 8080 ํฌํŠธ ์‚ฌ์šฉ ์ค‘์ธ ํ”„๋กœ์„ธ์Šค ํ™•์ธ +lsof -i :8080 + +# ํฌํŠธ๋ฅผ 8070์œผ๋กœ ๋ณ€๊ฒฝํ•˜์—ฌ ํ•ด๊ฒฐ +``` + +### Headplane ์„ค์ • ํŒŒ์ผ ๋ฌธ์ œ +```bash +# ๋นˆ ์„ค์ • ํŒŒ์ผ ์ƒ์„ฑ +echo "# Minimal config file for Headplane" > headplane-config/config.yaml + +# ํ™˜๊ฒฝ๋ณ€์ˆ˜ ์šฐ์„  ์‚ฌ์šฉ ์„ค์ • +``` + +### ํ—ฌ์Šค์ฒดํฌ ์‹คํŒจ +```bash +# wget ๋Œ€์‹  netcat ์‚ฌ์šฉ +# CMD-SHELL์„ ์‚ฌ์šฉํ•˜์—ฌ ํ˜ธํ™˜์„ฑ ๊ฐœ์„  +``` + +## ๐Ÿ“Š ์ตœ์ข… ์„ค์น˜ ๊ฒฐ๊ณผ + +### ์ ‘์† ์ •๋ณด +- **Headscale API**: http://localhost:8070 +- **Headplane UI**: http://localhost:3000 (์„ค์ • ์ค‘) +- **๋ฉ”ํŠธ๋ฆญ์Šค**: http://localhost:9090 + +### ์ƒ์„ฑ๋œ ์ •๋ณด +- **์‚ฌ์šฉ์ž**: myuser (ID: 1) +- **API ํ‚ค**: ์ž๋™ ์ƒ์„ฑ๋จ +- **Pre-auth ํ‚ค**: 24์‹œ๊ฐ„ ์œ ํšจ, ์žฌ์‚ฌ์šฉ ๊ฐ€๋Šฅ + +### ๋„คํŠธ์›Œํฌ ์„ค์ • +- **IPv4**: 100.64.0.0/10 +- **IPv6**: fd7a:115c:a1e0::/48 +- **Magic DNS**: headscale.local + +## ๐Ÿ”„ Git ๊ด€๋ฆฌ + +### ๋ธŒ๋žœ์น˜ ์ „๋žต +```bash +# ๊ธฐ๋Šฅ ๋ธŒ๋žœ์น˜ ์ƒ์„ฑ +git checkout -b feature/working-headscale-setup + +# ๋ณ€๊ฒฝ์‚ฌํ•ญ ์ปค๋ฐ‹ +git add . +git commit -m "๐ŸŽ‰ Working Headscale Setup Complete" + +# ์›๊ฒฉ ์ €์žฅ์†Œ ํ‘ธ์‹œ +git push -u origin feature/working-headscale-setup +``` + +## ๐Ÿ“ˆ ๋‹ค์Œ ๋‹จ๊ณ„ +1. Tailscale ํด๋ผ์ด์–ธํŠธ ์—ฐ๊ฒฐ ํ…Œ์ŠคํŠธ +2. HTTPS/TLS ์ธ์ฆ์„œ ๊ตฌ์„ฑ +3. Headplane ํ•œ๊ธ€ํ™” ์ž‘์—… +4. ACL ๋ณด์•ˆ ๊ทœ์น™ ์„ค์ • +5. ๋ฐฑ์—… ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง ๊ตฌ์„ฑ + +## ๐ŸŽ‰ ๊ฒฐ๋ก  +Headscale๊ณผ Headplane์„ ์‚ฌ์šฉํ•œ ์™„์ „ํ•œ ์ž์ฒด ํ˜ธ์ŠคํŒ… VPN ์†”๋ฃจ์…˜์ด ์„ฑ๊ณต์ ์œผ๋กœ ๊ตฌ์ถ•๋˜์—ˆ์Šต๋‹ˆ๋‹ค. ์ด์ œ Tailscale์„ ์™„์ „ํžˆ ๋Œ€์ฒดํ•  ์ˆ˜ ์žˆ๋Š” ํ™˜๊ฒฝ์ด ์ค€๋น„๋˜์—ˆ์Šต๋‹ˆ๋‹ค. \ No newline at end of file