{"id":20004906,"url":"https://github.com/hawxy/cdk-tailscale-bastion","last_synced_at":"2025-04-09T23:17:04.965Z","repository":{"id":41746025,"uuid":"509968934","full_name":"Hawxy/cdk-tailscale-bastion","owner":"Hawxy","description":"Deploys a AWS EC2 (Bastion Host) preconfigured for Tailscale access.","archived":false,"fork":false,"pushed_at":"2025-04-01T00:43:44.000Z","size":428,"stargazers_count":30,"open_issues_count":1,"forks_count":6,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-09T23:16:42.490Z","etag":null,"topics":["aws","bastion","cdk","ec2","tailscale"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Hawxy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-07-03T08:47:45.000Z","updated_at":"2025-03-19T13:33:08.000Z","dependencies_parsed_at":"2023-12-01T02:39:03.694Z","dependency_job_id":"54efb403-b769-4a1d-a1ab-aff20dc080b8","html_url":"https://github.com/Hawxy/cdk-tailscale-bastion","commit_stats":{"total_commits":24,"total_committers":3,"mean_commits":8.0,"dds":"0.16666666666666663","last_synced_commit":"f77475b214aa0c711bd7a940ad43e255c4d1f6ab"},"previous_names":[],"tags_count":23,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Hawxy%2Fcdk-tailscale-bastion","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Hawxy%2Fcdk-tailscale-bastion/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Hawxy%2Fcdk-tailscale-bastion/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Hawxy%2Fcdk-tailscale-bastion/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Hawxy","download_url":"https://codeload.github.com/Hawxy/cdk-tailscale-bastion/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248125593,"owners_count":21051771,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","bastion","cdk","ec2","tailscale"],"created_at":"2024-11-13T05:37:04.228Z","updated_at":"2025-04-09T23:17:04.945Z","avatar_url":"https://github.com/Hawxy.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cdk-tailscale-bastion\n\n![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/Hawxy/cdk-tailscale-bastion/build.yml?label=Build%20%26%20Release\u0026style=flat-square)\n[![npm](https://img.shields.io/npm/v/cdk-tailscale-bastion?style=flat-square)](https://www.npmjs.com/package/cdk-tailscale-bastion)\n[![Nuget](https://img.shields.io/nuget/v/CDK.Tailscale.Bastion?style=flat-square)](https://www.nuget.org/packages/CDK.Tailscale.Bastion/)\n\nThis packages creates an AWS EC2 (Bastion) configured for Tailscale. This covers the [Tailscale AWS VPC guide](https://tailscale.com/kb/1021/install-aws/) as well as most of the [Tailscale RDS guide](https://tailscale.com/kb/1141/aws-rds/).\n\nUsing Tailscale to access your VPC permits high performance connectivity whilst avoiding SSH or the overhead \u0026 limitations of Session Manager.\n\n## Installation\n\nJS/TS: `npm i cdk-tailscale-bastion -D`\n\nC#: `dotnet add package CDK.Tailscale.Bastion`\n\n## Instructions\n\nThe Tailscale Auth key should be passed in via secrets manager and NOT hardcoded in your application. \n\n```typescript\nimport { TailscaleBastion } from 'cdk-tailscale-bastion';\n\n// Secrets Manager\nconst secret = Secret.fromSecretNameV2(stack, 'ApiSecrets', 'tailscale');\n\nconst bastion = new TailscaleBastion(stack, 'Sample-Bastion', {\n  vpc,\n  tailscaleCredentials: {\n    secretsManager: {\n      secret: secret,\n      key: 'AUTH_KEY',\n    },\n  },\n});\n\n```\n\nWhatever resource you intend to reach should permit connections from the bastion on the relevant port, naturally. \n\n## Tailscale Auth Key\n\nI recommend generating an Ephemeral key that includes the bastion as a tag for ease of teardown and tracking:\n\n\u003cimg src=\"https://user-images.githubusercontent.com/975824/177150876-ab21b4ac-00f7-4a75-befa-cf7d2e9ca7f7.png\" height=\"200px\" /\u003e\n\n## Tailscale Configuration\n\nOnce deployed, unless you have [auto approval](https://tailscale.com/kb/1018/acls/#auto-approvers-for-routes-and-exit-nodes) enabled, you'll need to manually [enable the subnet routes](https://tailscale.com/kb/1019/subnets/#step-3-enable-subnet-routes-from-the-admin-console) in the tailscale console.\n\nYou'll also need to setup the nameserver. The bastion construct conveniently outputs the settings you require for Tailscale's DNS configuration:\n\n\u003cimg src=\"https://user-images.githubusercontent.com/975824/177154488-3f3c1d02-35c6-432b-96fc-9dca691ea94c.png\" height=\"250px\" /\u003e\n\nGiven your configuration is correct, a direct connection to your internal resources should now be possible.\n\n\n## 4via6 Support\n\nIf you wish to use [4via6 subnet routers](https://tailscale.com/kb/1201/4via6-subnets/), you can pass the IPv6 address via the `advertiseRoute` property:\n\n```ts\nnew TailscaleBastion(stack, 'Cdk-Sample-Lib', {\n  vpc,\n  tailscaleCredentials: ...,\n  advertiseRoute: 'fd7a:115c:a1e0:b1a:0:7:a01:100/120',\n});\n```\n\n## Incoming routes\n\nIf you have other subnet routers configured in Tailscale, you can use the `incomingRoutes` property to configure VPC route table entries for all private subnets.\n\n```ts\nnew TailscaleBastion(stack, 'Sample-Bastion', {\n  vpc,\n  tailscaleCredentials: ...,\n  incomingRoutes: [\n    '192.168.1.0/24',\n  ],\n});\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhawxy%2Fcdk-tailscale-bastion","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhawxy%2Fcdk-tailscale-bastion","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhawxy%2Fcdk-tailscale-bastion/lists"}