自建 DERP 中继：让 Headscale 打洞失败也能稳连国内 20ms

# 下载（按需换最新版本号）
wget https://golang.google.cn/dl/go1.23.2.linux-amd64.tar.gz
# 安装
rm -rf /usr/local/go && tar -C /usr/local -xzf go1.23.2.linux-amd64.tar.gz
# 配环境变量（建议同时写进 /etc/profile 持久化）
export PATH=$PATH:/usr/local/go/bin
echo 'export PATH=$PATH:/usr/local/go/bin' >> /etc/profile && source /etc/profile
# 开启 module + 国内代理（不然 go install 慢到怀疑人生）
go env -w GO111MODULE=on
go env -w GOPROXY=https://goproxy.cn,direct
# 验证
go version

go install tailscale.com/cmd/derper@latest

# 进目录（版本号换成你 ls 看到的真实值）
cd ~/go/pkg/mod/[email protected]/cmd/derper/
sudo chmod 777 ./cert.go
sudo vim cert.go

func (m *manualCertManager) getCertificate(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
	// ↓↓↓ 注释掉这三行，放行自签证书 ↓↓↓
	// if hi.ServerName != m.hostname {
	// 	return nil, fmt.Errorf("cert mismatch with hostname: %q", hi.ServerName)
	// }

	certCopy := new(tls.Certificate)
	*certCopy = *m.cert
	certCopy.Certificate = certCopy.Certificate[:len(certCopy.Certificate):len(certCopy.Certificate)]
	return certCopy, nil
}

# 编译到固定目录
go build -o /etc/derp/derper

# 自签 SSL 证书（derp.e7coding.com 换成你自己的域名/标识）
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout /etc/derp/derp.e7coding.com.key \
  -out /etc/derp/derp.e7coding.com.crt \
  -subj "/CN=derp.e7coding.com" \
  -addext "subjectAltName=DNS:derp.e7coding.com"

sudo vim /etc/systemd/system/derp.service

[Unit]
Description=HW Derper
After=network.target
Wants=network.target

[Service]
User=root
Restart=always
ExecStart=/etc/derp/derper -hostname derp.e7coding.com -a :33445 -http-port 33446 -certmode manual -certdir /etc/derp
RestartPreventExitStatus=1

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl start derp
sudo systemctl status derp

vim /etc/headscale/derp.yaml

regions:
  900:
    regionid: 900
    regioncode: custom
    regionname: custom shanghai
    nodes:
      - name: 900a
        regionid: 900
        hostname: <DERP 服务器公网 IP>
        ipv4: <DERP 服务器公网 IP>
        ipv6: <DERP 服务器 IPv6，没有可删掉这行>
        derpport: 33445
        insecurefortests: true

systemctl restart headscale
systemctl status headscale

/Applications/Tailscale.app/Contents/MacOS/Tailscale netcheck

Report:
	* UDP: true
	* Nearest DERP: HW shanghai
	* DERP latency:
		-  hw: 23.8ms  (custom shanghai)   ← 自建，20ms 级
		-  hb: 43.3ms  (Huawei Beijing)
		-  hk: 46.7ms  (Hang kong)

# 安装
curl -fsSL https://tailscale.com/install.sh | sh
# 登录到自建 Headscale
tailscale up --login-server=<你的 Headscale 地址>
# 终端会输出一个 register 链接，复制到浏览器（或在 headscale-ui 里）把这台节点加入组网

ExecStart=/etc/derp/derper -hostname derp.e7coding.com -a :33445 -http-port 33446 -certmode manual -certdir /etc/derp --verify-clients

sudo systemctl daemon-reload
sudo systemctl restart derp
sudo systemctl status derp