From bee2a5a0fc951893d90dac8f536aca7b0e2f7748 Mon Sep 17 00:00:00 2001
From: arch3rPro <wh1tecat@protonmail.com>
Date: Wed, 1 Apr 2026 21:15:30 +0800
Subject: [PATCH] =?UTF-8?q?docs(tailscale-derp):=20=E5=AE=8C=E5=96=84?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95=E6=8C=87=E5=8D=97=E5=B9=B6=E6=9B=B4=E6=96=B0?=
 =?UTF-8?q?docker-compose=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. 在README中细化tailscale容器登录步骤，增加状态验证说明
2. 更新docker-compose.yml，添加TS_USERSPACE环境变量和userspace-networking命令
3. 为DERP_VERIFY_CLIENTS设置默认值true
---
 apps/tailscale-derp/README.md                 | 16 ++++++++++++----
 apps/tailscale-derp/README_en.md              | 16 ++++++++++++----
 apps/tailscale-derp/latest/docker-compose.yml |  4 +++-
 3 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/apps/tailscale-derp/README.md b/apps/tailscale-derp/README.md
index 936c319..129b396 100644
--- a/apps/tailscale-derp/README.md
+++ b/apps/tailscale-derp/README.md
@@ -18,20 +18,28 @@ Tailscale DERP 中继服务器，使用完整配置方式，包含tailscale和de
 
 ### 登录指南
 
-部署完成后，需要获取tailscale登录链接：
+部署完成后，tailscale容器需要登录认证才能正常工作：
 
+1. **查看tailscale容器日志获取登录链接**：
 ```bash
-# 查看tailscale容器日志获取登录链接
+# 查看tailscale容器日志
 docker logs -f <容器名称>-tailscale
 ```
 
-在日志中找到类似以下内容的登录链接：
+2. **在日志中找到登录链接**：
 ```
+Switching ipn state NoState -> NeedsLogin (WantRunning=false, nm=false)
 To authenticate, visit:
         https://login.tailscale.com/a/xxxxxxx
 ```
 
-复制链接到浏览器打开并登录Tailscale账户。
+3. **复制链接到浏览器打开并登录Tailscale账户**
+
+4. **验证登录状态**：
+登录成功后，再次查看日志应该显示类似以下内容：
+```
+Switching ipn state NeedsLogin -> Running (WantRunning=true, nm=false)
+```
 
 ### 防火墙配置
 
diff --git a/apps/tailscale-derp/README_en.md b/apps/tailscale-derp/README_en.md
index ac46be8..5822db0 100644
--- a/apps/tailscale-derp/README_en.md
+++ b/apps/tailscale-derp/README_en.md
@@ -18,20 +18,28 @@ Tailscale DERP relay server with complete configuration, including coexistence o
 
 ### Login Guide
 
-After deployment, you need to get the tailscale login link:
+After deployment, the tailscale container needs login authentication to work properly:
 
+1. **Check tailscale container logs for login link**:
 ```bash
-# Check tailscale container logs for login link
+# Check tailscale container logs
 docker logs -f <container-name>-tailscale
 ```
 
-Find the login link in the logs similar to:
+2. **Find the login link in the logs**:
 ```
+Switching ipn state NoState -> NeedsLogin (WantRunning=false, nm=false)
 To authenticate, visit:
         https://login.tailscale.com/a/xxxxxxx
 ```
 
-Copy the link to browser and login to your Tailscale account.
+3. **Copy the link to browser and login to your Tailscale account**
+
+4. **Verify login status**:
+After successful login, check the logs again should show:
+```
+Switching ipn state NeedsLogin -> Running (WantRunning=true, nm=false)
+```
 
 ### Firewall Configuration
 
diff --git a/apps/tailscale-derp/latest/docker-compose.yml b/apps/tailscale-derp/latest/docker-compose.yml
index ad6651b..86c9113 100644
--- a/apps/tailscale-derp/latest/docker-compose.yml
+++ b/apps/tailscale-derp/latest/docker-compose.yml
@@ -5,11 +5,13 @@ services:
       - TS_HOSTNAME=tailscale-docker
       - TS_AUTH_ONCE=true
       - TS_STATE_DIR=/data
+      - TS_USERSPACE=true
     volumes:
       - tailscale:/var/run/tailscale
       - tailscale_data:/data
     networks:
       - 1panel-network
+    command: tailscaled --tun=userspace-networking --socks5-server=localhost:1055
   
   derper:
     image: ghcr.io/yangchuansheng/ip_derper:latest
@@ -23,7 +25,7 @@ services:
     volumes:
       - tailscale:/var/run/tailscale
     environment:
-      - DERP_VERIFY_CLIENTS=${DERP_VERIFY_CLIENTS}
+      - DERP_VERIFY_CLIENTS=${DERP_VERIFY_CLIENTS:-true}
     depends_on:
       - tailscale
     labels: