Sign all mullvad nodes for use in a locked tailnet.

tailscale-sign-mullvad.sh

set -euo pipefail

die () {
    echo >&2 "$@"
    exit 1
}

echo "This script will blindly sign all nodes with name '*.mullvad.ts.net.'."
read -p "If you wish to proceed, please enter 'Yes, I wish to proceed': " confirm

case $confirm in
    "Yes, I wish to proceed") echo "Confirmed.";;
    *) die "Exiting.";;
esac

ts_lock_json=$(tailscale lock status --json)

# No 'neat' way to suppress 'true|false' output from jq.
# TODO: Redirect output to /dev/null?
(jq -e '.Enabled' <<< $ts_lock_json) || die "Tailnet lock is disabled!"

public_key=$(jq -r '.PublicKey' <<< $ts_lock_json)

echo "Will sign mullvad nodes with $public_key"
sleep 1
echo "----------------------------------------"

# Loop through unsigned nodes
jq -c '.FilteredPeers.[]' <<< $ts_lock_json | while read peer; do
    name=$(jq -r '.Name' <<< $peer)
    if [[ ! $name =~ .*".mullvad.ts.net." ]]; then
        echo "$name is not a Mullvad node, skipping"
        continue
    fi

    nodekey=$(jq -r '.NodeKey' <<< $peer)
    echo "Signing $name ($nodekey) with $public_key"
    tailscale lock sign $nodekey $public_key
done