<div dir="ltr"><div>Hi, everyone.</div><div><br></div><div>The high-level overview: I'm trying to install <a href="https://tailscale.com/">Tailscale</a> as a portable service on my Steam Deck. <br></div><div><br></div><div>Tailscale is a point-to-point VPN service, essentially a wrapper around Wireguard that helps with network setup and management. The Steam Deck is Valve's handheld PC running SteamOS 3, which is derived from Arch. It uses an A/B partition system for system files, meaning you can't install a service the normal way.</div><div><br></div><div>There <i>is</i> <a href="https://tailscale.com/blog/steam-deck/">a guide to do this</a>, posted on their own blog, but it uses system extensions which aren't good for services that you want to run on startup. Indeed, following that guide puts me in a state where I have to manually start the daemon every time I reboot my Deck, even with the service enabled.<br></div><div><br></div><div>Let's move on to how I've started to do this.<br></div><div><br></div><div>Tailscale is available through most package managers, but they also publish <a href="https://pkgs.tailscale.com/stable/#static">static binaries with systemd unit files</a>. <br></div><div><br></div><div>This script grabs that binary, extracts it, and moves it into a portable service directory structure.</div><div><br></div><div> <div style="color:rgb(201,209,217);background-color:rgb(13,17,23);font-family:"Fira Code","Cascadia Code",Consolas,"Courier New",monospace,Consolas,"Courier New",monospace;font-weight:normal;font-size:14px;line-height:19px;white-space:pre"><div><span style="color:rgb(139,148,158)"># download and extract Tailscale</span></div><div><span style="color:rgb(201,209,217)">tarball=</span><span style="color:rgb(165,214,255)">"$(curl -s '<a href="https://pkgs.tailscale.com/stable/?mode=json">https://pkgs.tailscale.com/stable/?mode=json</a>' </span><span style="color:rgb(255,123,114)">|</span><span style="color:rgb(165,214,255)"> jq -r .Tarballs.amd64)"</span></div><div><span style="color:rgb(201,209,217)">version=</span><span style="color:rgb(165,214,255)">"$(echo </span><span style="color:rgb(201,209,217)">${tarball}</span><span style="color:rgb(165,214,255)"> </span><span style="color:rgb(255,123,114)">|</span><span style="color:rgb(165,214,255)"> cut -d_ -f2)"</span></div><div><span style="color:rgb(201,209,217)">tar_dir=</span><span style="color:rgb(165,214,255)">"$(echo </span><span style="color:rgb(201,209,217)">${tarball}</span><span style="color:rgb(165,214,255)"> </span><span style="color:rgb(255,123,114)">|</span><span style="color:rgb(165,214,255)"> cut -d. -f1-3)"</span></div><div><span style="color:rgb(201,209,217)">curl -s </span><span style="color:rgb(165,214,255)">"<a href="https://pkgs.tailscale.com/stable/">https://pkgs.tailscale.com/stable/</a></span><span style="color:rgb(201,209,217)">${tarball}</span><span style="color:rgb(165,214,255)">"</span><span style="color:rgb(201,209,217)"> -o tailscale.tgz</span></div><div><span style="color:rgb(201,209,217)">tar xzf tailscale.tgz</span></div><div><span style="color:rgb(121,192,255)">test</span><span style="color:rgb(201,209,217)"> -d $tar_dir</span></div><br><div><span style="color:rgb(139,148,158)"># Set up our target directory structure</span></div><div><span style="color:rgb(201,209,217)">mkdir -p tailscaled/{usr/{bin,sbin,lib/systemd/system},etc,proc,sys,dev,run,/var/tmp}</span></div><br><div><span style="color:rgb(139,148,158)"># Copy tailscale-distributed files to the right place</span></div><div><span style="color:rgb(201,209,217)">cp -rf $tar_dir/tailscaled tailscaled/usr/sbin/tailscaled</span></div><div><span style="color:rgb(201,209,217)">cp -rf $tar_dir/systemd/tailscaled.service tailscaled/usr/lib/systemd/system/tailscaled.service</span></div><br><div><span style="color:rgb(139,148,158)"># Write service os-release file</span></div><div><span style="color:rgb(121,192,255)">source</span><span style="color:rgb(201,209,217)"> /etc/os-release</span></div><div><span style="color:rgb(201,209,217)">cp -rf /etc/os-release tailscaled/etc/os-release</span></div></div> </div><div><br></div><div>Not automated yet is patching the provided unit file - you need to remove the EnvironmentFile line and "--port $PORT $FLAGS" options, and add <br></div><div> <div style="color:rgb(201,209,217);background-color:rgb(13,17,23);font-family:"Fira Code","Cascadia Code",Consolas,"Courier New",monospace,Consolas,"Courier New",monospace;font-weight:normal;font-size:14px;line-height:19px;white-space:pre"><div><span style="color:rgb(201,209,217)">[Exec]</span></div><div><span style="color:rgb(255,123,114)">Environment</span><span style="color:rgb(201,209,217)">=</span><span style="color:rgb(165,214,255)">"PATH=/usr/bin"</span></div></div> </div><div><br></div><div>Attach the portable service: <span style="font-family:monospace">sudo portablectl attach ./tailscaled --profile=trusted</span></div><div>and try starting it: <span style="font-family:monospace">sudo systemctl start tailscaled</span></div><div><br></div><div>It fails, leaving this in the logs:</div><div><br></div><div> <code class="gmail-lang-nohighlight">logtail started <br></code></div><div><code class="gmail-lang-nohighlight">Program starting: v1.30.2-t24c524c78-gc399ae6fa, Go 1.19.1-tsb13188dd36: []string{"/usr/sbin/tailscaled", "--state=/var/lib/tailscale/tailscaled.state", "--socket=/run/tailscale/tailscaled.sock"} <br></code></div><div><code class="gmail-lang-nohighlight">LogID: 0f59ed267a2b19cc28aac9ee7119914000ca478234af8d56893a025ae72cc647 <br></code></div><div><code class="gmail-lang-nohighlight">logpolicy: using $STATE_DIRECTORY, "/var/lib/tailscale" <br></code></div><div><code class="gmail-lang-nohighlight">wgengine.NewUserspaceEngine(tun "tailscale0") ... <br></code></div><div><code class="gmail-lang-nohighlight">wgengine.NewUserspaceEngine(tun "tailscale0") error: creating router: could not get iptables version: fork/exec /usr/bin/iptables: no such file or directory flushing log. <br></code></div><div><code class="gmail-lang-nohighlight">logger closing down <br></code></div><div><code class="gmail-lang-nohighlight">createEngine: creating router: could not get iptables version: fork/exec /usr/bin/iptables: no such file or directory</code> </div><div><br></div><div>iptables is, in fact, at /usr/bin/iptables, so what am I missing? Before I added the Environment line, I was getting errors that iptables wasn't on the PATH, so I suspect that now tailscaled can <i>see</i> iptables, but systemd isn't letting tailscaled run it.</div><div><br></div><div>Thanks for having a look at this.<br></div><div><div style="margin-left:40px"> </div></div></div>