Using a NervesHub support script to connect to tailscale

This is a ridiculous hack that I did yesterday to verify something we might want to tool up properly for NervesHub.

If you have Tailscale and a Nerves device with NervesHubLink connected to a NervesHub (such as NervesCloud.com) you can add the script below as a Support Script and if you run the script, the device should join your Tailnet and become routable.

It will also start EPMD and make the device an Erlang node. Then you could ridiculous and use a variant of my nerves_node hack to make the nodes connect up into a cluster. That’s not what we want to do. Rather we open a Livebook, then add a Smart cell for Remote Execution. Grab the cookie and host that the script prints. Bob is now your uncle.

You get all of Kino and access to pull things from your device. You can also connect the Livebook to the device but Mix.install won’t work for you and you’ll be quite limited in what you can do. But it has uses.

I don’t recommend this for production quite yet. I realized while writing this that I should restrict epmd to listen only to the Tailscale IP to be diligent for example. But it is probably already a pretty good debug tool if you need more direct access to your node. It means you can SSH via terminal (unless you’ve switched that off) and that also means you can deliver firmware via mix upload.

Enough of that. The hack script itself:

:inets.start()
:ssl.start()

url = ~c"https://pkgs.tailscale.com/stable/tailscale_1.82.0_arm64.tgz"
# You can use an ephemeral key to make ephemeral devices
# tags should be good for categorizing devices
# re-usable is required for it to work multiple times
tailscale_key = "MY_TAILSCALE_AUTH_KEY"
headers = []

tailscale_dir = "/data/tailscale"
File.mkdir_p!(tailscale_dir)
tmp_path = Path.join(tailscale_dir, "tailscale.tgz")

filepaths = Path.wildcard(Path.join(tailscale_dir, "/**"))

daemon_path =
  Enum.find(filepaths, fn path ->
    Path.basename(path) == "tailscaled"
  end)

cli_path =
  Enum.find(filepaths, fn path ->
    Path.basename(path) == "tailscale"
  end)

if is_nil(daemon_path) and is_nil(cli_path) do
  http_request_opts = [
    ssl: [
      cacerts: :public_key.cacerts_get(),
      customize_hostname_check: [
        match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
      ]
    ]
  ]

  IO.puts("to path: #{tmp_path}")

  {:ok, :saved_to_file} =
    :httpc.request(:get, {url, headers}, http_request_opts, stream: String.to_charlist(tmp_path))

  # {:ok, file} = :file.open(tmp_path, [:read, :compressed, :raw])

  {:ok, files} =
    :erl_tar.extract({:binary, File.read!(tmp_path)}, [:memory, :verbose, :compressed])

  Enum.each(files, fn {filename, content} ->
    IO.puts(filename)
    File.mkdir_p!(Path.dirname(Path.join(tailscale_dir, filename)))
    File.write!(Path.join(tailscale_dir, filename), content)
  end)
end

filepaths = Path.wildcard(Path.join(tailscale_dir, "/**"))

daemon_path =
  Enum.find(filepaths, fn path ->
    Path.basename(path) == "tailscaled"
  end)

cli_path =
  Enum.find(filepaths, fn path ->
    Path.basename(path) == "tailscale"
  end)

File.chmod(daemon_path, 0o700)
File.chmod(cli_path, 0o700)

case Process.whereis(Tailscale) do
  nil ->
    {:ok, _pid} =
      MuonTrap.Daemon.start_link(
        daemon_path,
        [
          "--tun=userspace-networking",
          "--statedir=#{tailscale_dir}"
        ],
        name: Tailscale
      )

  _ ->
    :ok
end

{output, 0} =
  System.cmd(cli_path, ["up", "--auth-key=#{tailscale_key}", "--accept-routes"],
    stderr_to_stdout: true
  )

{ip, 0} =
  System.cmd(cli_path, ["ip", "-4"])

ip = String.trim(ip)

cookie = Base.encode64(:crypto.strong_rand_bytes(64))

case Process.whereis(EPMD) do
  nil ->
    {:ok, pid} = MuonTrap.Daemon.start_link("epmd", [], name: EPMD)

  _ ->
    :ok
end

Node.stop()
{:ok, _pid} = Node.start(:"nerves@#{ip}")

Node.set_cookie(String.to_atom(cookie))
IO.puts("Host: nerves@#{ip}")
IO.puts("Cookie: #{cookie}")

I tried making it fairly idempotent. It shouldn’t redo very much work and it should work if it has half-succeeded in the past. A reboot will shut it all down and I name the processes so you can make a script to shut it back down.

A fun nuance is that most of the practical management ends up on the tailscale key configuration. There are things we could do while calling the Tailscale CLI, but since your key can be set to tag devices and decide if they are ephemeral or permanent the script can be quite dumb.