Jan Novak
6efa069b12
Document the psmf host (DNS, second tailscale netns instance, nginx vhosts, migration plan) and add the docker-dev-22 psmf-data-sync service plus the storage-23 pg_hba.conf entry it needs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1.2 KiB
1.2 KiB
# Create namespace
sudo ip netns add ts2
# veth pair: host side <-> ns side
sudo ip link add veth-ts2 type veth peer name veth-ts2-ns
sudo ip link set veth-ts2-ns netns ts2
# Host side
sudo ip addr add 10.200.0.1/30 dev veth-ts2
sudo ip link set veth-ts2 up
# Namespace side
sudo ip -n ts2 addr add 10.200.0.2/30 dev veth-ts2-ns
sudo ip -n ts2 link set veth-ts2-ns up
sudo ip -n ts2 link set lo up
sudo ip -n ts2 route add default via 10.200.0.1
# DNS inside the netns
sudo mkdir -p /etc/netns/ts2
echo "nameserver 1.1.1.1" | sudo tee /etc/netns/ts2/resolv.conf
# NAT from the netns out to the world (replace eth0 with your egress iface)
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -s 10.200.0.0/30 -o br0 -j MASQUERADE
sudo iptables -A FORWARD -i veth-ts2 -o br0 -j ACCEPT
sudo iptables -A FORWARD -o veth-ts2 -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# quick sanity check
sudo ip netns exec ts2 curl https://controlplane.tailscale.com
# expect: "OK"
# ts2 alias
echo 'alias ts2="sudo ip netns exec ts2 tailscale --socket=/run/tailscale-ts2/tailscaled.sock"' \
| sudo tee /etc/profile.d/tailscale-ts2.sh