# global
$ curl https://get.acme.sh | sh -s email=ca@frytea.com
# install acme.sh in china
git clone https://ghproxy.mirror.skybyte.me/https://github.com/acmesh-official/acme.sh.git
cd ./acme.sh
./acme.sh --install -m ca@frytea.com

# derper.xxx.xxx.com 是你的域名，需要解析到你的服务器
$ CF_Token="xxxxxx" CF_Zone_ID="xxxxxx" acme.sh --dns dns_cf --issue -d derper.xxx.xxx.com 
...
[Tue Apr 22 04:54:20 AM PDT 2025] The domain key is here: /root/.acme.sh/derper.xxx.xxx.com_ecc/derper.xxx.xxx.com.key
...
$ mkdir -p /opt/derper/certs
$ acme.sh --install-cert -d derper.xxx.xxx.com --ecc --key-file /opt/derper/certs/derper.xxx.xxx.com.key --fullchain-file /opt/derper/certs/derper.xxx.xxx.com.crt

# derper.xxx.xxx.com 是你的域名，需要解析到你的服务器
$ DP_Id="xxxxxx" DP_Key=xxxxxx acme.sh --dns dns_dp --issue -d derper.xxx.xxx.com
$ mkdir -p /opt/derper/certs
$ acme.sh --install-cert -d derper.xxx.xxx.com --ecc --key-file /opt/derper/certs/derper.xxx.xxx.com.key --fullchain-file /opt/derper/certs/derper.xxx.xxx.com.crt

$ GOVERSION=1.23.4 GOARCH=amd64 rm -rf go${GOVERSION}.linux-${GOARCH}.tar.gz && wget https://mirrors.nju.edu.cn/golang/go${GOVERSION}.linux-${GOARCH}.tar.gz -O go${GOVERSION}.linux-${GOARCH}.tar.gz
$ rm -rf /usr/local/go && tar -C /usr/local -xzf go${GOVERSION}.linux-${GOARCH}.tar.gz
$ export PATH=$PATH:/usr/local/go/bin
$ go version

go install tailscale.com/cmd/derper@main
cp /root/go/bin/derper /usr/local/bin/

#!/bin/sh
cd /usr/local/bin/
nohup ./derper -hostname derper.xxx.xxx.com -c=derper.conf -a :1214  -http-port -1 -certdir /opt/derper/certs -certmode manual -stun-port 1214 -verify-clients -stun > console.log 2>&1 &
echo $! > app.pid

#!/bin/sh
kill `cat app.pid`
rm -rf app.pid

[Unit]
Description=Derper service
After=network.target
 
[Service]
Type=forking
ExecStart=/opt/derper/runderper
ExecStop=/opt/derper/stopderper
 
[Install]
WantedBy=multi-user.target

# 开机自启并立即启动
systemctl enable --now derper.service

{
    "acls": [
    // ...
    ],
    "ssh": [
        // ...
    ],
    // ...
    "derpMap": {
        "OmitDefaultRegions": true, // true 表示不使用官方节点，仅使用自建，默认为 false，按需配置
        "Regions": {
            "900": {
                "RegionID":   900, // 900以上
                "RegionCode": "cn-gz", // 区域代码，会在 `tailscale netcheck` 显示
                "RegionName": "中国-广州", // 区域名称，会在 `tailscale netcheck` 显示
                "Nodes": [
                    {
                        "Name":     "1",
                        "RegionID": 900, // 对应上方ID
                        "HostName": "xxxxx.xxx", // 填写你的DERP服务域名
                        "DERPPort": 12345, // 你的 DERP 服务端口
                        "STUNPort": 1214, // 你的 STUN UDP 服务端口
                    },
                ],
            },
            // 更多DERP节点
        },
    },
    // ...
}

# 检查 DERP 连接情况
$ tailscale netcheck
Report:
        * Time: 2025-04-22T13:25:12.257986394Z
        * UDP: true
        * IPv4: yes, xx.xx.xx.xx:59494
        * IPv6: no, but OS has support
        * MappingVariesByDestIP: false
        * PortMapping: 
        * CaptivePortal: false
        * Nearest DERP: xx xx
        * DERP latency:
                - xx: 9.2ms   (xx xx)
                - xx: 26.9ms  (xx xx)
                - xx: 152.7ms (xx xx)
# 检查 Peer 连接情况
$ tailscale status
100.xx.xx.xx xx-node1          YOURNAME@ linux   -
100.xx.xx.xx xx-node2             YOURNAME@ linux   active; relay "xx", tx 43624652 rx 4118764