Update Tailscale 1.90.9 -> 1.102.2

[nathanwasson]

Update Tailscale to address vulnerability as noted in #137

[nathanwasson]

I created this PR hastily to get the ball rolling in case others want to help contribute as well. I'll build the container image tomorrow when I have time and test it to make sure the version update doesn't break functionality.

[nathanwasson]

Alright, had to make some additional commits to make the image build and the linter happy, but here it is for testing: https://github.com/nathanwasson/caddy-tailscale/pkgs/container/caddy-tailscale

[nathanwasson]

I deployed my updated image to my dev environment, and both the container and my applications exposed via caddy-tailscsale all seem to be happy.

Here you can see in the Tailscale admin panel on top the current official caddy-tailscale image running with the outdated version of Tailscale and on the bottom is my updated caddy-tailscale image running with the current version of Tailscale.

[nathanwasson]

I think I've done my part here, but I'm happy to help out however else may be needed. @willnorris would you be able to review this version update to address the known security vulnerability in the version of Tailscale shipped with the current release of caddy-tailscale?

[itsjxck]

@nathanwasson I've been trying this out, and it seemingly worked the first time I ran it, but now I'm getting errors like this for every request:

{"level":"error","ts":1785937465.922693,"logger":"tls.handshake","msg":"external certificate manager","remote_ip":"100.106.36.24","remote_port":"64038","sni":"<site-name>.<ts-domain>.ts.net","cert_manager":"caddytls.Tailscale","cert_manager_idx":0,"error":"Get \"http://local-tailscaled.sock/localapi/v0/cert/<site-name>.<ts-domain>.ts.net?type=pair\": Get \"http://local-tailscaled.sock/localapi/v0/cert/<site-name>.<ts-domain>.ts.net?type=pair\": context deadline exceeded"}

I have 4 sites configured in my caddyfile, all specified like this:

https://<site-name>.<ts-domain>.ts.net {
	bind tailscale/<site-name>
	...
}

I can see that each site is connected as a tailscale machine, they are all online, and they are all reachable with tailscale ping. It looks like traffic is routed to Caddy correctly, but then theres something up with Caddy's ability to pull the certs from Tailscale. Has this version update changed the way the certs should be pulled from Tailscale?

Update: I just tried the other sites that are configured, and they work fine. 3 of 4 work and I have no context on why the 1 doesn't. Will keep digging

Update 2: I changed the name of the site and now everything works, how bizarre