12# Join the tailnet in userspace mode, expose an HTTP CONNECT proxy for Caddy,3# then run Caddy. tailscaled dials upstreams by address through SOCKS5 so the4# Host header passes through untouched. TS_AUTHKEY comes from a Fly secret and is only needed the5# first time; afterwards the identity persists on the state volume.6set -eu7STATE="${TS_STATE_DIR:-/var/lib/tailscale}"8mkdir -p /var/run/tailscale "$STATE"9tailscaled --state="$STATE/tailscaled.state" --socket=/var/run/tailscale/tailscaled.sock \10 --tun=userspace-networking --socks5-server=127.0.0.1:1055 &11until [ -S /var/run/tailscale/tailscaled.sock ]; do sleep 1; done12if [ -n "${TS_AUTHKEY:-}" ]; then13 tailscale --socket=/var/run/tailscale/tailscaled.sock up --authkey="$TS_AUTHKEY" --hostname="${TS_HOSTNAME:-tiny-edge}" --accept-dns=false14elif [ -f "$STATE/tailscaled.state" ]; then15 tailscale --socket=/var/run/tailscale/tailscaled.sock up --hostname="${TS_HOSTNAME:-tiny-edge}" --accept-dns=false16else17 echo "TS_AUTHKEY is not set and no tailnet state exists; set the secret and redeploy" >&218fi19exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile