Axis_Cam_Tailscale/common/app/Tailscale_VPN_run

#!/bin/sh
# Tailscale VPN run script — called by the param_bridge C binary.
# Config is sourced from $STATE_DIR/params.conf (written by param_bridge).
# $1 selects the variant: "standard" (userspace networking + local proxies)
# or "root" (kernel networking, no local proxy). Defaults to "standard".
VARIANT="${1:-standard}"

killall tailscaled 2>/dev/null || true

APP_DIR="/usr/local/packages/Tailscale_VPN"
STATE_DIR="$APP_DIR/localdata"
TAILSCALED_PATH="$APP_DIR/lib/tailscaled"
TAILSCALE_PATH="$APP_DIR/lib/tailscale"
SOCKET_PATH="$STATE_DIR/tailscaled.sock"

mkdir -p "$STATE_DIR"
chmod 755 $TAILSCALED_PATH
chmod 755 $TAILSCALE_PATH

# Defaults — overridden by sourcing params.conf written by param_bridge
CUSTOM_SERVER=""
AUTH_KEY=""
CONF_HTTP="8080"
CONF_SOCKS="1080"
ACCEPT_DNS="false"
ACCEPT_ROUTES="false"
ADVERTISE_ROUTES=""

if [ -f "$STATE_DIR/params.conf" ]; then
    . "$STATE_DIR/params.conf"
fi

if [ "$VARIANT" = "root" ]; then
    logger -t "Tailscale_VPN" "Starting (root mode): custom_server=${CUSTOM_SERVER:-(default)}"
else
    logger -t "Tailscale_VPN" "Starting: http_port=$CONF_HTTP socks_port=$CONF_SOCKS custom_server=${CUSTOM_SERVER:-(default)}"

    # Check whether a TCP port is already bound
    is_port_in_use() {
        local port=$1
        local hex_port
        hex_port=$(printf '%04X' "$port")
        grep -q ":${hex_port} " /proc/net/tcp  2>/dev/null && return 0
        grep -q ":${hex_port} " /proc/net/tcp6 2>/dev/null && return 0
        return 1
    }

    if is_port_in_use "$CONF_HTTP"; then
        logger -t "Tailscale_VPN" "ERROR: HTTP proxy port $CONF_HTTP is already in use. Change it in Settings."
        exit 1
    fi
    if is_port_in_use "$CONF_SOCKS"; then
        logger -t "Tailscale_VPN" "ERROR: SOCKS5 port $CONF_SOCKS is already in use. Change it in Settings."
        exit 1
    fi
fi

logger -t "Tailscale_VPN" "Starting tailscaled daemon"
if [ "$VARIANT" = "root" ]; then
    $TAILSCALED_PATH \
        --state="$STATE_DIR/tailscaled.state" \
        --socket=$SOCKET_PATH \
        >/dev/null 2>&1 &
else
    $TAILSCALED_PATH \
        --state="$STATE_DIR/tailscaled.state" \
        --socket=$SOCKET_PATH \
        --socks5-server=localhost:$CONF_SOCKS \
        --outbound-http-proxy-listen=localhost:$CONF_HTTP \
        --tun=userspace-networking \
        >/dev/null 2>&1 &
fi
TAILSCALED_PID=$!

sleep 2

TAILSCALE_CMD="$TAILSCALE_PATH --socket=$SOCKET_PATH up --reset --hostname=$(hostname)"

if [ -n "$CUSTOM_SERVER" ]; then
    TAILSCALE_CMD="$TAILSCALE_CMD --login-server $CUSTOM_SERVER"
fi

if [ -n "$AUTH_KEY" ]; then
    TAILSCALE_CMD="$TAILSCALE_CMD --authkey $AUTH_KEY"
fi

if [ "$ACCEPT_DNS" = "true" ]; then
    TAILSCALE_CMD="$TAILSCALE_CMD --accept-dns=true"
fi

if [ "$ACCEPT_ROUTES" = "true" ]; then
    TAILSCALE_CMD="$TAILSCALE_CMD --accept-routes=true"
fi

# Advertise LAN subnets so this camera acts as a subnet router. Comma-separated
# CIDRs (e.g. 192.168.1.0/24,10.0.0.0/8). In userspace-networking mode the
# tailscaled netstack forwards tailnet traffic to these subnets, so no kernel IP
# forwarding is required. In kernel-networking (root) mode the host must
# forward packets between the tailnet and the LAN, so enable IP forwarding.
# Routes must still be approved in the Tailscale admin console either way.
if [ -n "$ADVERTISE_ROUTES" ]; then
    if [ "$VARIANT" = "root" ]; then
        echo 1 > /proc/sys/net/ipv4/ip_forward 2>/dev/null || true
        echo 1 > /proc/sys/net/ipv6/conf/all/forwarding 2>/dev/null || true
    fi
    TAILSCALE_CMD="$TAILSCALE_CMD --advertise-routes=$ADVERTISE_ROUTES"
fi

# Run `tailscale up` in the background and act on its outcome. If the node needs
# (re-)authentication, `up` blocks until the user logs in; backgrounding it
# ensures the status publisher below keeps running so the UI can surface the
# login URL (tailscaled reports BackendState=NeedsLogin + AuthURL while waiting).
# NOTE: `up` runs synchronously *inside* this backgrounded block so its real exit
# code is captured directly. We must NOT background `up` separately and `wait`
# for it from here, because in POSIX sh `wait` only works on children of the
# current shell — a subshell waiting on the parent's child returns 127.
{
    eval "$TAILSCALE_CMD"
    up_exit=$?
    if [ "$up_exit" -eq 0 ]; then
        if [ "$VARIANT" = "root" ]; then
            logger -t "Tailscale_VPN" "Tailscale VPN is running (root mode)"
        else
            logger -t "Tailscale_VPN" "Tailscale VPN is running"
        fi
        # Auth succeeded with a one-time auth key — signal param_bridge to clear it
        if [ -n "$AUTH_KEY" ]; then
            : > "$STATE_DIR/authkey_clear"
        fi
    else
        logger -t "Tailscale_VPN" "ERROR: tailscale up failed (exit $up_exit)"
    fi
} &
TAILSCALE_UP_PID=$!

if [ "$VARIANT" != "root" ]; then
    logger -t "Tailscale_VPN" "HTTP/HTTPS proxy: http://127.0.0.1:$CONF_HTTP"
    logger -t "Tailscale_VPN" "SOCKS5 proxy:     127.0.0.1:$CONF_SOCKS"
fi

# Publish tailscale's real backend state as JSON for the web UI to consume.
# This is the authoritative connection signal (BackendState / Self.Online /
# TailscaleIPs / AuthURL) instead of scraping syslog. Served statically at
# /local/Tailscale_VPN/status.json.
STATUS_FILE="$APP_DIR/html/status.json"

publish_status() {
    if "$TAILSCALE_PATH" --socket="$SOCKET_PATH" status --json > "$STATUS_FILE.tmp" 2>/dev/null; then
        mv "$STATUS_FILE.tmp" "$STATUS_FILE" 2>/dev/null
        chmod 644 "$STATUS_FILE" 2>/dev/null
    else
        rm -f "$STATUS_FILE.tmp" 2>/dev/null
    fi
}

status_loop() {
    while true; do
        publish_status
        sleep 5
    done
}
status_loop &
STATUS_LOOP_PID=$!

# Clean up the status writer, up watcher, daemon and published status on
# stop/restart so param_bridge (which signals this script) leaves no orphans or
# stale state.
cleanup() {
    [ -n "$STATUS_LOOP_PID" ]   && kill "$STATUS_LOOP_PID"   2>/dev/null
    [ -n "$TAILSCALE_UP_PID" ]  && kill "$TAILSCALE_UP_PID"  2>/dev/null
    [ -n "$TAILSCALED_PID" ]    && kill "$TAILSCALED_PID"    2>/dev/null
    rm -f "$STATUS_FILE" 2>/dev/null
    exit 0
}
trap cleanup TERM INT

wait $TAILSCALED_PID