apiVersion: v1
kind: Secret
metadata:
  name: tailscale-auth-secret
  namespace: family-apps
type: Opaque
stringData:
  TS_AUTHKEY: "PLACEHOLDER_FOR_YOUR_TAILSCALE_AUTH_KEY"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: tailscale-pvc
  namespace: family-apps
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tailscale-exit-node
  namespace: family-apps
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tailscale-exit-node
  template:
    metadata:
      labels:
        app: tailscale-exit-node
    spec:
      containers:
      - name: tailscale
        image: tailscale/tailscale:latest
        command:
        - /bin/sh
        - -c
        - |
          # Enable IP forwarding inside the container's network namespace
          sysctl -w net.ipv4.ip_forward=1
          sysctl -w net.ipv6.conf.all.forwarding=1
          
          # Execute default Tailscale container entrypoint
          exec /usr/local/bin/containerboot
        env:
        - name: TS_AUTHKEY
          valueFrom:
            secretKeyRef:
              name: tailscale-auth-secret
              key: TS_AUTHKEY
        - name: TS_EXTRA_ARGS
          value: "--advertise-exit-node"
        - name: TS_USERSPACE
          value: "false"
        - name: TS_STATE_DIR
          value: "/var/lib/tailscale"
        - name: TS_KUBE_SECRET
          value: ""
        securityContext:
          privileged: true
          capabilities:
            add: ["NET_ADMIN"]
        volumeMounts:
        - name: state
          mountPath: /var/lib/tailscale
        - name: tun
          mountPath: /dev/net/tun
      volumes:
      - name: state
        persistentVolumeClaim:
          claimName: tailscale-pvc
      - name: tun
        hostPath:
          path: /dev/net/tun