- commit
- 0de728c560b549a170626d1526e941c7bcf3b344
- parent
- 5b4b9419f1dab80f45dc90704ff7b26b717be432
- author
- Dami <dami.etoile@gmail.com>
| M | docs/ | 54 | ++---------------------------- |
@@ -1,58 +1,10 @@
11 # Personal relay deployment22 3-The personal relay runs on a Linux Docker host and is published through Tailscale Funnel at [https://tiny.tailbe516a.ts.net](https://tiny.tailbe516a.ts.net). The relay, Caddy and Tailscale containers share one network namespace, so only that node's port 443 is public; the host itself stays private.4-5-## Public access6-7-Funnel forwards raw TLS on port 443 to Caddy inside the relay's Tailscale node. Caddy keeps terminating TLS with the tailnet certificate, so nothing else changes. The setting persists in the Tailscale state directory across container restarts.8-9-```sh10-docker exec tiny-tailscale tailscale funnel --bg --tcp=443 tcp://127.0.0.1:44311-docker exec tiny-tailscale tailscale funnel status12-docker exec tiny-tailscale tailscale funnel --tcp=443 off13-```14-15-Public DNS for the relay name resolves to Tailscale's ingress only while Funnel is on; tailnet devices keep using the direct path. Writes stay restricted to members, so public visitors can read and sign in but cannot publish without an invitation. The relay sees the loopback address for every connection behind Caddy, so IP based blocks apply to the proxy rather than to individual clients.16-17-## Storage18-19-The relay data lives on a dedicated 2 TB WD drive mounted at `/srv/tiny`. The drive uses UUID `98f49cba-bd8c-432d-a91a-41db66920e90` and is formatted as ext4.20-21-Persisted directories include:22-23-- `/srv/tiny/data` for relay and tenant data24-- `/srv/tiny/tailscale` for Tailscale state25-- `/srv/tiny/certs` for certificates26-- `/srv/tiny/logs` for service logs27-28-The service checks the drive's UUID before starting and stops if the mount disappears.29-30-## Service operations31-32-The service is `tiny.service`, with certificate renewal scheduled by `tiny-certificates.timer`.33-34-In the Tailscale admin console, open **Machines > tiny > Endpoints** to find the HTTP and HTTPS listeners. The node's key expiry is disabled.35-36-```sh37-ssh <host> sudo systemctl status tiny38-ssh <host> sudo systemctl restart tiny39-ssh <host> sudo systemctl status tiny-certificates.timer40-ssh <host> docker logs tiny41-```42-43-To deploy an update, build the images from a checkout on the host, then restart the service:44-45-```sh46-docker build --target runtime -t tiny:dogfood .47-docker build -f deploy/Tailscale.Dockerfile -t tiny-tailscale:dogfood deploy48-sudo systemctl restart tiny49-```50-51-The owner is `npub1cq2s86qrtadf36eqq3epm38wmhdynrrcwxf84eldk3f94dkv7ttsrulrz5`. Sign in with that identity to manage the relay.3+The personal relay runs on a Linux Docker host. Tailnet devices reach it at [https://tiny.tailbe516a.ts.net](https://tiny.tailbe516a.ts.net); everyone else reaches it through the Fly edge at `https://012.run`. The relay, Caddy and Tailscale containers share one network namespace, so nothing on the host itself listens publicly.524 535 ## Public domain through a Fly edge546 55-The relay is also reachable at `https://012.run`, with sites on `*.012.run`. A small Fly machine, `deploy/edge`, terminates TLS at Fly's edge, joins the tailnet in userspace mode, and forwards plain HTTP over the tailnet to a listener on the relay host that only the tailnet can reach. Fly's proxy has no request body cap and passes WebSockets.7+The public address is `https://012.run`, with sites on `*.012.run`. A small Fly machine, `deploy/edge`, terminates TLS at Fly's edge, joins the tailnet in userspace mode, and forwards plain HTTP over the tailnet to a listener on the relay host that only the tailnet can reach. Fly's proxy has no request body cap and passes WebSockets.568 579 ```sh5810 cd deploy/edge@@ -62,7 +14,7 @@ fly certs check 012.run
6214 fly certs check "*.012.run"6315 ```6416 65-DNS at the registrar, all DNS-only records: A and AAAA for `012.run` and `*.012.run` pointing at the app's addresses from `fly ips list`, and a `_acme-challenge.012.run` CNAME from `fly certs setup "*.012.run"` for the wildcard certificate. The relay host's Caddyfile serves `012.run:8080` and `*.012.run:8080` over plain HTTP for the edge; see `deploy/edge/slate.Caddyfile.snippet`. After the certificates issue, set `--public-url https://012.run` on the relay so signed requests, NIP-11 and site hosts use the public name. The ts.net name keeps working through Funnel.17+DNS at the registrar, all DNS-only records: A and AAAA for `012.run` and `*.012.run` pointing at the app's addresses from `fly ips list`, and a `_acme-challenge.012.run` CNAME from `fly certs setup "*.012.run"` for the wildcard certificate. The relay host's Caddyfile serves `012.run:8080` and `*.012.run:8080` over plain HTTP for the edge; see `deploy/edge/slate.Caddyfile.snippet`. After the certificates issue, set `--public-url https://012.run` on the relay so signed requests, NIP-11 and site hosts use the public name. The ts.net name stays tailnet only.6618 6719 ## Repository hosting6820