services:
  derper:
    container_name: derper
    image: fredliang/derper
    restart: always
    network_mode: host  # 直接使用宿主机网络，支持 IPv6
    environment:
      - DERP_DOMAIN=derp.example.com
      - DERP_ADDR=:13477
      - DERP_HTTP_PORT=13478
      - DERP_VERIFY_CLIENTS=true
    volumes:
      - /var/run/tailscale/tailscaled.sock:/var/run/tailscale/tailscaled.sock

docker compose up -d

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name derp.example.com;
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    location ^~ / {
        proxy_pass http://127.0.0.1:13477;
        
        # 核心：强制发送 WebSocket 头
        # 解决 HTTP/2 下头丢失导致 426 错误的问题
        proxy_set_header Upgrade "websocket";
        proxy_set_header Connection "upgrade";
        
        # 必须：协议版本与关闭缓存
        proxy_http_version 1.1;
        proxy_buffering off;
        
        # 基础头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        
        # 超时（保持长连接）
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        
        # 安全头
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    }
}

sudo nginx -t && sudo nginx -s reload

{
  // 自定义 DERP 服务器
  "derpMap": {
    // 只使用自定义 DERP，禁用官方 DERP
    "OmitDefaultRegions": true,
    "Regions": {
      "900": {
        "RegionID": 900,
        "RegionCode": "hk",
        "RegionName": "DMIT Cloud Hong Kong",
        "Nodes": [
          {
            "Name": "hk1",
            "RegionID": 900,
            "HostName": "derp.example.com",
            "DERPPort": 443,
            "STUNPort": 3478
          }
        ]
      }
    }
  },
  "acls": [
    {
      "action": "accept",
      "src": ["*"],
      "dst": ["*:*"]
    }
  ]
}

{
  "Name": "hk1",
  "RegionID": 900,
  "HostName": "derp.example.com",
  "IPv4": "[IP_ADDRESS]",
  "IPv6": "[IP_ADDRESS]",
  "DERPPort": 443,
  "STUNPort": 3478
}

services:
  derper:
    container_name: derper
    image: ghcr.io/yangchuansheng/ip_derper:latest
    restart: always
    network_mode: host  # 直接使用宿主机网络，支持 IPv6
    environment:
      - DERP_HOST=你的服务器IP
      - DERP_ADDR=:13477
      - DERP_HTTP_PORT=13478
      - DERP_CERTS=/app/certs
      - DERP_STUN=true
      - DERP_VERIFY_CLIENTS=true
    volumes:
      - /var/run/tailscale/tailscaled.sock:/var/run/tailscale/tailscaled.sock:ro
      - ./certs:/app/certs

docker compose up -d

{
  // 自定义 DERP 服务器
  "derpMap": {
    // 只使用自定义 DERP，禁用官方 DERP，true 是只使用自己的节点，false 是自己的节点+官方节点
    "OmitDefaultRegions": false,
    "Regions": {
      "900": {
        "RegionID":   900,
        "RegionCode": "chn",
        "RegionName": "China",
        "Nodes": [
          {
            "Name":     "server",
            "RegionID": 900,
            "IPv4":             "[IP_ADDRESS]",
            "IPv6":             "[IP_ADDRESS]",
            "InsecureForTests": true,
            "DERPPort":         13477,
            "STUNPort":         3478
          }
        ]
      }
    }
  }
}

# UFW 示例：方案一（反代部署放行 HTTPS）
sudo ufw allow 443/tcp
sudo ufw allow 3478/udp

# UFW 示例：方案二（纯 IP 部署直接放行）
sudo ufw allow 13477/tcp
sudo ufw allow 3478/udp

tailscale netcheck

Report:
    * UDP: true
    * IPv4: yes, ...
    * IPv6: yes, ...
    * DERP latency:
        - hkg: 25.3ms (Tencent Cloud Hong Kong)

tailscale status