Merge pull request #16 from tsirysndr/feat/tailscale

feat: integrate Tailscale support for Firecracker MicroVMs

Cargo.lock

···
  "actix-web",
  "anyhow",
  "env_logger",
+ "fire-config",
  "firecracker-prepare",
  "firecracker-process",
  "firecracker-state",

crates/fire-config/src/lib.rs

···
     pub cert: Option<String>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TailscaleOptions {
+    pub auth_key: Option<String>,
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct Vm {
     pub vcpu: Option<u16>,
···
     pub api_socket: Option<String>,
     pub mac: Option<String>,
     pub ssh_keys: Option<Vec<String>>,
+    pub tailscale: Option<TailscaleOptions>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
···
                 api_socket: None,
                 mac: None,
                 ssh_keys: None,
+                tailscale: None,
             },
             etcd: None,
         }

crates/fire-server/Cargo.toml

···
 firecracker-vm = { path = "../firecracker-vm" }
 firecracker-prepare = { path = "../firecracker-prepare" }
 firecracker-process = { path = "../firecracker-process" }
+fire-config = { path = "../fire-config" }
 serde_json = "1.0.145"
 sqlx = { version = "0.8.6", features = [
   "runtime-tokio",

crates/fire-server/src/api/microvm.rs

···
             boot_args: None,
             ssh_keys: None,
             start: None,
+            tailscale_auth_key: None,
         },
         false => serde_json::from_slice::<CreateMicroVM>(&body)?,
     };
···
 #[post("/{id}/start")]
 async fn start_microvm(
     id: web::Path<String>,
+    mut payload: web::Payload,
     pool: web::Data<Arc<Pool<Sqlite>>>,
 ) -> Result<impl Responder, actix_web::Error> {
     let id = id.into_inner();
+    let body = read_payload!(payload);
+    let tailscale_auth_key = match body.is_empty() {
+        true => None,
+        false => {
+            let params: serde_json::Value = serde_json::from_slice(&body)?;
+            params
+                .get("tailscale_auth_key")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string())
+        }
+    };
     let pool = pool.get_ref().clone();
-    let vm = services::microvm::start_microvm(pool, &id)
+    let vm = services::microvm::start_microvm(pool, &id, tailscale_auth_key)
         .await
         .map_err(actix_web::error::ErrorInternalServerError)?;
     Ok(HttpResponse::Ok().json(vm))

crates/fire-server/src/services/microvm.rs

···
 
 use crate::types::microvm::CreateMicroVM;
 use anyhow::Error;
+use fire_config::TailscaleOptions;
 use firecracker_state::{entity::virtual_machine::VirtualMachine, repo};
 use firecracker_vm::{constants::BRIDGE_DEV, types::VmOptions};
 use owo_colors::OwoColorize;
···
     Ok(Some(vm))
 }
 
-pub async fn start_microvm(pool: Arc<Pool<Sqlite>>, id: &str) -> Result<VirtualMachine, Error> {
+pub async fn start_microvm(
+    pool: Arc<Pool<Sqlite>>,
+    id: &str,
+    tailscale_auth_key: Option<String>,
+) -> Result<VirtualMachine, Error> {
     let vm = repo::virtual_machine::find(&pool, id).await?;
     if vm.is_none() {
         println!("[!] No virtual machine found with the name: {}", id);
···
         ssh_keys: vm
             .ssh_keys
             .map(|keys| keys.split(',').map(|s| s.to_string()).collect()),
+        tailscale: tailscale_auth_key.map(|key| TailscaleOptions {
+            auth_key: Some(key),
+        }),
     };
 
     let vm = start(pool, options, Some(vm.id)).await?;

crates/fire-server/src/types/microvm.rs

···
+use fire_config::TailscaleOptions;
 use firecracker_vm::{mac::generate_unique_mac, types::VmOptions};
 use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
···
 }
 
 #[derive(Serialize, Deserialize, Clone, ToSchema)]
+pub struct StartMicroVM {
+    pub tailscale_auth_key: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Clone, ToSchema)]
 pub struct CreateMicroVM {
     pub name: Option<String>,
     pub vcpus: Option<u8>,
···
     pub boot_args: Option<String>,
     pub ssh_keys: Option<Vec<String>>,
     pub start: Option<bool>,
+    pub tailscale_auth_key: Option<String>,
 }
 
 impl Into<VmOptions> for CreateMicroVM {
···
             rootfs: self.rootfs,
             bootargs: self.boot_args,
             mac_address: generate_unique_mac(),
+            tailscale: self.tailscale_auth_key.map(|key| TailscaleOptions {
+                auth_key: Some(key),
+            }),
             ..Default::default()
         }
     }

crates/firecracker-prepare/src/lib.rs

···
                 &debootstrap_dir,
                 "sh",
                 "-c",
-                "apt-get install -y systemd-resolved",
+                "apt-get install -y systemd-resolved ca-certificates curl",
             ],
             true,
         )?;
···
 
         let squashfs_root_dir = format!("{}/squashfs_root", app_dir);
         rootfs::extract_squashfs(&ubuntu_file, &squashfs_root_dir)?;
+
+        run_command(
+            "cp",
+            &["-r", "/etc/ssl", &format!("{}/etc/", squashfs_root_dir)],
+            true,
+        )?;
+        run_command(
+            "cp",
+            &[
+                "-r",
+                "/etc/ca-certificates",
+                &format!("{}/etc/", squashfs_root_dir),
+            ],
+            true,
+        )?;
 
         run_command(
             "chroot",

crates/firecracker-up/src/cmd/start.rs

···
 use std::process;
 
 use anyhow::Error;
+use fire_config::TailscaleOptions;
 use firecracker_state::repo;
 use firecracker_vm::types::VmOptions;
 
 use crate::cmd::up::up;
 
-pub async fn start(name: &str) -> Result<(), Error> {
+pub async fn start(name: &str, tailscale_auth_key: Option<String>) -> Result<(), Error> {
     let etcd = match fire_config::read_config() {
         Ok(config) => config.etcd,
         Err(_) => None,
···
         ssh_keys: vm
             .ssh_keys
             .map(|keys| keys.split(',').map(|s| s.to_string()).collect()),
+        tailscale: tailscale_auth_key.map(|key| TailscaleOptions {
+            auth_key: Some(key),
+        }),
     })
     .await?;
 

crates/firecracker-up/src/main.rs

···
         .subcommand(
             Command::new("start")
                 .arg(arg!(<name> "Name of the Firecracker MicroVM to start").required(true))
+                .arg(
+                    Arg::new("tailscale-auth-key")
+                        .long("tailscale-auth-key")
+                        .value_name("TAILSCALE_AUTH_KEY")
+                        .help("Tailscale auth key to connect the VM to a Tailscale network"),
+                )
                 .about("Start Firecracker MicroVM"),
         )
         .subcommand(
···
         .subcommand(
             Command::new("restart")
                 .arg(arg!(<name> "Name of the Firecracker MicroVM to restart").required(true))
+                .arg(
+                    Arg::new("tailscale-auth-key")
+                        .long("tailscale-auth-key")
+                        .value_name("TAILSCALE_AUTH_KEY")
+                        .help("Tailscale auth key to connect the VM to a Tailscale network"),
+                )
                 .about("Restart Firecracker MicroVM"),
         )
         .subcommand(
···
                         .long("ssh-keys")
                         .value_name("SSH_KEYS")
                         .help("Comma-separated list of SSH public keys to add to the VM"),
+                )
+                .arg(
+                    Arg::new("tailscale-auth-key")
+                        .long("tailscale-auth-key")
+                        .value_name("TAILSCALE_AUTH_KEY")
+                        .help("Tailscale auth key to connect the VM to a Tailscale network"),
                 )
                 .about("Start a new Firecracker MicroVM"),
         )
···
                 .value_name("SSH_KEYS")
                 .help("Comma-separated list of SSH public keys to add to the VM"),
         )
+        .arg(
+            Arg::new("tailscale-auth-key")
+                .long("tailscale-auth-key")
+                .value_name("TAILSCALE_AUTH_KEY")
+                .help("Tailscale auth key to connect the VM to a Tailscale network"),
+        )
 }
 
 #[tokio::main]
···
         }
         Some(("start", args)) => {
             let name = args.get_one::<String>("name").cloned().unwrap();
-            start(&name).await?;
+            let tailscale_auth_key = args.get_one::<String>("tailscale-auth-key").cloned();
+            start(&name, tailscale_auth_key).await?;
         }
         Some(("restart", args)) => {
             let name = args.get_one::<String>("name").cloned().unwrap();
+            let tailscale_auth_key = args.get_one::<String>("tailscale-auth-key").cloned();
             stop(&name).await?;
-            start(&name).await?;
+            start(&name, tailscale_auth_key).await?;
         }
         Some(("up", args)) => {
             let vcpu = matches
···
             let ssh_keys = args
                 .get_one::<String>("ssh-keys")
                 .map(|s| s.split(',').map(|s| s.trim().to_string()).collect());
+            let tailscale_auth_key = args.get_one::<String>("tailscale-auth-key").cloned();
             let options = VmOptions {
                 debian: args.get_one::<bool>("debian").copied(),
                 alpine: args.get_one::<bool>("alpine").copied(),
···
                 mac_address,
                 etcd: None,
                 ssh_keys,
+                tailscale: tailscale_auth_key.map(|key| fire_config::TailscaleOptions {
+                    auth_key: Some(key),
+                }),
             };
             up(options).await?
         }
···
             let ssh_keys = matches
                 .get_one::<String>("ssh-keys")
                 .map(|s| s.split(',').map(|s| s.trim().to_string()).collect());
+            let tailscale_auth_key = matches.get_one::<String>("tailscale-auth-key").cloned();
 
             let options = VmOptions {
                 debian: Some(debian),
···
                 mac_address,
                 etcd: None,
                 ssh_keys,
+                tailscale: tailscale_auth_key.map(|key| fire_config::TailscaleOptions {
+                    auth_key: Some(key),
+                }),
             };
             up(options).await?
         }

crates/firecracker-vm/src/guest.rs

···
 use crate::{command::run_command, constants::BRIDGE_IP};
 use anyhow::Result;
 
-pub fn configure_guest_network(key_name: &str, guest_ip: &str) -> Result<()> {
+pub fn configure_guest_network(key_path: &str, guest_ip: &str) -> Result<()> {
     println!("[+] Configuring network in guest...");
     const MAX_RETRIES: u32 = 20;
     let mut retries = 0;
···
             "ssh",
             &[
                 "-i",
-                key_name,
+                key_path,
                 "-o",
                 "StrictHostKeyChecking=no",
                 &format!("root@{}", guest_ip),

crates/firecracker-vm/src/lib.rs

···
 mod mosquitto;
 mod mqttc;
 mod network;
+mod tailscale;
 pub mod types;
 
 pub async fn setup(
···
         let guest_ip = format!("{}.firecracker", name);
         guest::configure_guest_network(&key_name, &guest_ip)?;
     }
+
+    tailscale::setup_tailscale(&name, options)?;
+
     let pool = firecracker_state::create_connection_pool().await?;
 
     let ip_file = format!("/tmp/firecracker-{}.ip", name);

crates/firecracker-vm/src/tailscale.rs

···
+use std::fs;
+
+use anyhow::anyhow;
+use anyhow::Context;
+use anyhow::Error;
+use firecracker_prepare::command::run_command_with_stdout_inherit;
+use owo_colors::OwoColorize;
+
+use crate::types::VmOptions;
+
+pub fn setup_tailscale(name: &str, config: &VmOptions) -> Result<(), Error> {
+    if let Some(tailscale) = &config.tailscale {
+        if let Some(auth_key) = &tailscale.auth_key {
+            let len = auth_key.len();
+            let display_key = if len > 16 {
+                format!("{}****{}", &auth_key[..16], &auth_key[len - 4..])
+            } else {
+                return Err(anyhow!("Tailscale auth key is too short"));
+            };
+            println!("[+] Setting up Tailscale with auth key: {}", display_key);
+            let key_path =
+                get_private_key_path().with_context(|| "Failed to get SSH private key path")?;
+
+            let guest_ip = format!("{}.firecracker", name);
+            run_ssh_command(&key_path, &guest_ip, "rm -f /etc/security/namespace.init")?;
+            run_ssh_command(
+                &key_path,
+                &guest_ip,
+                "type tailscaled || curl -fsSL https://tailscale.com/install.sh | sh",
+            )?;
+            run_ssh_command(
+                &key_path,
+                &guest_ip,
+                &format!("tailscale up --auth-key {} --hostname {}", auth_key, name),
+            )?;
+            run_ssh_command(
+                &key_path,
+                &guest_ip,
+                "systemctl enable --now tailscaled || true",
+            )?;
+            run_ssh_command(&key_path, &guest_ip, "systemctl status tailscaled || true")?;
+            run_ssh_command(&key_path, &guest_ip, "tailscale status || true")?;
+            println!("[+] Tailscale setup completed.");
+            println!(
+                "[+] You can access the VM via its Tailscale domain: {}",
+                format!("{}.tailscale.net", name).cyan()
+            );
+            return Ok(());
+        }
+    }
+
+    println!("[+] Tailscale auth key not provided, skipping Tailscale setup.");
+    Ok(())
+}
+
+fn run_ssh_command(key_path: &str, guest_ip: &str, command: &str) -> Result<(), Error> {
+    run_command_with_stdout_inherit(
+        "ssh",
+        &[
+            "-i",
+            key_path,
+            "-o",
+            "StrictHostKeyChecking=no",
+            &format!("root@{}", guest_ip),
+            command,
+        ],
+        false,
+    )?;
+    Ok(())
+}
+
+fn get_private_key_path() -> Result<String, Error> {
+    let home_dir = dirs::home_dir().ok_or_else(|| anyhow!("Failed to get home directory"))?;
+    let app_dir = format!("{}/.fireup", home_dir.display());
+    let key_name = glob::glob(format!("{}/id_rsa", app_dir).as_str())
+        .with_context(|| "Failed to glob ssh key files")?
+        .last()
+        .ok_or_else(|| anyhow!("No SSH key file found"))?
+        .with_context(|| "Failed to get SSH key path")?;
+    let key_name = fs::canonicalize(&key_name)
+        .with_context(|| {
+            format!(
+                "Failed to resolve absolute path for SSH key: {}",
+                key_name.display()
+            )
+        })?
+        .display()
+        .to_string();
+    Ok(key_name)
+}

crates/firecracker-vm/src/types.rs

···
-use fire_config::{EtcdConfig, FireConfig};
+use fire_config::{EtcdConfig, FireConfig, TailscaleOptions};
 use firecracker_prepare::Distro;
 
 use crate::constants::{BRIDGE_DEV, FC_MAC, FIRECRACKER_SOCKET};
···
     pub mac_address: String,
     pub etcd: Option<EtcdConfig>,
     pub ssh_keys: Option<Vec<String>>,
+    pub tailscale: Option<TailscaleOptions>,
 }
 
 impl From<FireConfig> for VmOptions {
···
             mac_address: vm.mac.unwrap_or(FC_MAC.into()),
             etcd: config.etcd.clone(),
             ssh_keys: vm.ssh_keys.clone(),
+            tailscale: vm.tailscale.clone(),
         }
     }
 }