在 Linux/Ubuntu 上部署 DERPer

准备

准备服务器、域名(域名需要备案)
获取一张和你准备使用的域名相匹配的 SSL 证书，来源不限于
1. 云服务商申请
2. 通过 CertBot 申请 (Let’s Encrypt)
3. 通过 acme.sh 申请 (Let’s Encrypt) 推荐。

拿到证书后需要另存为其他位置和命名格式：

来自来源1的证书需要手动发送到服务器，推荐保存到 /etc/derper/, 命名格式为 <YOUR DOMAIN>.crt和<YOUR DOMAIN>.key
如果你使用 CertBot, 需要执行:

cp /etc/letsencrypt/live/<YOUR DOMAIN>/fullchain.pem /etc/derper/<YOUR DOMAIN>.crt
cp /etc/letsencrypt/live/<YOUR DOMAIN>/privkey.pem /etc/derper/<YOUR DOMAIN>.key

如果你使用 acme.sh, 需要执行:

cp ~/.acme.sh/<YOUR DOMAIN>_ecc/fullchain.cer /etc/derper/<YOUR DOMAIN>.crt
cp ~/.acme.sh/<YOUR DOMAIN>_ecc/<YOUR DOMAIN>.key /etc/derper/<YOUR DOMAIN>.key

防火墙放行端口
- TCP/443 (或者你的自定义端口)
- TCP/80
- UDP/3478 (用于STUN)

安装 GOLANG

#!/bin/bash
set -e
GO_VERSION=$(curl -s https://go.dev/dl/?mode=json | grep -o '"version":\s*"go[^"]*"' | head -n1 | cut -d'"' -f4)
echo "Latest version: $GO_VERSION"
wget -O /tmp/go.tar.gz "https://go.dev/dl/${GO_VERSION}.linux-amd64.tar.gz"
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf /tmp/go.tar.gz
grep -q "GOROOT=/usr/local/go" /etc/profile || cat >> /etc/profile <<'EOF'
export GOROOT=/usr/local/go
export GOPATH=/usr/local/gopath
export GOBIN=$GOPATH/bin
export PATH=$PATH:$GOROOT/bin
export PATH=$PATH:$GOPATH/bin
EOF
source /etc/profile && source ~/.bashrc

安装 derper

(可选)设置go代理

go env -w GOPROXY=https://goproxy.cn,direct

go安装

go install tailscale.com/cmd/derper@main

创建 systemd 服务单元文件

如果你通过 derper 做 TLS 终结:

mkdir -p /etc/derper
[ -f "/etc/systemd/system/derper.service" ] || cat >> /etc/systemd/system/derper.service <<'EOF'
[Unit]
Description=Tailscale DERP Server
After=network.target

[Service]
Type=simple
WorkingDirectory=/usr/local/gopath/bin
ExecStart=/usr/local/gopath/bin/derper \
 --hostname <REPLACE TO YOUR OWN DOMAIN> \
 -c /etc/derper/derper.conf \
 -a :443 \
 --http-port 80 \
 --certdir /etc/derper/ \
 --certmode manual \
 --mesh-psk-file /etc/derper/mesh.key \
 --stun
StandardOutput=journal
StandardError=journal
Restart=on-failure
RestartSec=3

[Install]
WantedBy=multi-user.target
EOF

如果你通过 nginx 等反向代理做 TLS 终结:

mkdir -p /etc/derper
[ -f "/etc/systemd/system/derper.service" ] || cat >> /etc/systemd/system/derper.service <<'EOF'
[Unit]
Description=Tailscale DERP Server
After=network.target

[Service]
Type=simple
WorkingDirectory=/usr/local/gopath/bin
ExecStart=/usr/local/gopath/bin/derper \
 --hostname <REPLACE TO YOUR OWN DOMAIN> \
 -c /etc/derper/derper.conf \
 -a :56473 \
 --http-port 56473 \
 --mesh-psk-file /etc/derper/mesh.key \
 --stun
StandardOutput=journal
StandardError=journal
Restart=on-failure
RestartSec=3

[Install]
WantedBy=multi-user.target
EOF

修改刚才的服务单元文件
```
nano /etc/systemd/system/derper.service
```
- hostname 部分需要改成你自己的
- 端口号可以改，但是需要记住
- Mesh 密钥只在你同时运行多台 derper 时生效，需要保证各机器上的 key 相同
设置反向代理(这里以 nginx 为例)

server {
  listen       443 ssl;
  listen       [::]:443 ssl;
  http2        on;
  listen       443 quic;
  server_name  <YOUR DOMAIN>;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256';
  ssl_prefer_server_ciphers on;

  ssl_early_data on;
  quic_retry on;
  quic_gso on;

  add_header Alt-Svc 'h3=":443"; ma=86400';
  add_header QUIC-Status $http3;

  ssl_certificate      <YOUR CERT PATH>;
  ssl_certificate_key  <YOUR KEY PATH>;

  location / {
    client_max_body_size 1G;

    # websockets
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";

    # other settings
    proxy_set_header  Host $host;
    proxy_set_header  X-Real-IP $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto $scheme;
    proxy_pass        http://127.0.0.1:56473;
  }
}

server {
  listen       80;
  server_name  <YOUR DOMAIN>;

  location /generate_204 {
    return 204;
  }

  return 307 https://<YOUR DOMAIN>$request_uri;
}

启动 derper

systemctl daemon-reload
systemctl enable derper.service
systemctl start derper.service

Tailscale启动和登录

本地打开网址登录

tailscale up

前往 https://login.tailscale.com/admin/machines/new-linux 生成命令一键安装 tailscale 和登录

Tailscale ACL添加节点

在 ACL 里添加以下配置

"derpMap": {
	"OmitDefaultRegions": false, // 选择是否忽略所有官方节点
	"Regions": {
		"901":                     // 这里从 900 到 999 取一个数字
    {
			"RegionID":   901,       // RegionID 和上面的键相等
			"RegionCode": "ydx",     // 会显示在 netcheck 前面和移动端节点连接性测试页面
			"RegionName": "Beijing", // 会显示在 netcheck 后面
			"Nodes": [
				{
					"Name":     "Tencent",
					"RegionID": 901,
					"HostName": "",      // 前面步骤里用到的域名
					"IPv4":     "",      // 如实填写公网地址能减少 dns 解析时间
					"IPv6":     "",
					"DERPPort": 443,
					"STUNPort": 3478,
				},
			],
		},
	},
},

[1] 教程来自知乎大内网战略(6)：自建 Tailscale DERP 中继服务器保姆级教程