Add Tailscale integration and fix CF Access policy OR logic bug

Tailscale: OAuth-based manager, API routes, settings UI, reconciler hooks,
config loader support, and Docker/env wiring.

Author: ChrispyBacon-dev

dockflare/Dockerfile

@@ -33,6 +33,8 @@ RUN echo "DEBUG: Contents of /usr/src/app/app/static AFTER npm run build:css:" &
 RUN echo "DEBUG: Specifically checking for /usr/src/app/app/static/css/output.css AFTER npm run build:css:"
 RUN ls -l /usr/src/app/app/static/css/output.css || echo "/usr/src/app/app/static/css/output.css NOT FOUND after build"
 
+FROM tailscale/tailscale:latest AS tailscale-cli
+
 FROM python:3.13-slim AS runtime
 ARG DOCKFLARE_UID=65532
 ARG DOCKFLARE_GID=65532
@@ -42,6 +44,7 @@ WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends wget ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
+COPY --from=tailscale-cli /usr/local/bin/tailscale /usr/local/bin/tailscale
 RUN mkdir -p /app/static/css
 COPY --from=frontend-builder /usr/src/app/app/static/css/output.css /app/static/css/output.css
 COPY ./app /app

dockflare/app/__init__.py

@@ -38,6 +38,7 @@
 
 tunnel_state = { "name": config.TUNNEL_NAME, "id": None, "token": None, "status_message": "Initializing...", "error": None }
 cloudflared_agent_state = { "container_status": "unknown", "last_action_status": None }
+tailscale_state = { "node": None, "version_mismatch": False, "last_error": None, "service_count": 0 }
 
 log_queue = queue.Queue(maxsize=config.MAX_LOG_QUEUE_SIZE)
 state_update_queue = queue.Queue(maxsize=50) 
@@ -263,6 +264,11 @@ def inject_version():
         app_instance.register_blueprint(email_bp)
         logging.info("Email blueprint registered.")
 
+        from .web.tailscale_api_routes import tailscale_api_bp
+        csrf.exempt(tailscale_api_bp)
+        app_instance.register_blueprint(tailscale_api_bp)
+        logging.info("Tailscale API blueprint registered.")
+
     return app_instance
 
 app = create_app()

dockflare/app/config.py

@@ -154,3 +154,17 @@ def _get_int_env(name, default, minimum=None):
 EMAIL_JWT_AUDIENCE = 'dockflare-mail'
 EMAIL_JWT_EXPIRY_SECONDS = 3600
 
+TAILSCALE_SOCKET = '/var/run/tailscale/tailscaled.sock'
+TAILSCALE_CLI_TIMEOUT = 30
+TAILSCALE_RECONCILE_INTERVAL = 60
+TAILSCALE_CLEANUP_ON_SHUTDOWN = False
+TAILSCALE_LABEL_NS = f"{LABEL_PREFIX}ts."
+
+TAILSCALE_ENABLED = False
+TAILSCALE_OAUTH_CLIENT_ID = None
+TAILSCALE_OAUTH_CLIENT_SECRET = None
+TAILSCALE_TAILNET = '-'
+TAILSCALE_DEFAULT_TAGS = ['tag:container']
+TAILSCALE_IGNORE_SERVICES = []
+TAILSCALE_SERVICE_PREFIX = ''
+

dockflare/app/core/docker_handler.py

@@ -26,7 +26,7 @@
 
 from app import config, docker_client, cloudflared_agent_state, tunnel_state, publish_state_event
 
-from app.core.state_manager import managed_rules, state_lock, save_state
+from app.core.state_manager import managed_rules, state_lock, save_state, tailscale_rules, upsert_tailscale_rule
 from app.core.tunnel_manager import update_cloudflare_config
 from app.core.cloudflare_api import create_cloudflare_dns_record, get_zone_id_from_name, list_account_zones
 from app.core.access_manager import handle_access_policy_from_labels
@@ -91,6 +91,126 @@ def is_valid_service(service_str):
     logging.warning(f"Invalid service string format: '{service_str}' does not match supported patterns (HTTP, HTTPS, TCP, SSH, RDP, HTTP_STATUS, Bastion).")
     return False
 
+def _parse_tailscale_configs(labels, container_id, container_name):
+    ts_ns = config.TAILSCALE_LABEL_NS
+    if labels.get(f"{ts_ns}enable", "false").lower() not in ("true", "1", "t", "yes"):
+        return []
+
+    name = labels.get(f"{ts_ns}name") or container_name.lstrip("/").lower().replace("_", "-")
+
+    port_str = labels.get(f"{ts_ns}port", "")
+    if not port_str:
+        logging.warning("TS_HANDLER: Container %s has ts.enable but no ts.port, skipping.", container_name)
+        return []
+
+    try:
+        port = int(port_str)
+    except ValueError:
+        logging.warning("TS_HANDLER: Invalid ts.port '%s' for %s, skipping.", port_str, container_name)
+        return []
+
+    protocol = labels.get(f"{ts_ns}protocol", "https")
+    if protocol not in ("http", "https", "tcp"):
+        logging.warning("TS_HANDLER: Invalid ts.protocol '%s' for %s, using https.", protocol, container_name)
+        protocol = "https"
+
+    funnel = labels.get(f"{ts_ns}funnel", "false").lower() in ("true", "1", "t", "yes")
+
+    try:
+        funnel_port = int(labels.get(f"{ts_ns}funnel_port", "443"))
+    except ValueError:
+        funnel_port = 443
+
+    destination = labels.get(f"{ts_ns}destination", f"localhost:{port}")
+
+    return [{
+        "name": name,
+        "port": port,
+        "protocol": protocol,
+        "funnel": funnel,
+        "funnel_port": funnel_port,
+        "destination": destination,
+        "container_id": container_id,
+        "container_name": container_name,
+    }]
+
+
+def _process_tailscale_start(labels, container_id, container_name):
+    if not config.TAILSCALE_ENABLED:
+        return
+
+    from app.core import tailscale_manager
+
+    ts_configs = _parse_tailscale_configs(labels, container_id, container_name)
+    if not ts_configs:
+        return
+
+    for ts_cfg in ts_configs:
+        name = ts_cfg["name"]
+        rule_key = tailscale_manager._build_svc_name(name)
+        try:
+            tailscale_manager.add_service(
+                name=name,
+                port=ts_cfg["port"],
+                protocol=ts_cfg["protocol"],
+                destination=ts_cfg["destination"],
+            )
+            rule_data = {
+                "name": name,
+                "port": ts_cfg["port"],
+                "protocol": ts_cfg["protocol"],
+                "destination": ts_cfg["destination"],
+                "funnel": ts_cfg["funnel"],
+                "funnel_port": ts_cfg["funnel_port"],
+                "container_id": container_id,
+                "container_name": container_name,
+                "status": "active",
+                "delete_at": None,
+                "source": "docker",
+                "funnel_active": False,
+            }
+            if ts_cfg["funnel"]:
+                try:
+                    tailscale_manager.enable_funnel(
+                        funnel_port=ts_cfg["funnel_port"],
+                        protocol=ts_cfg["protocol"],
+                        destination=ts_cfg["destination"],
+                    )
+                    rule_data["funnel_active"] = True
+                except tailscale_manager.TailscaleFunnelACLError as e:
+                    logging.error("TS_HANDLER: Funnel ACL error for %s: %s", name, e)
+            upsert_tailscale_rule(rule_key, rule_data)
+            logging.info("TS_HANDLER: Registered service %s for container %s", rule_key, container_name)
+        except tailscale_manager.TailscaleSocketError as e:
+            logging.error("TS_HANDLER: Socket error for %s: %s", name, e)
+        except tailscale_manager.TailscaleUntaggedNodeError as e:
+            logging.error("TS_HANDLER: Untagged node error for %s: %s", name, e)
+        except tailscale_manager.TailscaleCLIError as e:
+            logging.error("TS_HANDLER: CLI error for %s: %s", name, e)
+        except Exception as e:
+            logging.error("TS_HANDLER: Unexpected error for %s: %s", name, e, exc_info=True)
+
+
+def _process_tailscale_stop(container_id):
+    if not config.TAILSCALE_ENABLED:
+        return
+
+    from datetime import datetime, timedelta, timezone
+
+    state_changed = False
+    delete_at = datetime.now(timezone.utc) + timedelta(seconds=config.GRACE_PERIOD_SECONDS)
+
+    with state_lock:
+        for rule_key, rule_data in list(tailscale_rules.items()):
+            if rule_data.get("container_id") == container_id and rule_data.get("status") == "active":
+                rule_data["status"] = "pending_deletion"
+                rule_data["delete_at"] = delete_at
+                state_changed = True
+                logging.info("TS_HANDLER: Scheduled deletion of %s at %s", rule_key, delete_at.isoformat())
+        if state_changed:
+            save_state()
+
+
 def process_container_start(container_obj):
     from app import app
     with app.app_context():
@@ -272,6 +392,7 @@ def process_container_start(container_obj):
                 index += 1
             if not hostnames_to_process:
                 logging.warning(f"DOCKER_HANDLER: No valid hostname configs for {container_name_val} ({container_id_val[:12]}).")
+                _process_tailscale_start(labels, container_id_val, container_name_val)
                 return
 
             logging.info(f"DOCKER_HANDLER: Found {len(hostnames_to_process)} hostname configurations for container {container_name_val}")
@@ -490,6 +611,7 @@ def process_container_start(container_obj):
                 else:
                     logging.error(f"DOCKER_HANDLER: Failed to update Cloudflare tunnel config for {container_name_val}. DNS records not managed.")
 
+            _process_tailscale_start(labels, container_id_val, container_name_val)
 
         except NotFound:
             logging.warning(f"DOCKER_HANDLER: Container {container_name_val} ({container_id_val[:12] if container_id_val else 'UnknownID'}) not found.")
@@ -536,6 +658,8 @@ def schedule_container_stop(container_id_val):
                 save_state()
                 publish_state_event('snapshot_refresh')
 
+        _process_tailscale_stop(container_id_val)
+
 def docker_event_listener(stop_event_param, label_prefix):
     if not docker_client:
         logging.error(f"Docker client unavailable, event listener for {label_prefix} cannot start.")

dockflare/app/core/reconciler.py

@@ -23,7 +23,7 @@
 from app import config, docker_client, tunnel_state, publish_state_event
 from flask import current_app 
 
-from app.core.state_manager import managed_rules, state_lock, save_state, get_agent, update_agent
+from app.core.state_manager import managed_rules, state_lock, save_state, get_agent, update_agent, tailscale_rules, upsert_tailscale_rule, remove_tailscale_rule, list_tailscale_rules
 from app.core.cloudflare_api import (
     get_zone_id_from_name, 
     create_cloudflare_dns_record,
@@ -687,3 +687,140 @@ def cleanup_expired_rules(stop_event_param):
             stop_event_param.wait(wait_duration)
 
     logging.info("Cleanup task for expired rules stopped.")
+
+
+def _run_tailscale_reconciliation():
+    from app import app as main_app
+    from app.core import tailscale_manager
+    from app.core.docker_handler import _parse_tailscale_configs
+
+    with main_app.app_context():
+        if not config.TAILSCALE_ENABLED:
+            return
+
+        desired_rules = {}
+        try:
+            containers = docker_client.containers.list(all=False)
+            for c in containers:
+                try:
+                    c.reload()
+                    ts_configs = _parse_tailscale_configs(c.labels, c.id, c.name)
+                    for ts_cfg in ts_configs:
+                        rule_key = tailscale_manager._build_svc_name(ts_cfg["name"])
+                        desired_rules[rule_key] = ts_cfg
+                except Exception as e_cont:
+                    logging.error("TS_RECONCILE: Error parsing container %s: %s", c.id[:12] if c.id else "?", e_cont)
+        except Exception as e_list:
+            logging.error("TS_RECONCILE: Error listing containers: %s", e_list)
+            return
+
+        current_rules = list_tailscale_rules()
+
+        for rule_key, ts_cfg in desired_rules.items():
+            existing = current_rules.get(rule_key)
+            if existing and existing.get("status") == "active":
+                continue
+
+            if existing and existing.get("status") == "pending_deletion":
+                existing["status"] = "active"
+                existing["delete_at"] = None
+                existing["container_id"] = ts_cfg["container_id"]
+                upsert_tailscale_rule(rule_key, existing)
+                logging.info("TS_RECONCILE: Restored %s (was pending_deletion)", rule_key)
+                continue
+
+            try:
+                tailscale_manager.add_service(
+                    name=ts_cfg["name"],
+                    port=ts_cfg["port"],
+                    protocol=ts_cfg["protocol"],
+                    destination=ts_cfg["destination"],
+                )
+                rule_data = {
+                    "name": ts_cfg["name"],
+                    "port": ts_cfg["port"],
+                    "protocol": ts_cfg["protocol"],
+                    "destination": ts_cfg["destination"],
+                    "funnel": ts_cfg["funnel"],
+                    "funnel_port": ts_cfg["funnel_port"],
+                    "container_id": ts_cfg["container_id"],
+                    "container_name": ts_cfg["container_name"],
+                    "status": "active",
+                    "delete_at": None,
+                    "source": "docker",
+                    "funnel_active": False,
+                }
+                if ts_cfg["funnel"]:
+                    try:
+                        tailscale_manager.enable_funnel(
+                            funnel_port=ts_cfg["funnel_port"],
+                            protocol=ts_cfg["protocol"],
+                            destination=ts_cfg["destination"],
+                        )
+                        rule_data["funnel_active"] = True
+                    except tailscale_manager.TailscaleFunnelACLError as e:
+                        logging.error("TS_RECONCILE: Funnel ACL error for %s: %s", rule_key, e)
+                upsert_tailscale_rule(rule_key, rule_data)
+                logging.info("TS_RECONCILE: Added service %s", rule_key)
+            except tailscale_manager.TailscaleSocketError as e:
+                logging.error("TS_RECONCILE: Socket error adding %s: %s", rule_key, e)
+            except tailscale_manager.TailscaleCLIError as e:
+                logging.error("TS_RECONCILE: CLI error adding %s: %s", rule_key, e)
+
+        now_utc = datetime.now(timezone.utc)
+        for rule_key, rule_data in current_rules.items():
+            if rule_data.get("status") != "active":
+                continue
+            if rule_data.get("source", "docker") != "docker":
+                continue
+            if rule_key not in desired_rules:
+                delete_at = now_utc + timedelta(seconds=config.GRACE_PERIOD_SECONDS)
+                rule_data = dict(rule_data)
+                rule_data["status"] = "pending_deletion"
+                rule_data["delete_at"] = delete_at
+                upsert_tailscale_rule(rule_key, rule_data)
+                logging.info("TS_RECONCILE: Marked %s for deletion at %s", rule_key, delete_at.isoformat())
+
+
+def tailscale_background_loop(stop_event_param):
+    from app import app as main_app
+    from app.core import tailscale_manager
+
+    logging.info("Tailscale background loop starting.")
+
+    while not stop_event_param.is_set():
+        next_run = time.time() + config.TAILSCALE_RECONCILE_INTERVAL
+
+        with main_app.app_context():
+            try:
+                if config.TAILSCALE_ENABLED:
+                    _run_tailscale_reconciliation()
+
+                    now_utc = datetime.now(timezone.utc)
+                    for rule_key, rule_data in list(list_tailscale_rules().items()):
+                        if rule_data.get("status") != "pending_deletion":
+                            continue
+                        delete_at = rule_data.get("delete_at")
+                        if isinstance(delete_at, datetime):
+                            delete_at_utc = delete_at.astimezone(timezone.utc) if delete_at.tzinfo else delete_at.replace(tzinfo=timezone.utc)
+                            if delete_at_utc > now_utc:
+                                continue
+                        try:
+                            tailscale_manager.remove_service(rule_data.get("name", rule_key))
+                            if rule_data.get("funnel_active"):
+                                tailscale_manager.disable_funnel(
+                                    rule_data.get("funnel_port", 443),
+                                    rule_data.get("protocol", "https"),
+                                )
+                            remove_tailscale_rule(rule_key)
+                            logging.info("TS_CLEANUP: Removed expired service %s", rule_key)
+                        except Exception as e:
+                            logging.error("TS_CLEANUP: Error removing %s: %s", rule_key, e)
+            except Exception as e_outer:
+                logging.error("TS_BACKGROUND: Loop error: %s", e_outer, exc_info=True)
+
+        wait_duration = max(0, next_run - time.time())
+        if not stop_event_param.is_set():
+            stop_event_param.wait(wait_duration)
+
+    logging.info("Tailscale background loop stopped.")