start.sh

#!/bin/bash
## ──────────────────────────────────────────────────────────────────
## start.sh — Stealth Entrypoint
## ──────────────────────────────────────────────────────────────────
## Starts 3 layers:
##   1. Tailscale daemon (userspace, no root)
##   2. Tailscale mesh join (background)
##   3. Uvicorn server on :7860 (foreground)
## ──────────────────────────────────────────────────────────────────

set -e

echo "[BOOT] Starting stealth stack..."

# ── LAYER 3: Tailscale VPN (userspace mode) ──
# --tun=userspace-networking: No TUN device, no root — pure userspace sockets
# --state: Persists auth in /tmp so reconnects survive container restarts
# --socket: Unix socket for CLI communication (non-root writable path)
echo "[TAILSCALE] Starting daemon in userspace mode..."
tailscaled \
    --tun=userspace-networking \
    --state=/tmp/tailscale-state/tailscaled.state \
    --socket=/tmp/tailscale-state/tailscaled.sock \
    --no-logs-no-support \
    &>/tmp/tailscale-state/daemon.log &

TAILSCALED_PID=$!
echo "[TAILSCALE] Daemon PID: ${TAILSCALED_PID}"

# Wait for daemon socket to be ready
sleep 3

# Authenticate and join the mesh network
# TAILSCALE_AUTHKEY must be set as HF Space secret
if [ -n "${TAILSCALE_AUTHKEY}" ]; then
    echo "[TAILSCALE] Joining mesh network..."
    tailscale up \
        --authkey="${TAILSCALE_AUTHKEY}" \
        --hostname=hf-stealth-node \
        --accept-routes \
        --socket=/tmp/tailscale-state/tailscaled.sock \
        &>/tmp/tailscale-state/up.log &
    echo "[TAILSCALE] Mesh join initiated (background)"
else
    echo "[TAILSCALE] No TAILSCALE_AUTHKEY set — VPN layer disabled (API still works via public URL)"
fi

# ── LAYER 1 + 2: FastAPI Server (Decoy + Hidden API) ──
# uvicorn on 0.0.0.0:7860 — the ONLY exposed port
# Process name shows as "python" + "uvicorn" — completely normal for HF
echo "[SERVER] Starting on port 7860..."
exec python3 -m uvicorn app:app --host 0.0.0.0 --port 7860 --log-level info