Configure Tailscale mesh VPN with subnet routing and ACL policies for secure network access

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Global variables
SUBNET=""
ENABLE_EXIT_NODE=false
CLEANUP_FILES=()

# Usage function
usage() {
    echo "Usage: $0 --subnet=<CIDR> [--enable-exit-node]"
    echo "Example: $0 --subnet=192.168.1.0/24 --enable-exit-node"
    echo "Options:"
    echo "  --subnet=<CIDR>        Local subnet to advertise (required)"
    echo "  --enable-exit-node     Enable exit node functionality (optional)"
    echo "  --help                 Show this help message"
    exit 1
}

# Error handling and cleanup
cleanup() {
    if [ ${#CLEANUP_FILES[@]} -gt 0 ]; then
        echo -e "${YELLOW}[CLEANUP] Removing temporary files...${NC}"
        for file in "${CLEANUP_FILES[@]}"; do
            [ -f "$file" ] && rm -f "$file"
        done
    fi
}

error_exit() {
    echo -e "${RED}[ERROR] $1${NC}" >&2
    cleanup
    exit 1
}

trap cleanup EXIT
trap 'error_exit "Script failed on line $LINENO"' ERR

# Parse arguments
for arg in "$@"; do
    case $arg in
        --subnet=*)
            SUBNET="${arg#*=}"
            shift
            ;;
        --enable-exit-node)
            ENABLE_EXIT_NODE=true
            shift
            ;;
        --help)
            usage
            ;;
        *)
            echo -e "${RED}Unknown option: $arg${NC}"
            usage
            ;;
    esac
done

# Validate required arguments
if [ -z "$SUBNET" ]; then
    echo -e "${RED}Error: --subnet parameter is required${NC}"
    usage
fi

# Validate subnet format
if ! echo "$SUBNET" | grep -qE '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$'; then
    error_exit "Invalid subnet format. Use CIDR notation (e.g., 192.168.1.0/24)"
fi

echo -e "${BLUE}Tailscale Mesh VPN Installation Script${NC}"
echo "======================================"

# Check if running as root or with sudo
echo -e "${BLUE}[1/9] Checking privileges...${NC}"
if [ "$EUID" -ne 0 ]; then
    error_exit "This script must be run as root or with sudo"
fi

# Auto-detect distribution
echo -e "${BLUE}[2/9] Detecting operating system...${NC}"
if [ ! -f /etc/os-release ]; then
    error_exit "/etc/os-release not found. Cannot detect distribution."
fi

. /etc/os-release

case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_UPDATE="apt update && apt upgrade -y"
        PKG_INSTALL="apt install -y"
        DISTRO_FAMILY="debian"
        ;;
    almalinux|rocky|centos|rhel|ol)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf update -y"
        PKG_INSTALL="dnf install -y"
        DISTRO_FAMILY="rhel"
        RHEL_VERSION="${VERSION_ID%%.*}"
        ;;
    fedora)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf update -y"
        PKG_INSTALL="dnf install -y"
        DISTRO_FAMILY="rhel"
        RHEL_VERSION="9"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_UPDATE="yum update -y"
        PKG_INSTALL="yum install -y"
        DISTRO_FAMILY="rhel"
        RHEL_VERSION="9"
        ;;
    *)
        error_exit "Unsupported distribution: $ID"
        ;;
esac

echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"

# Update system packages
echo -e "${BLUE}[3/9] Updating system packages...${NC}"
$PKG_UPDATE || error_exit "Failed to update system packages"

# Install required tools
echo -e "${BLUE}[4/9] Installing required tools...${NC}"
case "$DISTRO_FAMILY" in
    debian)
        $PKG_INSTALL curl gnupg lsb-release || error_exit "Failed to install required tools"
        ;;
    rhel)
        $PKG_INSTALL curl gnupg || error_exit "Failed to install required tools"
        ;;
esac

# Install Tailscale
echo -e "${BLUE}[5/9] Installing Tailscale...${NC}"
case "$DISTRO_FAMILY" in
    debian)
        # Add Tailscale repository
        KEYRING_FILE="/usr/share/keyrings/tailscale-archive-keyring.gpg"
        LIST_FILE="/etc/apt/sources.list.d/tailscale.list"
        CLEANUP_FILES+=("$KEYRING_FILE" "$LIST_FILE")
        
        curl -fsSL "https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).noarmor.gpg" | tee "$KEYRING_FILE" >/dev/null
        curl -fsSL "https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).tailscale-keyring.list" | tee "$LIST_FILE" >/dev/null
        chmod 644 "$KEYRING_FILE" "$LIST_FILE"
        
        apt update || error_exit "Failed to update package list"
        $PKG_INSTALL tailscale || error_exit "Failed to install Tailscale"
        ;;
    rhel)
        # Add Tailscale repository
        REPO_FILE="/etc/yum.repos.d/tailscale.repo"
        curl -fsSL "https://pkgs.tailscale.com/stable/rhel/${RHEL_VERSION}/tailscale.repo" -o "$REPO_FILE"
        chmod 644 "$REPO_FILE"
        
        $PKG_INSTALL tailscale || error_exit "Failed to install Tailscale"
        ;;
esac

# Enable and start Tailscale service
echo -e "${BLUE}[6/9] Starting Tailscale service...${NC}"
systemctl enable --now tailscaled || error_exit "Failed to start Tailscale daemon"

# Wait for service to be ready
sleep 3
systemctl is-active --quiet tailscaled || error_exit "Tailscale daemon is not running"

# Configure IP forwarding
echo -e "${BLUE}[7/9] Configuring IP forwarding...${NC}"
SYSCTL_CONF="/etc/sysctl.d/99-tailscale.conf"

cat > "$SYSCTL_CONF" << EOF
# Tailscale subnet routing configuration
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
EOF

chmod 644 "$SYSCTL_CONF"
sysctl -p "$SYSCTL_CONF" || error_exit "Failed to apply sysctl settings"

# Configure firewall for subnet routing
echo -e "${BLUE}[8/9] Configuring firewall...${NC}"
case "$DISTRO_FAMILY" in
    debian)
        if command -v ufw >/dev/null 2>&1 && ufw status | grep -q "Status: active"; then
            echo -e "${YELLOW}Configuring UFW for Tailscale...${NC}"
            ufw allow in on tailscale0
            ufw allow out on tailscale0
        fi
        ;;
    rhel)
        if systemctl is-active --quiet firewalld; then
            echo -e "${YELLOW}Configuring firewalld for Tailscale...${NC}"
            firewall-cmd --permanent --add-interface=tailscale0 --zone=trusted
            firewall-cmd --permanent --add-masquerade
            firewall-cmd --reload
        fi
        
        # Configure SELinux if enabled
        if command -v getenforce >/dev/null 2>&1 && [ "$(getenforce)" != "Disabled" ]; then
            echo -e "${YELLOW}Configuring SELinux for Tailscale...${NC}"
            setsebool -P nis_enabled 1 2>/dev/null || true
        fi
        ;;
esac

# Initial Tailscale authentication and configuration
echo -e "${BLUE}[9/9] Configuring Tailscale...${NC}"
TAILSCALE_ARGS="--accept-routes --accept-dns"

# Add subnet routing
TAILSCALE_ARGS="$TAILSCALE_ARGS --advertise-routes=$SUBNET"
echo -e "${YELLOW}Subnet routing enabled for: $SUBNET${NC}"

# Add exit node if requested
if [ "$ENABLE_EXIT_NODE" = true ]; then
    TAILSCALE_ARGS="$TAILSCALE_ARGS --advertise-exit-node"
    echo -e "${YELLOW}Exit node functionality enabled${NC}"
fi

# Start Tailscale with configuration
echo -e "${YELLOW}Starting Tailscale authentication...${NC}"
tailscale up $TAILSCALE_ARGS || error_exit "Failed to configure Tailscale"

# Verify installation
echo -e "${BLUE}Verifying installation...${NC}"
if ! tailscale status >/dev/null 2>&1; then
    error_exit "Tailscale is not properly configured"
fi

TAILSCALE_IP=$(tailscale ip -4 2>/dev/null || echo "Not assigned yet")
echo -e "${GREEN}✓ Tailscale service is running${NC}"
echo -e "${GREEN}✓ Tailscale IP: $TAILSCALE_IP${NC}"
echo -e "${GREEN}✓ Subnet routing configured for: $SUBNET${NC}"
[ "$ENABLE_EXIT_NODE" = true ] && echo -e "${GREEN}✓ Exit node capability enabled${NC}"

echo ""
echo -e "${GREEN}Installation completed successfully!${NC}"
echo ""
echo -e "${YELLOW}Next steps:${NC}"
echo "1. Approve subnet routes in the Tailscale admin console:"
echo "   https://login.tailscale.com/admin/machines"
[ "$ENABLE_EXIT_NODE" = true ] && echo "2. Approve exit node capability in the admin console"
echo "3. Configure ACL policies for zero-trust access control"
echo "4. Install Tailscale on other devices to join the mesh network"
echo ""
echo -e "${BLUE}Tailscale status:${NC}"
tailscale status