mirror of
https://github.com/jbowdre/runtimeterror.git
synced 2024-11-21 14:32:19 +00:00
new post: taking-taildrive-testdrive
This commit is contained in:
parent
436748e697
commit
b15c943f0b
3 changed files with 193 additions and 0 deletions
BIN
content/posts/taking-taildrive-testdrive/davfs-suid.png
Normal file
BIN
content/posts/taking-taildrive-testdrive/davfs-suid.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
BIN
content/posts/taking-taildrive-testdrive/files-tags.png
Normal file
BIN
content/posts/taking-taildrive-testdrive/files-tags.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 51 KiB |
193
content/posts/taking-taildrive-testdrive/index.md
Normal file
193
content/posts/taking-taildrive-testdrive/index.md
Normal file
|
|
@ -0,0 +1,193 @@
|
|||
---
|
||||
title: "Taking Taildrive for a Testdrive"
|
||||
date: "2024-07-29T23:48:29Z"
|
||||
# lastmod: 2024-07-28
|
||||
description: "A quick exploration of Taildrive, Tailscale's new(ish) feature to easily share directories with other machines on your tailnet without having to juggle authentication or network connectivity."
|
||||
featured: false
|
||||
toc: true
|
||||
reply: true
|
||||
categories: Tips
|
||||
tags:
|
||||
- linux
|
||||
- tailscale
|
||||
---
|
||||
My little [homelab](/homelab) is bit different from many others in that I don't have a SAN/NAS or other dedicated storage setup. This can sometimes make sharing files between systems a little bit tricky. I've used workarounds like [Tailscale Serve](/tailscale-ssh-serve-funnel/#tailscale-serve) for sharing files over HTTP or simply `scp`ing files around as needed, but none of those solutions are really very elegant.
|
||||
|
||||
Last week, Tailscale announced [a new integration](https://tailscale.com/blog/controld) with [ControlD](https://controld.com/) to add advanced DNS filtering and security. While I was getting that set up on my tailnet, I stumbled across an option I hadn't previously noticed in the Tailscale CLI: the `tailscale drive` command:
|
||||
|
||||
> Share a directory with your tailnet
|
||||
>
|
||||
> USAGE
|
||||
> `tailscale drive share <name> <path>`
|
||||
> `tailscale drive rename <oldname> <newname>`
|
||||
> `tailscale drive unshare <name>`
|
||||
> `tailscale drive list`
|
||||
>
|
||||
> Taildrive allows you to share directories with other machines on your tailnet.
|
||||
|
||||
That sounded kind of neat - especially once I found the corresponding [Taildrive documentation](https://tailscale.com/kb/1369/taildrive) and started to get a better understanding of how this new(ish) feature works:
|
||||
|
||||
> Normally, maintaining a file server requires you to manage credentials and access rules separately from the connectivity layer. Taildrive offers a file server that unifies connectivity and access controls, allowing you to share directories directly from the Tailscale client. You can then use your tailnet policy file to define which members of your tailnet can access a particular shared directory, and even define specific read and write permissions.
|
||||
>
|
||||
> Beginning in version 1.64.0, the Tailscale client includes a WebDAV server that runs on `100.100.100.100:8080` while Tailscale is connected. Every directory that you share receives a globally-unique path consisting of the tailnet, the machine name, and the share name: `/tailnet/machine/share`.
|
||||
>
|
||||
> For example, if you shared a directory with the share name `docs` from the machine `mylaptop` on the tailnet `mydomain.com`, the share's path would be `/mydomain.com/mylaptop/docs`.
|
||||
|
||||
Oh yeah. That will be a huge simplification for how I share files within my tailnet.
|
||||
|
||||
I've now had a chance to get this implemented on my tailnet and thought I'd share some notes on how I did it.
|
||||
|
||||
### ACL Changes
|
||||
My Tailscale policy relies heavily on [ACL tags](https://tailscale.com/kb/1068/acl-tags) to manage access between systems, especially for "headless" server systems which don't typically have users logged in to them. I don't necessarily want every system to be able to export a file share so I decided to control that capability with a new `tag:share` flag. Before I could use that tag, though, I had to [add it to the ACL](https://tailscale.com/kb/1068/acl-tags#define-a-tag):
|
||||
|
||||
```json
|
||||
{
|
||||
"groups": {
|
||||
"group:admins": ["user@example.com"],
|
||||
},
|
||||
"tagOwners": {
|
||||
"tag:share": ["group:admins"],
|
||||
},
|
||||
{...},
|
||||
}
|
||||
```
|
||||
|
||||
Next I needed to add the appropriate [node attributes](https://tailscale.com/kb/1337/acl-syntax#nodeattrs) to enable Taildrive sharing on devices with that tag and Taildrive access for all other systems:
|
||||
|
||||
```json
|
||||
{
|
||||
"nodeAttrs": {
|
||||
{
|
||||
// devices with the share tag can share files with Taildrive
|
||||
"target": ["tag:share"],
|
||||
"attr": ["drive:share"],
|
||||
},
|
||||
{
|
||||
// all devices can access shares
|
||||
"target": ["*"],
|
||||
"attr": ["drive:access"],
|
||||
},
|
||||
},
|
||||
{...},
|
||||
}
|
||||
```
|
||||
|
||||
And I created a pair of [Grants](https://tailscale.com/kb/1324/acl-grants) to give logged-in users read-write access and tagged devices read-only access:
|
||||
|
||||
```json
|
||||
{
|
||||
"grants":[
|
||||
{
|
||||
// users get read-write access to shares
|
||||
"src": ["autogroup:member"],
|
||||
"dst": ["tag:share"],
|
||||
"app": {
|
||||
"tailscale.com/cap/drive": [{
|
||||
"shares": ["*"],
|
||||
"access": "rw"
|
||||
}]
|
||||
}
|
||||
},
|
||||
{
|
||||
// tagged devices get read-only access
|
||||
"src": ["autogroup:tagged"],
|
||||
"dst": ["tag:share"],
|
||||
"app": {
|
||||
"tailscale.com/cap/drive": [{
|
||||
"shares": ["*"],
|
||||
"access": "ro"
|
||||
}]
|
||||
}
|
||||
}
|
||||
],
|
||||
{...},
|
||||
}
|
||||
```
|
||||
|
||||
That will let me create/manage files from the devices I regularly work on, and easily retrieve them as needed on the others.
|
||||
|
||||
Then I just used the Tailscale admin portal to add the new `tag:share` tag to my existing `files` node:
|
||||
|
||||
|
||||
|
||||
### Exporting the Share
|
||||
After making the required ACL changes, actually publishing the share was very straightforward. Per the [`tailscale drive --help` output](https://paste.jbowdre.lol/tailscale-drive), the syntax is:
|
||||
|
||||
```shell
|
||||
tailscale drive share <name> <path> # [tl! .cmd]
|
||||
```
|
||||
|
||||
I (somewhat-confusingly) wanted to share a share named `share`, found at `/home/john/share` (I *might* be bad at naming things) so I used this to export it:
|
||||
|
||||
```shell
|
||||
tailscale drive share share /home/john/share # [tl! .cmd]
|
||||
```
|
||||
|
||||
And I could verify that `share` had, in fact, been shared with:
|
||||
|
||||
```shell
|
||||
tailscale drive list # [tl! .cmd]
|
||||
name path as # [tl! .nocopy:2]
|
||||
----- ---------------- ----
|
||||
share /home/john/share john
|
||||
```
|
||||
|
||||
### Mounting the Share
|
||||
In order to mount the share from the Debian [Linux development environment on my Chromebook](https://support.google.com/chromebook/answer/9145439), I first needed to install the `davfs2` package to add support for mounting WebDAV shares:
|
||||
|
||||
```shell
|
||||
sudo apt update # [tl! .cmd:1]
|
||||
sudo apt install davfs2
|
||||
```
|
||||
|
||||
During the install of `davfs2`, I got prompted for whether or not I want to allow unprivileged users to mount WebDAV resources. I was in a hurry and just selected the default `<No>` response... before I realized that was probably a mistake (at least for this particular use case).
|
||||
|
||||
So I ran `sudo dpkg-reconfigure davfs2` to try again and this time made sure to select `<Yes>`:
|
||||
|
||||
|
||||
|
||||
That should ensure that the share gets mounted with appropriate privileges (otherwise, all the files would be owned by `root` and that could pose some additional challenges).
|
||||
|
||||
I also created a folder inside my home directory to use as a mountpoint:
|
||||
|
||||
```shell
|
||||
mkdir ~/taildrive # [tl! .cmd]
|
||||
```
|
||||
|
||||
I knew from the [Taildrive docs](https://tailscale.com/kb/1369/taildrive) that the WebDAV server would be running at `http://100.100.100.100:8080` and the share would be available at `/<tailnet>/<machine>/<share>`, so I added the following to my `/etc/fstab`:
|
||||
|
||||
```txt
|
||||
http://100.100.100.100:8080/example.com/files/share /home/john/taildrive/ davfs user,rw,noauto 0 0
|
||||
```
|
||||
|
||||
Then I ran `sudo systemctl daemon-reload` to make sure the system knew about the changes to the fstab.
|
||||
|
||||
Taildrive's WebDAV implementation doesn't require any additional authentication (that's handled automatically by Tailscale), but `davfs2` doesn't know that. So to keep it from prompting unnecessarily for credentials when attempting to mount the taildrive, I added this to the bottom of `~/.davfs2/secrets`, with empty strings taking the place of the username and password:
|
||||
|
||||
```txt
|
||||
/home/john/taildrive "" ""
|
||||
```
|
||||
|
||||
After that, I could mount the share like so:
|
||||
|
||||
```shell
|
||||
mount ~/taildrive # [tl! .cmd]
|
||||
```
|
||||
|
||||
And verify that I could see the files being shared from `share` on `files`:
|
||||
|
||||
```shell
|
||||
ls -l ~/taildrive # [tl! .cmd]
|
||||
drwxr-xr-x - john 15 Feb 09:20 books # [tl! .nocopy:5]
|
||||
drwxr-xr-x - john 22 Oct 2023 dist
|
||||
drwx------ - john 28 Jul 15:10 lost+found
|
||||
drwxr-xr-x - john 22 Nov 2023 media
|
||||
drwxr-xr-x - john 16 Feb 2023 notes
|
||||
.rw-r--r-- 18 john 10 Jan 2023 status
|
||||
```
|
||||
|
||||
Neat, right?
|
||||
|
||||
I'd like to eventually get this set up so that [AutoFS](https://help.ubuntu.com/community/Autofs) can handle mounting the Taildrive WebDAV share on the fly. I know that [won't work within the containerized Linux environment on my Chromebook](https://www.chromium.org/chromium-os/developer-library/guides/containers/containers-and-vms/#can-i-mount-filesystems) but I think it *should* be possible on an actual Linux system. My initial efforts were unsuccessful though; I'll update this post if I figure it out.
|
||||
|
||||
In the meantime, though, this will be a more convenient way for me to share files between my Tailscale-connected systems.
|
||||
Loading…
Reference in a new issue