feat(family-apps): add tailscale exit node deployment

k8s/family-apps/kustomization.yaml

@@ -11,4 +11,5 @@ resources:
   - rufaro.yaml
   - media-suite.yaml
   - musicseerr.yaml
+  - tailscale.yaml
 

k8s/family-apps/tailscale.yaml

@@ -0,0 +1,76 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tailscale-auth-secret
+  namespace: family-apps
+type: Opaque
+stringData:
+  TS_AUTHKEY: "PLACEHOLDER_FOR_YOUR_TAILSCALE_AUTH_KEY"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: tailscale-pvc
+  namespace: family-apps
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-exit-node
+  namespace: family-apps
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tailscale-exit-node
+  template:
+    metadata:
+      labels:
+        app: tailscale-exit-node
+    spec:
+      containers:
+      - name: tailscale
+        image: tailscale/tailscale:latest
+        command:
+        - /bin/sh
+        - -c
+        - |
+          # Enable IP forwarding inside the container's network namespace
+          sysctl -w net.ipv4.ip_forward=1
+          sysctl -w net.ipv6.conf.all.forwarding=1
+          
+          # Execute default Tailscale container entrypoint
+          exec /usr/local/bin/containerboot
+        env:
+        - name: TS_AUTHKEY
+          valueFrom:
+            secretKeyRef:
+              name: tailscale-auth-secret
+              key: TS_AUTHKEY
+        - name: TS_EXTRA_ARGS
+          value: "--advertise-exit-node"
+        - name: TS_USERSPACE
+          value: "false"
+        - name: TS_STATE_DIR
+          value: "/var/lib/tailscale"
+        securityContext:
+          privileged: true
+          capabilities:
+            add: ["NET_ADMIN"]
+        volumeMounts:
+        - name: state
+          mountPath: /var/lib/tailscale
+        - name: tun
+          mountPath: /dev/net/tun
+      volumes:
+      - name: state
+        persistentVolumeClaim:
+          claimName: tailscale-pvc
+      - name: tun
+        hostPath:
+          path: /dev/net/tun