File size: 2,400 Bytes
493bd60 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | #!/bin/bash
## ──────────────────────────────────────────────────────────────────
## start.sh — Stealth Entrypoint
## ──────────────────────────────────────────────────────────────────
## Starts 3 layers:
## 1. Tailscale daemon (userspace, no root)
## 2. Tailscale mesh join (background)
## 3. Uvicorn server on :7860 (foreground)
## ──────────────────────────────────────────────────────────────────
set -e
echo "[BOOT] Starting stealth stack..."
# ── LAYER 3: Tailscale VPN (userspace mode) ──
# --tun=userspace-networking: No TUN device, no root — pure userspace sockets
# --state: Persists auth in /tmp so reconnects survive container restarts
# --socket: Unix socket for CLI communication (non-root writable path)
echo "[TAILSCALE] Starting daemon in userspace mode..."
tailscaled \
--tun=userspace-networking \
--state=/tmp/tailscale-state/tailscaled.state \
--socket=/tmp/tailscale-state/tailscaled.sock \
--no-logs-no-support \
&>/tmp/tailscale-state/daemon.log &
TAILSCALED_PID=$!
echo "[TAILSCALE] Daemon PID: ${TAILSCALED_PID}"
# Wait for daemon socket to be ready
sleep 3
# Authenticate and join the mesh network
# TAILSCALE_AUTHKEY must be set as HF Space secret
if [ -n "${TAILSCALE_AUTHKEY}" ]; then
echo "[TAILSCALE] Joining mesh network..."
tailscale up \
--authkey="${TAILSCALE_AUTHKEY}" \
--hostname=hf-stealth-node \
--accept-routes \
--socket=/tmp/tailscale-state/tailscaled.sock \
&>/tmp/tailscale-state/up.log &
echo "[TAILSCALE] Mesh join initiated (background)"
else
echo "[TAILSCALE] No TAILSCALE_AUTHKEY set — VPN layer disabled (API still works via public URL)"
fi
# ── LAYER 1 + 2: FastAPI Server (Decoy + Hidden API) ──
# uvicorn on 0.0.0.0:7860 — the ONLY exposed port
# Process name shows as "python" + "uvicorn" — completely normal for HF
echo "[SERVER] Starting on port 7860..."
exec python3 -m uvicorn app:app --host 0.0.0.0 --port 7860 --log-level info
|