Setup Tailscale on an immutable Linux system (e.g. GNOME OS or Fedora Silverblue)

main.sh

#!/bin/bash

sudo podman rm -f tailscaled
# If you want to store the Tailscale secrets on the TPM, add --device=/dev/tpm0 to the Podman flags below
sudo podman run -d \
  --name=tailscaled \
  --restart=always \
  -v tailscale-data:/var/lib/tailscale \
  -v /dev/net/tun:/dev/net/tun \
  -v /run:/run \
  -v /etc/passwd:/etc/passwd:ro \
  -v /etc/group:/etc/group:ro \
  --network=host \
  --cap-add=NET_ADMIN \
  --cap-add=NET_RAW \
  -e TS_STATE_DIR=/var/lib/tailscale \
  docker.io/tailscale/tailscale \
  tailscaled --state=/var/lib/tailscale/tailscaled.state
sudo systemctl enable --now podman-restart

sudo podman exec tailscaled tailscale set --operator=${USER}

sudo tee /etc/systemd/network/50-tailscale.network << 'EOF'
[Match]
Name=tailscale0

[Network]
DNS=100.100.100.100
DNS=fd7a:115c:a1e0::53
Domains=~ts.net
EOF

sudo systemctl restart systemd-networkd systemd-resolved
  
# Now manage the Tailscale daemon via https://flathub.org/apps/dev.deedles.Trayscale or https://flathub.org/apps/org.fkoehler.KTailctl