Setup Tailscale site-to-site VPN with multiple exit nodes for redundancy

#!/usr/bin/env bash
set -euo pipefail

# Tailscale Site-to-Site VPN with Multiple Exit Nodes Setup Script
# Supports Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, RHEL, and Fedora

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
NODE_TYPE=""
SUBNET=""
HOSTNAME=""
EXIT_NODE_IPS=""

# Usage message
usage() {
    echo "Usage: $0 --type [exit|client] [--subnet SUBNET] [--hostname HOSTNAME] [--exit-ips IP1,IP2,IP3]"
    echo "  --type: Node type (exit or client)"
    echo "  --subnet: Network subnet to advertise (required for exit nodes)"
    echo "  --hostname: Tailscale hostname (optional)"
    echo "  --exit-ips: Comma-separated list of exit node IPs for failover (client nodes only)"
    echo ""
    echo "Examples:"
    echo "  $0 --type exit --subnet 192.168.1.0/24 --hostname exit-node-1"
    echo "  $0 --type client --hostname client-1 --exit-ips 100.64.1.10,100.64.1.11,100.64.1.12"
    exit 1
}

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --type)
            NODE_TYPE="$2"
            shift 2
            ;;
        --subnet)
            SUBNET="$2"
            shift 2
            ;;
        --hostname)
            HOSTNAME="$2"
            shift 2
            ;;
        --exit-ips)
            EXIT_NODE_IPS="$2"
            shift 2
            ;;
        -h|--help)
            usage
            ;;
        *)
            echo -e "${RED}Unknown option: $1${NC}"
            usage
            ;;
    esac
done

# Validate required arguments
if [[ -z "$NODE_TYPE" ]]; then
    echo -e "${RED}Error: --type is required${NC}"
    usage
fi

if [[ "$NODE_TYPE" == "exit" && -z "$SUBNET" ]]; then
    echo -e "${RED}Error: --subnet is required for exit nodes${NC}"
    usage
fi

# Error handling
cleanup() {
    echo -e "${RED}Error occurred. Cleaning up...${NC}"
    systemctl stop tailscaled 2>/dev/null || true
}
trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

echo -e "${GREEN}Starting Tailscale site-to-site VPN setup...${NC}"

# Detect distribution and set package manager
echo -e "${YELLOW}[1/8] Detecting Linux distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            # Fallback to yum for older versions
            if ! command -v dnf &> /dev/null; then
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
            fi
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
    echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"
else
    echo -e "${RED}Cannot detect Linux distribution${NC}"
    exit 1
fi

# Update package lists
echo -e "${YELLOW}[2/8] Updating package lists...${NC}"
$PKG_UPDATE

# Install required packages
echo -e "${YELLOW}[3/8] Installing required packages...${NC}"
$PKG_INSTALL curl wget

# Install Tailscale
echo -e "${YELLOW}[4/8] Installing Tailscale...${NC}"
curl -fsSL https://tailscale.com/install.sh | sh

# Configure IP forwarding for exit nodes
if [[ "$NODE_TYPE" == "exit" ]]; then
    echo -e "${YELLOW}[5/8] Configuring IP forwarding for exit node...${NC}"
    
    # Enable IP forwarding
    if ! grep -q "net.ipv4.ip_forward = 1" /etc/sysctl.conf; then
        echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
    fi
    if ! grep -q "net.ipv6.conf.all.forwarding = 1" /etc/sysctl.conf; then
        echo 'net.ipv6.conf.all.forwarding = 1' >> /etc/sysctl.conf
    fi
    sysctl -p
    
    # Configure firewall based on distribution
    if command -v firewall-cmd &> /dev/null; then
        # RHEL-based systems with firewalld
        systemctl enable firewalld
        systemctl start firewalld
        firewall-cmd --permanent --add-masquerade
        firewall-cmd --reload
    elif command -v ufw &> /dev/null; then
        # Ubuntu/Debian with ufw
        ufw --force enable
        ufw allow in on tailscale0
        ufw allow out on tailscale0
    fi
else
    echo -e "${YELLOW}[5/8] Skipping IP forwarding (client node)...${NC}"
fi

# Start and enable Tailscale service
echo -e "${YELLOW}[6/8] Starting Tailscale service...${NC}"
systemctl enable tailscaled
systemctl start tailscaled

# Configure Tailscale based on node type
echo -e "${YELLOW}[7/8] Configuring Tailscale...${NC}"
if [[ "$NODE_TYPE" == "exit" ]]; then
    # Configure exit node
    TAILSCALE_CMD="tailscale up --advertise-routes=$SUBNET --advertise-exit-node"
    if [[ -n "$HOSTNAME" ]]; then
        TAILSCALE_CMD="$TAILSCALE_CMD --hostname=$HOSTNAME"
    fi
    
    echo -e "${GREEN}Starting Tailscale as exit node...${NC}"
    echo "Please authenticate using the URL that will be displayed:"
    $TAILSCALE_CMD
    
    # Create failover monitoring script for exit nodes
    cat > /usr/local/bin/tailscale-health-check.sh << 'EOF'
#!/bin/bash
# Health check script for Tailscale exit nodes
LOGFILE="/var/log/tailscale-health.log"
STATUS=$(tailscale status --json 2>/dev/null)
if [[ $? -eq 0 ]]; then
    echo "$(date): Tailscale healthy" >> "$LOGFILE"
else
    echo "$(date): Tailscale unhealthy, restarting..." >> "$LOGFILE"
    systemctl restart tailscaled
fi
EOF
    chmod 755 /usr/local/bin/tailscale-health-check.sh
    chown root:root /usr/local/bin/tailscale-health-check.sh
    
else
    # Configure client node
    TAILSCALE_CMD="tailscale up"
    if [[ -n "$HOSTNAME" ]]; then
        TAILSCALE_CMD="$TAILSCALE_CMD --hostname=$HOSTNAME"
    fi
    
    echo -e "${GREEN}Starting Tailscale as client node...${NC}"
    echo "Please authenticate using the URL that will be displayed:"
    $TAILSCALE_CMD
    
    # Create failover script for client nodes if exit IPs provided
    if [[ -n "$EXIT_NODE_IPS" ]]; then
        IFS=',' read -ra EXIT_ARRAY <<< "$EXIT_NODE_IPS"
        cat > /usr/local/bin/tailscale-failover.sh << EOF
#!/bin/bash
# Tailscale exit node failover script
LOGFILE="/var/log/tailscale-failover.log"
EXIT_NODES=(${EXIT_ARRAY[@]})

check_exit_node() {
    local exit_ip="\$1"
    ping -c 3 -W 5 "\$exit_ip" > /dev/null 2>&1
    return \$?
}

switch_exit_node() {
    local new_exit="\$1"
    tailscale set --exit-node="\$new_exit"
    echo "\$(date): Switched to exit node \$new_exit" >> "\$LOGFILE"
}

for exit_node in "\${EXIT_NODES[@]}"; do
    if check_exit_node "\$exit_node"; then
        switch_exit_node "\$exit_node"
        exit 0
    fi
done

echo "\$(date): All exit nodes unreachable" >> "\$LOGFILE"
EOF
        chmod 755 /usr/local/bin/tailscale-failover.sh
        chown root:root /usr/local/bin/tailscale-failover.sh
        
        # Create systemd timer for failover checks
        cat > /etc/systemd/system/tailscale-failover.service << 'EOF'
[Unit]
Description=Tailscale Exit Node Failover
After=tailscaled.service
Requires=tailscaled.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/tailscale-failover.sh
User=root
EOF

        cat > /etc/systemd/system/tailscale-failover.timer << 'EOF'
[Unit]
Description=Run Tailscale failover check every 30 seconds
Requires=tailscale-failover.service

[Timer]
OnCalendar=*:*:0/30
Persistent=true

[Install]
WantedBy=timers.target
EOF
        
        systemctl daemon-reload
        systemctl enable tailscale-failover.timer
        systemctl start tailscale-failover.timer
    fi
fi

# Verification
echo -e "${YELLOW}[8/8] Verifying installation...${NC}"
sleep 5

if systemctl is-active --quiet tailscaled; then
    echo -e "${GREEN}✓ Tailscaled service is running${NC}"
else
    echo -e "${RED}✗ Tailscaled service is not running${NC}"
    exit 1
fi

if tailscale status > /dev/null 2>&1; then
    echo -e "${GREEN}✓ Tailscale is connected${NC}"
    echo -e "${GREEN}Tailscale Status:${NC}"
    tailscale status
    echo -e "${GREEN}Tailscale IP:${NC}"
    tailscale ip -4
else
    echo -e "${RED}✗ Tailscale is not properly configured${NC}"
    exit 1
fi

echo -e "${GREEN}Installation completed successfully!${NC}"
echo ""
echo -e "${YELLOW}Next steps:${NC}"
echo "1. Go to https://login.tailscale.com/admin/machines to approve routes and exit nodes"
echo "2. Configure ACL policies for route priorities if needed"
if [[ "$NODE_TYPE" == "exit" ]]; then
    echo "3. Monitor exit node health with: tail -f /var/log/tailscale-health.log"
else
    echo "3. Monitor failover status with: tail -f /var/log/tailscale-failover.log"
fi