Jan Novak
6efa069b12
Document the psmf host (DNS, second tailscale netns instance, nginx vhosts, migration plan) and add the docker-dev-22 psmf-data-sync service plus the storage-23 pg_hba.conf entry it needs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
39 lines
1.2 KiB
Markdown
39 lines
1.2 KiB
Markdown
```bash
|
|
# Create namespace
|
|
sudo ip netns add ts2
|
|
|
|
# veth pair: host side <-> ns side
|
|
sudo ip link add veth-ts2 type veth peer name veth-ts2-ns
|
|
sudo ip link set veth-ts2-ns netns ts2
|
|
|
|
# Host side
|
|
sudo ip addr add 10.200.0.1/30 dev veth-ts2
|
|
sudo ip link set veth-ts2 up
|
|
|
|
# Namespace side
|
|
sudo ip -n ts2 addr add 10.200.0.2/30 dev veth-ts2-ns
|
|
sudo ip -n ts2 link set veth-ts2-ns up
|
|
sudo ip -n ts2 link set lo up
|
|
sudo ip -n ts2 route add default via 10.200.0.1
|
|
|
|
# DNS inside the netns
|
|
sudo mkdir -p /etc/netns/ts2
|
|
echo "nameserver 1.1.1.1" | sudo tee /etc/netns/ts2/resolv.conf
|
|
|
|
# NAT from the netns out to the world (replace eth0 with your egress iface)
|
|
sudo sysctl -w net.ipv4.ip_forward=1
|
|
sudo iptables -t nat -A POSTROUTING -s 10.200.0.0/30 -o br0 -j MASQUERADE
|
|
sudo iptables -A FORWARD -i veth-ts2 -o br0 -j ACCEPT
|
|
sudo iptables -A FORWARD -o veth-ts2 -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
|
|
# quick sanity check
|
|
sudo ip netns exec ts2 curl https://controlplane.tailscale.com
|
|
# expect: "OK"
|
|
```
|
|
|
|
```bash
|
|
# ts2 alias
|
|
echo 'alias ts2="sudo ip netns exec ts2 tailscale --socket=/run/tailscale-ts2/tailscaled.sock"' \
|
|
| sudo tee /etc/profile.d/tailscale-ts2.sh
|
|
``` |