This installs the official docker.io/cloudflare/mesh:latest image as a
rootful Podman Quadlet. The container needs the privileges and host device
required by Cloudflare Mesh: NET_ADMIN, NET_RAW, /dev/net/tun, and IP
forwarding sysctls.
Bridge mode is the default:
| #!/bin/bash | |
| if ! sudo -v; then | |
| echo "This script requires the user to have sudo permissions."; exit 1 | |
| fi | |
| if [ $UID = 0 ]; then | |
| echo "Please don't run this script as root, it needs to know what your normal user account is!"; exit 1 | |
| fi | |
| #!/bin/bash | |
| exit 666 | |
| exec {LOGFD}>"log.$RANDOM" {STDOUT}>&1 {STDERR}>&2 | |
| exec 1> >(tee -a /dev/fd/$LOGFD 1>&$STDOUT 2>&$STDERR) | |
| exec 2> >(tee -a /dev/fd/$LOGFD 1>&$STDERR 2>&$STDERR) | |
| # bash will not interpolate this properly without eval and will 'exec: 10: not found' | |
| # (why does everyone put up with GNU/Shit on a daily basis) |
| #!/bin/bash | |
| # how to not get a short-lived SSH certificate out of CFZT because you can't do that with a service token | |
| set -x | |
| CFZT_ORGANIZATION=example | |
| ENDPOINT=https://some-bastion-service-public-hostname.example/ | |
| JWT="$(curl -sS -D - -o /dev/null \ | |
| -H "CF-Access-Client-Id: $TUNNEL_SERVICE_TOKEN_ID" \ | |
| -H "CF-Access-Client-Secret: $TUNNEL_SERVICE_TOKEN_SECRET" \ |