Update Tailscale to v1.96.2

The tailscaled.state file in localdata will now persist across updates, so your camera stays connected to Tailscale without re-authentication

.github/workflows/build.yml

@@ -2,7 +2,7 @@ name: Auto Build & Release Tailscale ACAP
 
 on:
   schedule:
-    - cron: "0 3 * * 1"   # Every Monday at 03:00 UTC
+    - cron: "0 0 * * *"   # Every Monday at 03:00 UTC
   workflow_dispatch:
 
 jobs:
@@ -20,8 +20,28 @@ jobs:
     - name: Get latest Tailscale version
       id: tailscale_version
       run: |
-        VERSION=$(curl -s https://api.github.com/repos/tailscale/tailscale/releases/latest | jq -r .tag_name)
-        VERSION=${VERSION#v}  # remove leading 'v'
+        # 1. Start from GitHub latest
+        GH_TAG=$(curl -s https://api.github.com/repos/tailscale/tailscale/releases/latest | jq -r .tag_name)
+        GH_VERSION=${GH_TAG#v}
+
+        echo "GitHub latest: $GH_VERSION"
+
+        # 2. See if static ARM build exists for that version
+        if curl -sfI "https://pkgs.tailscale.com/stable/tailscale_${GH_VERSION}_arm.tgz" > /dev/null; then
+          VERSION="$GH_VERSION"
+          echo "Using GitHub latest (has ARM package): $VERSION"
+        else
+          echo "No ARM package for $GH_VERSION, falling back to latest version on pkgs.tailscale.com"
+          # 3. Derive latest version that actually has an ARM tarball
+          VERSION=$(
+            curl -s https://pkgs.tailscale.com/stable/ \
+            | grep -o 'tailscale_[0-9.]*_arm\.tgz' \
+            | sed -E 's/^tailscale_([0-9.]+)_arm\.tgz$/\1/' \
+            | sort -V | tail -n1
+          )
+          echo "Fallback version: $VERSION"
+        fi
+
         echo "RELEASE_VERSION=$VERSION" >> $GITHUB_ENV
         echo "version=$VERSION" >> $GITHUB_OUTPUT
     
@@ -128,8 +148,8 @@ jobs:
       run: |
         git config user.name "github-actions[bot]"
         git config user.email "github-actions[bot]@users.noreply.github.com"
-
-        git add */app/manifest.json releases/*
+        # Only commit manifests; do not track release artifacts
+        git add */app/manifest.json
         if git diff --cached --quiet; then
           echo "No changes to commit"
         else

.gitignore

@@ -1,2 +1,10 @@
 **/.DS_Store
 **/build
+
+# Do not track release artifacts
+releases/
+build/
+
+# Do not track downloaded Tailscale tarballs and temp bins
+tailscale_bins/
+*.tgz

README.md

@@ -1,105 +1,143 @@
-# The Tailscale installer ACAP
+# Tailscale Installer ACAP for Axis Cameras
 
-This ACAP packages the scripts and files required to install the Tailscale VPN client on Axis Cameras.
+This repository contains an **ACAP package** that installs the [Tailscale VPN client](https://tailscale.com/) on Axis cameras.
 
-The "ROOT" versions require root privileges on the camera and will not work on OS 12 up.
+- ✅ Secure remote access to cameras  
+- ✅ Easy to install via EAP package  
+- ✅ Works on **Axis OS 12+** (non-root version)  
+- ✅ Based on **WireGuard VPN** technology  
 
-If you like my work and want to help me to keep maintaining it, a sponsor would be amazing, every bit helps.
+[![Releases](https://img.shields.io/github/v/release/Mo3he/Axis_Cam_Tailscale)](https://github.com/Mo3he/Axis_Cam_Tailscale/releases)  
+[![License](https://img.shields.io/github/license/Mo3he/Axis_Cam_Tailscale)](LICENSE)  
+[![Sponsor](https://img.shields.io/badge/sponsor-%E2%9D%A4-lightgrey?logo=github)](https://github.com/sponsors/Mo3he)
 
-[:dollar: Sponsor](https://github.com/sponsors/Mo3he)
+---
 
-## Testers needed
+## 📑 Table of Contents
 
-I have added a new "custom" version which allows you to set a custom server and auth key for use of headscale.
+- [📥 Installation](#-installation)  
+- [🚀 Usage](#-usage)  
+- [🔄 Updating Tailscale](#-updating-tailscale)  
+- [🧪 Testers Needed](#-testers-needed)  
+- [🎉 Good News](#-good-news)  
+- [🎯 Purpose](#-purpose)  
+- [🔗 Useful Links](#-useful-links)  
+- [🖥️ Compatibility](#️-compatibility)  
+- [⭐ Star History](#-star-history)  
+- [💖 Support](#-support)  
 
-Click the three dots then "settings" to add your details.
-If you get a tls error restart the app.
+---
 
-Please give it a try and let me know if it works well or if you have issues.
+## 📥 Installation
 
-## Good news, everyone!
+The recommended way is to use the **prebuilt `.eap` file** from the [Releases page](https://github.com/Mo3he/Axis_Cam_Tailscale/releases).
 
-We have found a way to run the Tailscale ACAP without root privileges allowing it to run on Axis OS 12.
+1. Log into your Axis camera.  
+2. Go to **Apps → Add App**.  
+3. Upload the `.eap` file.  
 
-Please note this new version runs in user space networking mode and therefore has some limitations, most notably the camera will not be able to connect out to other Tailscale nodes.
-This does not affect the normal use case of using Tailscale to connect to the camera.
-If you require full functionality, please do not upgrade to Axis OS 12 and use the version marked "ROOT".
+Once installed:
+- Start the app. 
+- Click **Open** to view logs and get your Tailscale authentication URL.  
+- On uninstall, all changes/files are removed.  
 
-The changes are implemented from version 1.68.1 of the acap.
+> ⚠️ You’ll need a [Tailscale account](https://tailscale.com/) to authenticate.
 
-Thank you for your continued support.
+---
 
-## Purpose
+## 🚀 Usage
 
-Adding a VPN client directly to the camera allows secure remote access to the device without requiring any other equipment or network configuration.
-Tailscale achieves this in a secure, simple to setup and easy to use way.
-Tailscale is based on WireGuard VPN tunneling technology.
+- Runs a startup script to set permissions and launch Tailscale.  
+- View logs via the **Open** button in the app.  
+- Authenticate using the provided URL.  
 
-https://tailscale.com/blog/how-tailscale-works/
+---
 
-## Links
+## 🔄 Updating Tailscale
 
-https://tailscale.com/
+- New `.eap` files are auto-built and released **weekly** (if a new Tailscale version is available).  
+- To update, simply install the new `.eap` over the existing one.  
 
-https://github.com/tailscale/tailscale 
+### Manual update (advanced)
 
-https://www.wireguard.com/
+Replace the binaries in the `lib/` folder:
+- `tailscale`
+- `tailscaled`
 
-https://www.axis.com/
+Download the latest versions: [Tailscale static builds](https://pkgs.tailscale.com/stable/#static)
 
-## Compatibility
+#### Build locally
 
-The Tailscale ACAP is compatable with Axis cameras with arm and aarch64 based Soc's.
+From the main directory of the version you want (`arm` / `aarch64`):
 
-```
-curl --anyauth "*" -u <username>:<password> <device ip>/axis-cgi/basicdeviceinfo.cgi --data "{\"apiVersion\":\"1.0\",\"context\":\"Client defined request ID\",\"method\":\"getAllProperties\"}"
+```bash
+docker build --tag <package_name> .
+docker cp $(docker create <package_name>):/opt/app ./build
 ```
 
-where `<device ip>` is the IP address of the Axis device, `<username>` is the root username and `<password>` is the root password. Please
-note that you need to enclose your password with quotes (`'`) if it contains special characters.
+---
 
-## Installing
+## 🧪 Testers Needed
 
-The recommended way to install this ACAP is to use the pre built eap file.
-Go to "Apps" on the camera and click "Add app".
+A new **custom** version is available:
+- Allows setting a custom server and auth key (for [Headscale](https://headscale.net/)).  
+- Go to **Settings (⋮ → Settings)** to add your details.   
 
+Please give it a try and share your feedback!
 
-## Using the Tailscale ACAP
+---
 
-The Tailscale ACAP will run a script on startup that sets the required permissions and starts the service and app.
-Once started click "Open" to see the output of the logs for further instructions and obtain the authetication URL.
+## 🎉 Good News
 
-When uninstalling the ACAP, all changes and files are removed from the camera.
+Tailscale ACAP can now run **without root privileges**, making it compatible with **Axis OS 12+**.  
 
-You will need a tailscale.com account to use the ACAP
+- Runs in **user space networking mode**.  
 
-## Updating Tailscale version
+For **full networking features**, use the **ROOT** version on Axis OS < 12.
 
-The eap files will be auto built and released every Monday if there is a new version and simply installing the new version over the old will update all files.
+---
 
-It's also possible to build and use a locally built image as all necesary files are provided.
+## 🎯 Purpose
 
-Replace binaries "tailscale" and "tailscaled" in lib folder with new versions.
-Make sure you use the files for the correct Soc.
+Adding a VPN client directly to the camera enables:  
+- Secure remote access without additional hardware or complex network configuration.  
+- Easy setup through Tailscale’s lightweight WireGuard-based tunnel.  
 
-Latest versions can be found at 
+🔗 Learn more: [How Tailscale Works](https://tailscale.com/blog/how-tailscale-works/)
 
-https://pkgs.tailscale.com/stable/#static
+---
 
+## 🔗 Useful Links
 
-To build, 
-From main directory of the version you want (arm/aarch64)
+- [Tailscale](https://tailscale.com/)  
+- [Tailscale GitHub](https://github.com/tailscale/tailscale)  
+- [WireGuard](https://www.wireguard.com/)  
+- [Axis Communications](https://www.axis.com/)  
 
-```
-docker build --tag <package name> . 
-```
-```
-docker cp $(docker create <package name>):/opt/app ./build 
+---
+
+## 🖥️ Compatibility
+
+The Tailscale ACAP is compatible with Axis cameras with **ARM** and **AARCH64**-based SoCs.
+
+You can verify your device details using the following command:
+
+```bash
+curl --anyauth "*" -u <username>:<password> <device_ip>/axis-cgi/basicdeviceinfo.cgi --data '{"apiVersion":"1.0","context":"Client defined request ID","method":"getAllProperties"}'
 ```
 
+> Replace `<device_ip>`, `<username>`, and `<password>` with your device credentials.  
+> Enclose your password in quotes `' '` if it contains special characters.
 
-## Star History
+---
+
+## ⭐ Star History
 
 [![Star History Chart](https://api.star-history.com/svg?repos=Mo3he/Axis_Cam_Tailscale&type=Date)](https://www.star-history.com/#Mo3he/Axis_Cam_Tailscale&Date)
 
+---
 
+## 💖 Support
+
+If you like this project and want to support future updates:  
+👉 [Sponsor Me](https://github.com/sponsors/Mo3he)

aarch64/app/Tailscale_VPN

@@ -1,10 +1,30 @@
 #!/bin/sh
 
-    echo "Starting Service"
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscale
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscaled
-    /usr/local/packages/Tailscale_VPN/lib/tailscaled --tun=userspace-networking --socket=/usr/local/packages/Tailscale_VPN/tailscaled.sock &
-    echo "Service Started"
-    echo "Scroll to Bottom for link"
-    /usr/local/packages/Tailscale_VPN/lib/tailscale --socket=/usr/local/packages/Tailscale_VPN/tailscaled.sock up
-    wait
+echo "Starting Service"
+
+# Define paths
+APP_DIR="/usr/local/packages/Tailscale_VPN"
+STATE_DIR="$APP_DIR/localdata"
+
+# Create localdata directory if it doesn't exist
+mkdir -p "$STATE_DIR"
+
+# Set permissions
+chmod 777 "$APP_DIR/lib/tailscale"
+chmod 777 "$APP_DIR/lib/tailscaled"
+
+# Start tailscaled with state stored in localdata
+"$APP_DIR/lib/tailscaled" \
+    --state="$STATE_DIR/tailscaled.state" \
+    --socket="$STATE_DIR/tailscaled.sock" \
+    --socks5-server=localhost:1055 \
+    --tun=userspace-networking &
+
+echo "Service Started"
+sleep 2
+echo "Scroll to Bottom for link"
+
+# Run tailscale up with the socket in localdata
+"$APP_DIR/lib/tailscale" --socket="$STATE_DIR/tailscaled.sock" up
+
+wait

aarch64/app/manifest.json

@@ -8,11 +8,11 @@
             "embeddedSdkVersion": "3.0",
             "vendorUrl": "https://www.tailscale.com",
             "runMode": "once",
-            "version": "1.88.3",
+            "version": "1.96.2",
             "architecture": "aarch64"
         },
         "configuration": {
             "settingPage": "index.html"
         }
     }
-}
+}

aarch64_ROOT/app/Tailscale_VPN

@@ -1,10 +1,28 @@
 #!/bin/sh
 
-    echo "Starting Service"
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscale
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscaled
-    /usr/local/packages/Tailscale_VPN/lib/tailscaled &
-    echo "Service Started"
-    echo "Scroll to Bottom for link"
-    /usr/local/packages/Tailscale_VPN/lib/tailscale up --accept-routes
-    wait
+echo "Starting Service"
+
+# Define paths
+APP_DIR="/usr/local/packages/Tailscale_VPN"
+STATE_DIR="$APP_DIR/localdata"
+
+# Create localdata directory if it doesn't exist
+mkdir -p "$STATE_DIR"
+
+# Set permissions
+chmod 777 "$APP_DIR/lib/tailscale"
+chmod 777 "$APP_DIR/lib/tailscaled"
+
+# Start tailscaled with state stored in localdata
+"$APP_DIR/lib/tailscaled" \
+    --state="$STATE_DIR/tailscaled.state" \
+    --socket="$STATE_DIR/tailscaled.sock" &
+
+echo "Service Started"
+sleep 2
+echo "Scroll to Bottom for link"
+
+# Run tailscale up with the socket in localdata
+"$APP_DIR/lib/tailscale" --socket="$STATE_DIR/tailscaled.sock" up --accept-routes
+
+wait

aarch64_ROOT/app/manifest.json

@@ -12,11 +12,11 @@
           },
             "vendorUrl": "https://www.tailscale.com",
             "runMode": "once",
-            "version": "1.88.3",
+            "version": "1.96.2",
             "architecture": "aarch64"
         },
         "configuration": {
             "settingPage": "index.html"
         }
     }
-}
+}

aarch64_custom/app/config_updater.c

@@ -17,7 +17,9 @@
 #include <errno.h>
 
 #define APP_NAME "serverconfig"
-#define CONFIG_FILE "/usr/local/packages/serverconfig/config.txt"
+#define APP_DIR "/usr/local/packages/serverconfig"
+#define STATE_DIR APP_DIR "/localdata"
+#define CONFIG_FILE STATE_DIR "/config.txt"
 #define SCRIPT_PATH "/usr/local/packages/serverconfig/start_tailscale.sh"
 #define SCRIPT_SOURCE "/usr/local/packages/serverconfig/lib/start_tailscale.sh"
 
@@ -27,6 +29,19 @@ static gboolean signal_handler(gpointer loop) {
     return G_SOURCE_REMOVE;
 }
 
+// Create localdata directory
+static void ensure_localdata_exists(void) {
+    struct stat st = {0};
+    
+    if (stat(STATE_DIR, &st) == -1) {
+        if (mkdir(STATE_DIR, 0755) != 0) {
+            syslog(LOG_ERR, "Failed to create localdata directory: %s", strerror(errno));
+        } else {
+            syslog(LOG_INFO, "Created localdata directory: %s", STATE_DIR);
+        }
+    }
+}
+
 // Copy script from lib folder to main directory
 static void copy_script_file(void) {
     char buffer[4096];
@@ -109,6 +124,9 @@ static void update_config_file(AXParameter* handle) {
     gchar* key_value = NULL;
     FILE* file;
     
+    // Ensure localdata directory exists
+    ensure_localdata_exists();
+    
     // Get parameter values
     if (!ax_parameter_get(handle, "CustomServer", &server_value, &error)) {
         syslog(LOG_ERR, "Failed to get CustomServer: %s", 
@@ -125,7 +143,7 @@ static void update_config_file(AXParameter* handle) {
         key_value = g_strdup("");
     }
     
-    // Write to config file
+    // Write to config file in localdata
     file = fopen(CONFIG_FILE, "w");
     if (file) {
         fprintf(file, "custom_server=%s\n", server_value ? server_value : "");
@@ -135,12 +153,12 @@ static void update_config_file(AXParameter* handle) {
         // Set permissions to ensure the file is readable
         chmod(CONFIG_FILE, 0644);
         
-        syslog(LOG_INFO, "Updated configuration file: custom_server=%s", 
+        syslog(LOG_INFO, "Updated configuration file in local custom_server=%s", 
                server_value ? server_value : "");
-        syslog(LOG_INFO, "Updated configuration file: auth_key=%s", 
+        syslog(LOG_INFO, "Updated configuration file in local auth_key=%s", 
                key_value && strlen(key_value) > 0 ? "(set)" : "(empty)");
     } else {
-        syslog(LOG_ERR, "Failed to open config file for writing");
+        syslog(LOG_ERR, "Failed to open config file for writing: %s", strerror(errno));
     }
     
     // Clean up
@@ -185,6 +203,9 @@ int main(void) {
         exit(1);
     }
 
+    // Ensure localdata directory exists
+    ensure_localdata_exists();
+    
     // Ensure script is copied from lib folder
     copy_script_file();
 
@@ -229,4 +250,4 @@ int main(void) {
     ax_parameter_free(handle);
     
     return 0;
-}
+}

aarch64_custom/app/lib/start_tailscale.sh

@@ -5,10 +5,15 @@
 pkill -f tailscaled || true
 
 # Simple script to start Tailscale with custom configuration
-CONFIG_FILE="/usr/local/packages/serverconfig/config.txt"
-TAILSCALED_PATH="/usr/local/packages/serverconfig/lib/tailscaled"
-TAILSCALE_PATH="/usr/local/packages/serverconfig/lib/tailscale"
-SOCKET_PATH="/usr/local/packages/serverconfig/tailscaled.sock"
+APP_DIR="/usr/local/packages/serverconfig"
+STATE_DIR="$APP_DIR/localdata"
+CONFIG_FILE="$STATE_DIR/config.txt"
+TAILSCALED_PATH="$APP_DIR/lib/tailscaled"
+TAILSCALE_PATH="$APP_DIR/lib/tailscale"
+SOCKET_PATH="$STATE_DIR/tailscaled.sock"
+
+# Create localdata directory if it doesn't exist
+mkdir -p "$STATE_DIR"
 
 # Log to syslog
 logger -t "tailscale_script" "Starting Tailscale VPN service"
@@ -31,9 +36,13 @@ if [ -f "$CONFIG_FILE" ]; then
     done < "$CONFIG_FILE"
 fi
 
-# Start tailscaled
+# Start tailscaled with state stored in localdata
 logger -t "tailscale_script" "Starting tailscaled daemon"
-$TAILSCALED_PATH --tun=userspace-networking --socket=$SOCKET_PATH &
+$TAILSCALED_PATH \
+    --state="$STATE_DIR/tailscaled.state" \
+    --socket=$SOCKET_PATH \
+    --socks5-server=localhost:1055 \
+    --tun=userspace-networking &
 TAILSCALED_PID=$!
 
 # Wait for tailscaled to initialize
@@ -61,4 +70,4 @@ logger -t "tailscale_script" "Tailscale VPN is running"
 logger -t "tailscale_script" "To change settings, modify parameters in ACAP web interface"
 
 # Wait for tailscaled process to exit
-wait $TAILSCALED_PID
+wait $TAILSCALED_PID

aarch64_custom/app/manifest.json

@@ -8,7 +8,7 @@
             "embeddedSdkVersion": "3.0",
             "vendorUrl": "https://www.tailscale.com",
             "runMode": "respawn",
-            "version": "1.88.3"
+            "version": "1.96.2"
         },
         "configuration": {
             "settingPage": "index.html",
@@ -26,4 +26,4 @@
             ]
         }
     }
-}
+}

arm/app/Tailscale_VPN

@@ -1,10 +1,30 @@
 #!/bin/sh
 
-    echo "Starting Service"
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscale
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscaled
-    /usr/local/packages/Tailscale_VPN/lib/tailscaled --tun=userspace-networking --socket=/usr/local/packages/Tailscale_VPN/tailscaled.sock &
-    echo "Service Started"
-    echo "Scroll to Bottom for link"
-    /usr/local/packages/Tailscale_VPN/lib/tailscale --socket=/usr/local/packages/Tailscale_VPN/tailscaled.sock up
-    wait
+echo "Starting Service"
+
+# Define paths
+APP_DIR="/usr/local/packages/Tailscale_VPN"
+STATE_DIR="$APP_DIR/localdata"
+
+# Create localdata directory if it doesn't exist
+mkdir -p "$STATE_DIR"
+
+# Set permissions
+chmod 777 "$APP_DIR/lib/tailscale"
+chmod 777 "$APP_DIR/lib/tailscaled"
+
+# Start tailscaled with state stored in localdata
+"$APP_DIR/lib/tailscaled" \
+    --state="$STATE_DIR/tailscaled.state" \
+    --socket="$STATE_DIR/tailscaled.sock" \
+    --socks5-server=localhost:1055 \
+    --tun=userspace-networking &
+
+echo "Service Started"
+sleep 2
+echo "Scroll to Bottom for link"
+
+# Run tailscale up with the socket in localdata
+"$APP_DIR/lib/tailscale" --socket="$STATE_DIR/tailscaled.sock" up
+
+wait

arm/app/manifest.json

@@ -8,11 +8,11 @@
             "embeddedSdkVersion": "3.0",
             "vendorUrl": "https://www.tailscale.com",
             "runMode": "once",
-            "version": "1.88.3",
+            "version": "1.96.2",
             "architecture": "armv7hf"
         },
         "configuration": {
             "settingPage": "index.html"
         }
     }
-}
+}

arm_ROOT/app/Tailscale_VPN

@@ -1,10 +1,28 @@
 #!/bin/sh
 
-    echo "Starting Service"
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscale
-    chmod 777 /usr/local/packages/Tailscale_VPN/lib/tailscaled
-    /usr/local/packages/Tailscale_VPN/lib/tailscaled &
-    echo "Service Started"
-    echo "Scroll to Bottom for link"
-    /usr/local/packages/Tailscale_VPN/lib/tailscale up --accept-routes
-    wait
+echo "Starting Service"
+
+# Define paths
+APP_DIR="/usr/local/packages/Tailscale_VPN"
+STATE_DIR="$APP_DIR/localdata"
+
+# Create localdata directory if it doesn't exist
+mkdir -p "$STATE_DIR"
+
+# Set permissions
+chmod 777 "$APP_DIR/lib/tailscale"
+chmod 777 "$APP_DIR/lib/tailscaled"
+
+# Start tailscaled with state stored in localdata
+"$APP_DIR/lib/tailscaled" \
+    --state="$STATE_DIR/tailscaled.state" \
+    --socket="$STATE_DIR/tailscaled.sock" &
+
+echo "Service Started"
+sleep 2
+echo "Scroll to Bottom for link"
+
+# Run tailscale up with the socket in localdata
+"$APP_DIR/lib/tailscale" --socket="$STATE_DIR/tailscaled.sock" up --accept-routes
+
+wait

arm_ROOT/app/manifest.json

@@ -12,11 +12,11 @@
           },
             "vendorUrl": "https://www.tailscale.com",
             "runMode": "once",
-            "version": "1.88.3",
+            "version": "1.96.2",
             "architecture": "armv7hf"
         },
         "configuration": {
             "settingPage": "index.html"
         }
     }
-}
+}