1
2
3

curl -fsSL https://get.docker.com | bash -s docker
# 国内
curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

1
2
3
4
5
6
7
8
9

docker run -d \
  --name derper \
  --restart always \
  -p 12345:12345 \
  -p 3478:3478/udp \
  -e DERP_ADDR=:12345 \
  -e DERP_CERTS=/app/certs \
  -e DERP_VERIFY_CLIENTS=false \
  ghcr.io/yangchuansheng/ip_derper:latest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

services:
  derper:
    image: ghcr.io/yangchuansheng/ip_derper:latest
    container_name: derper
    restart: always
    ports:
      - "12345:12345"
      - "3478:3478/udp"
    environment:
      - DERP_ADDR=:12345
      - DERP_CERTS=/app/certs
      - DERP_VERIFY_CLIENTS=false # 关闭验证

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

mkdir -p /opt/tailscale-derper
cd /opt/tailscale-derper
# 在/opt/tailscale-derper目录下创建docker-compose.yaml

# 以下命令都需要在/opt/tailscale-derper下执行
# 启动
docker-compose up -d

# 停止
docker-compose down

# 重启
docker-compose restart

# 查看nginx proxy manager日志
docker-compose logs -f

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

{
  // 以上省略配置
  "derpMap": {
    "OmitDefaultRegions": true,
    "Regions": {
      "901": {
        "RegionID": 901,
        // 900 多个节点依次递增
        "RegionCode": "CN-NB",
        // 区域代码，会在 `tailscale netcheck` 显示
        "RegionName": "中国-宁波",
        // 区域名称，会在 `tailscale netcheck` 显示
        "Nodes": [
          {
            "Name": "YN-NB",
            "RegionID": 901, // 对应上方ID
            "HostName": "这里换上你的服务器 ip", // 填写你的DERP服务域名
            "DERPPort": 12345, // 你的DERP服务端口与部署时的一致
            "InsecureForTests": true // 必须为true，以跳过证书验证
          }
        ]
      }
    }
  },
  // 以下省略配置
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108

// Example/default ACLs for unrestricted connections.
{
  // Declare static groups of users. Use autogroups for all users or users with a specific role.
  // "groups": {
  //  	"group:example": ["alice@example.com", "bob@example.com"],
  // },

  // Define the tags which can be applied to devices and by which users.
  // "tagOwners": {
  //  	"tag:example": ["autogroup:admin"],
  // },

  // Define access control lists for users, groups, autogroups, tags,
  // Tailscale IP addresses, and subnet ranges.
  "acls": [
    // Allow all connections.
    // Comment this section out if you want to define specific restrictions.
    {
      "action": "accept",
      "src": [
        "*"
      ],
      "dst": [
        "*:*"
      ]
    }

    // Allow users in "group:example" to access "tag:example", but only from
    // devices that are running macOS and have enabled Tailscale client auto-updating.
    // {"action": "accept", "src": ["group:example"], "dst": ["tag:example:*"], "srcPosture":["posture:autoUpdateMac"]},
  ],
  "derpMap": {
    "OmitDefaultRegions": true,
    "Regions": {
      "901": {
        "RegionID": 901,
        // 900 多个节点依次递增
        "RegionCode": "CN-NB",
        // 区域代码，会在 `tailscale netcheck` 显示
        "RegionName": "中国-宁波",
        // 区域名称，会在 `tailscale netcheck` 显示
        "Nodes": [
          {
            "Name": "YN-NB",
            "RegionID": 901,
            // 对应上方ID
            "HostName": "这里换上你的服务器 ip",
            // 填写你的DERP服务域名
            "DERPPort": 12345,
            // 你的DERP服务端口与部署时的一致
            "InsecureForTests": true // 必须为true，以跳过证书验证
          }
        ]
      }
    }
  },
  // Define postures that will be applied to all rules without any specific
  // srcPosture definition.
  // "defaultSrcPosture": [
  //      "posture:anyMac",
  // ],

  // Define device posture rules requiring devices to meet
  // certain criteria to access parts of your system.
  // "postures": {
  //      // Require devices running macOS, a stable Tailscale
  //      // version and auto update enabled for Tailscale.
  // 	"posture:autoUpdateMac": [
  // 	    "node:os == 'macos'",
  // 	    "node:tsReleaseTrack == 'stable'",
  // 	    "node:tsAutoUpdate",
  // 	],
  //      // Require devices running macOS and a stable
  //      // Tailscale version.
  // 	"posture:anyMac": [
  // 	    "node:os == 'macos'",
  // 	    "node:tsReleaseTrack == 'stable'",
  // 	],
  // },

  // Define users and devices that can use Tailscale SSH.
  "ssh": [
    // Allow all users to SSH into their own devices in check mode.
    // Comment this section out if you want to define specific restrictions.
    {
      "action": "check",
      "src": [
        "autogroup:member"
      ],
      "dst": [
        "autogroup:self"
      ],
      "users": [
        "autogroup:nonroot",
        "root"
      ]
    }
  ]

  // Test access rules every time they're saved.
  // "tests": [
  //  	{
  //  		"src": "alice@example.com",
  //  		"accept": ["tag:example"],
  //  		"deny": ["100.101.102.103:443"],
  //  	},
  // ],
}

1

tailscale netcheck