service: Support connecting containers to tailscale network

roles/service/tasks/additional.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Additional containers for {{ service_name }}
+- name: Additional container {{ _service_additional_container.name }}
   ansible.builtin.include_role:
     name: container
   vars:
@@ -11,7 +11,11 @@
     container_mounts: "{{ _service_additional_container_mounts }}"
     container_devices: "{{ _service_additional_container.devices }}"
     container_publish_ports: "{{ _service_additional_container_publish_ports }}"
-    container_networks: "{{ _service_additional_container_networks }}"
+    container_networks: >-
+      {{
+        _service_additional_container_networks if not _service_additional_container.tailscale
+        else [{'name': _service_additional_container.name ~ '-tailscale.container'}]
+      }}
     container_hostname: "{{ _service_additional_container.name | regex_replace('^' ~ service_name ~ '-', '') }}"
     container_secrets: "{{ _service_additional_container_secrets }}"
     container_env: "{{ _service_additional_container.env }}"
@@ -21,13 +25,23 @@
     container_requires: "{{ _service_additional_container_requires }}"
     container_wants: "{{ _service_additional_container_wants }}"
     container_auto_update: "{{ service_auto_update }}"
-  loop: "{{ _service_additional_containers }}"
-  loop_control:
-    loop_var: _service_additional_container
-    index_var: _service_additional_container_index
 
-- name: Socat sockets for additional containers of {{ service_name }}
-  ansible.builtin.include_tasks: additional_socat.yaml
-  loop: "{{ _service_additional_containers }}"
+- name: Socat for socket published ports of {{ _service_additional_container.name }}
+  ansible.builtin.include_role:
+    name: socat
+  loop: "{{  _service_additional_container_publish_socket_ports }}"
   loop_control:
-    loop_var: _service_additional_container
+    loop_var: publish_port
+  vars:
+    socat_service_name: "{{ service_name }}-{{ publish_port.name }}"
+    socat_target_container: "{{ _service_additional_container.name }}"
+    socat_target_http_port: "{{ publish_port.container_port }}"
+    socat_auto_update: "{{ service_auto_update }}"
+
+- name: Tailscale for {{ _service_additional_container.name }}
+  ansible.builtin.include_tasks: tailscale.yaml
+  when: _service_additional_container.tailscale
+  vars:
+    _service_tailscale_container_name: "{{ _service_additional_container.name }}"
+    _service_tailscale_networks: "{{ _service_additional_container_networks }}"
+    _service_tailscale_hostname: "{{ _service_additional_container.name | regex_replace('^' ~ service_name ~ '-', '') }}"

roles/service/tasks/additional_socat.yaml

@@ -1,12 +0,0 @@
----
-- name: Socat for socket published ports of {{ service_name }}
-  ansible.builtin.include_role:
-    name: socat
-  loop: "{{  _service_additional_container_publish_socket_ports }}"
-  loop_control:
-    loop_var: publish_port
-  vars:
-    socat_service_name: "{{ service_name }}-{{ publish_port.name }}"
-    socat_target_container: "{{ _service_additional_container.name }}"
-    socat_target_http_port: "{{ publish_port.container_port }}"
-    socat_auto_update: "{{ service_auto_update }}"

roles/service/tasks/main.yaml

@@ -5,14 +5,21 @@
 - name: Database for {{ service_name }}
   ansible.builtin.include_tasks: database.yaml
   when: _service_setup_database
-
 - name: Redis for {{ service_name }}
   ansible.builtin.include_tasks: redis.yaml
   when: service_redis
 
 - name: Secrets for {{ service_name }}
   ansible.builtin.include_tasks: secrets.yaml
-  when: _service_container_secrets | length > 0
+  when: _service_container_secrets | length > 0 or service_tailscale
+
+- name: Tailscale for {{ service_name }}
+  ansible.builtin.include_tasks: tailscale.yaml
+  when: service_tailscale
+  vars:
+    _service_tailscale_container_name: "{{ service_name }}"
+    _service_tailscale_networks: "{{ _service_networks }}"
+    _service_tailscale_hostname: "{{ service_name }}"
 
 - name: Template mounts for {{ service_name }}
   ansible.builtin.include_tasks: host_mounts.yaml
@@ -20,7 +27,10 @@
 
 - name: Additional containers for {{ service_name }}
   ansible.builtin.include_tasks: additional.yaml
-  when: _service_additional_containers | length > 0
+  loop: "{{ _service_additional_containers }}"
+  loop_control:
+    loop_var: _service_additional_container
+    index_var: _service_additional_container_index
 
 - name: Native socket for {{ service_name }}
   ansible.builtin.include_role:

roles/service/tasks/tailscale.yaml

@@ -0,0 +1,60 @@
+---
+- name: Create tailscale preauthkey secret for {{ _service_tailscale_container_name }}
+  when:
+    - not ansible_check_mode
+    - "_service_tailscale_container_name ~ '-tailscale-preauthkey' not in service_podman_secrets"
+  block:
+    - name: Get preauthkey from tailscale API
+      ansible.builtin.uri:
+        url: "{{ service_tailscale_login_server }}/api/v1/preauthkey"
+        headers:
+          Authorization: Bearer {{ service_tailscale_apikey }}
+        method: POST
+        body:
+          expiration: >-
+            {{
+              now(utc=true).replace(
+                day=now(utc=true).day if now(utc=true).hour != 23 else now(utc=true).day + 1,
+                hour=now(utc=true).hour + 1 if now(utc=true).hour != 23 else 0
+              ).isoformat()
+            }}Z
+          aclTags:
+            - tag:container
+            - "tag:{{ _service_tailscale_container_name }}"
+        body_format: json
+      register: _service_tailscale_preauthkey
+    - name: Create preauthkey secret
+      containers.podman.podman_secret:
+        name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
+        data: "{{ _service_tailscale_preauthkey.json.preAuthKey.key }}"
+      no_log: true
+
+- name: Tailscale container for {{ _service_tailscale_container_name }}
+  ansible.builtin.import_role:
+    name: container
+  vars:
+    container_name: "{{ _service_tailscale_container_name }}-tailscale"
+    container_image: docker.io/tailscale/tailscale:latest
+    container_networks: "{{ _service_tailscale_networks }}"
+    container_hostname: "{{ _service_tailscale_hostname }}"
+    container_add_capabilities:
+      - NET_ADMIN
+    container_devices:
+      - source: /dev/net/tun
+    container_mounts:
+      - type: volume
+        source: "{{ _service_tailscale_container_name }}-tailscale"
+        destination: /var/lib/tailscale
+    container_auto_update: "{{ service_auto_update }}"
+    container_secrets:
+      - name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
+        target: preauthkey
+    container_env:
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_AUTHKEY: file:/run/secrets/preauthkey
+      TS_EXTRA_ARGS: --login-server={{ service_tailscale_login_server }}
+      TS_HOSTNAME: "{{ _service_tailscale_container_name }}"
+      TS_AUTH_ONCE: "true"
+      TS_NO_LOGS_NO_SUPPORT: "true"
+      TS_USERSPACE: "false"
+      TS_ACCEPT_DNS: "true"