name: tailscale-derper

services:
  derper:
    build: .
    command:
      - --hostname=${DERPER_HOSTNAME:?}
      # In order verify clients, we need to connected to the tailscale network
      # Check: https://tailscale.com/kb/1118/custom-derp-servers#optional-restricting-client-access-to-your-derp-node
      - --verify-clients
    restart: unless-stopped
    ports:
      - 80:80/tcp
      - 443:443/tcp
      - 3478:3478/udp
    volumes:
      # Mount tailscale socket to communicate with tailscaled
      # Required when `--verify-clients` is enabled
      - ./tailscale/tmp/tailscaled.sock:/var/run/tailscale/tailscaled.sock:rw
      # Save ssl certificates to persist across restarts
      - ./derper/certs:/root/.cache/tailscale/derper-certs
    depends_on:
      - tailscale

  tailscale:
    image: tailscale/tailscale:v1.70.0
    hostname: tailscale-relay
    environment:
      - TS_STATE_DIR=/var/lib/tailscale
      # Join the tailscale network using Pre-Auth Key
      - TS_AUTHKEY=${TS_AUTHKEY:?}
    restart: unless-stopped
    volumes:
      - ./tailscale/data:/var/lib/tailscale
      # Tailcale creates socket at `/tmp/tailscaled.sock`
      - ./tailscale/tmp:/tmp/