glinet-tailscale-feed

Full install + device→arch guide: INSTALL.md

Self-hosted opkg feed that restores Tailscale + the GL.iNet admin-UI Tailscale panel on GL.iNet GL-E750 / GL-E750V2 (Mudi / Mudi V2) and other ath79 / mips_24kc (QCA95xx) routers, after GL.iNet stopped shipping it.

Built for seven GL architectures (see the table below); GL-E750/E750V2 = QCA9533 / ath79 / mips_24kc.

Beyond GL's stock panel, this feed's panel adds: LAN-gateway and advertise-exit-node toggles, an exit-node kill switch, keep-through-firmware-upgrade, in-panel package updates, a binary-source picker, auth key login (paste a pre-generated key instead of using the browser bind link) and custom login server support for self-hosted control planes such as Headscale.

Packages

Package	Version	Download	Purpose
tailscale	current stable	~8.2MB	Current tailscaled+CLI, one binary. Full features (incl. netstack).
tailscale-micro	current stable, -micro	~5.6MB	Size-minimized: drops netstack/gVisor only. Keeps DNS, subnet-router and exit-node (kernel-TUN routing). Built for all 7 arches. Conflicts with tailscale.

Versions track upstream Tailscale stable and are rebuilt automatically (see Automatic updates); the sizes above are approximate. | gl-sdk4-tailscale | git-2025.115 | ~7KB | GL backend: init, rpcd handler, firewall/hotplug, gl_tailscale. | | gl-sdk4-ui-tailscaleview | git-2025.244 | ~18KB | The admin-UI Tailscale panel (menu + web view + i18n). | | gl-sdk4-tailscale-mullvad | 0.1.6 | ~13KB | Mullvad exit-node picker inside the panel: country (flag) → city selects, active-node indicator, live switching. Verified end-to-end on a GL-XE3000. Needs the Tailscale Mullvad add-on and a device slot for the router (see the source repo README for the ACL/tag gotchas). Source + docs: glinet-tailscale-mullvad. |

The two gl-sdk4-* packages were extracted from GL's own XE3000 firmware image (they are architecture-independent shell/Lua/JS — no compiled code) and repackaged for mips_24kc. The tailscale binary is cross-compiled from upstream source (GOARCH=mips GOMIPS=softfloat, ts_include_cli, -s -w), the same approach as GL's small-tailscale branch.

Architectures

GL.iNet dropped Tailscale across several device families. This feed rebuilds it for all of them. Find your device's arch with opkg print-architecture, then use the matching feed path:

Feed path (arch)	GL devices (examples)
mips_24kc	ath79 / QCA95xx — GL-E750, E750V2, AR750, MT300N
mipsel_24kc	ramips mt7621/mt7628 — MT1300 Beryl, MT300N-V2, SFT1200
arm_cortex-a7 / arm_cortex-a7_neon-vfpv4	ipq40xx — AR750S Slate, B1300, A1300
arm_cortex-a15_neon-vfpv4	ipq806x — B2200
arm_cortex-a9_vfpv3-d16	mvebu (armada-38x)
aarch64_cortex-a53	mt7981 / ipq807x / ipq60xx — Flint, Spitz AX, XE3000

Every arch feed ships the same GL GUI panel (gl-sdk4-*, Architecture: all) plus both a full tailscale and a size-minimized tailscale-micro — -micro is now built for all seven arches, not just mips_24kc. See Low-resource devices for which to install.

Install (any device)

Easiest — the script auto-detects arch, checks free space, and picks full vs -micro:

# inspect only, changes nothing:
curl -fsSL https://digitalcybersoft.github.io/glinet-tailscale-feed/setup.sh | sh -s -- --dry-run
# install:
curl -fsSL https://digitalcybersoft.github.io/glinet-tailscale-feed/setup.sh | sh

Piping is safe: the script never reads from a non-tty, so it won't hang or eat stdin. Download it first only if you want the interactive "flash is tight, use -micro?" prompt during a real install (piped, that question auto-answers "keep full"):

curl -fsSL https://digitalcybersoft.github.io/glinet-tailscale-feed/setup.sh -o /tmp/setup.sh
sh /tmp/setup.sh --dry-run     # or --full / --micro to force a tier
sh /tmp/setup.sh

Manual equivalent:

ARCH=$(opkg print-architecture | awk '$1=="arch" && $2!="all" && $2!="noarch"{print $3, $2}' | sort -rn | awk 'NR==1{print $2}')
echo "src/gz glits https://digitalcybersoft.github.io/glinet-tailscale-feed/$ARCH" >> /etc/opkg/customfeeds.conf
opkg update  --force-signature
opkg install --force-signature tailscale gl-sdk4-tailscale gl-sdk4-ui-tailscaleview

Panel appears under Applications -> Tailscale in the GL admin UI (postinst reloads rpcd/nginx; refresh or reboot if needed). If opkg rejects the arch, add --force-architecture.

The --force-signature flag is required (unsigned feed)

GL firmware ships opkg with check_signature enabled. This feed is unsigned, so:

• opkg update without --force-signature downloads then deletes this feed's package list (it has no Packages.sig). Always update with opkg update --force-signature.
• The installer drops a helper: run glits-update instead of plain opkg update to refresh and keep this feed, then opkg install --force-signature tailscale to pull a newer build.
• Already-installed packages keep working after a plain opkg update; only the update list is pruned.
• --nocheck-signature does not exist in OpenWrt/GL opkg — use --force-signature.

Low-resource devices: use tailscale-micro

setup.sh picks the tier for you: it installs -micro whenever RAM is ≤256 MB or the writable overlay is too tight for the full build. RAM is the binding constraint, not flash: full tailscale links netstack (gVisor userspace TCP/IP) and its RSS can OOM a 128 MB router, whereas a router routes subnets and exit-node traffic through the kernel TUN, so -micro gives up nothing it needs. -micro now exists for all seven arches, so this path works on every supported device. Force it with sh setup.sh --micro.

GL models in this class (128 MB RAM or less, small internal flash — setup.sh measures your actual device, so treat this as a recognition aid, not a lookup table):

Arch	Low-resource GL models
mips_24kc (ath79)	GL-E750 / E750V2 (Mudi), GL-AR750 (Creta), GL-AR750S (Slate), GL-AR300M / AR300M16 (Shadow), GL-AR300M-Lite, GL-X750 (Spitz), GL-USB150 (Microuter)
mipsel_24kc (ramips)	GL-MT300N-V2 (Mango, 16 MB flash / 128 MB RAM), GL-MT300A, GL-SFT1200 (Opal), GL-MT1300 (Beryl, 256 MB RAM)
arm_cortex-a7 (ipq40xx)	GL-B1300 (Convexa-B), GL-A1300 (Slate Plus) — 256 MB RAM, so setup.sh defaults these to -micro too

If even -micro will not fit the internal flash, setup.sh detects attached USB/SD and points you at extroot (per-package relocation does not work — tailscaled lives at a fixed absolute path). You can also install to a mounted sd dest manually: opkg install -d sd ... with an sd entry in /etc/opkg.conf.

Verified / not verified

• Verified: binaries are ELF32 big-endian MIPS32 soft-float, run under qemu (tailscale version, up --help); GUI packages contain no ELF; e750 firmware 4.8.5 has the oui-httpd/menu.d/libuci-lua/ coreutils-timeout framework the panel needs; served files match their index SHA256.
• NOT verified on real hardware for every arch. The GUI view JS is GL 4.8.3-built; the e750 should be on 4.8.x. tailscale-micro omits netstack (userspace TCP/IP) only; it keeps DNS and does subnet / exit-node routing through the kernel TUN. On low-RAM boxes -micro is the safer build, not a fallback.

Automatic updates

The feed rebuilds itself. A GitHub Actions workflow (.github/workflows/build-feed.yml) checks the upstream tailscale/tailscale tags on a schedule, takes the newest stable release (even minor version), and if that version has no build yet it cross-compiles every arch (full + -micro), publishes the ipks as a GitHub Release, and redeploys the Pages feed (keeping the newest 7 versions). No manual step is involved; workflow_dispatch allows a manual run or a forced rebuild.

On the device, run glits-update (not plain opkg update, which drops this unsigned feed) then opkg install --force-signature tailscale (or tailscale-micro) to pull the newest build.

Known deviation

Stock Tailscale firewall mark (0x80000)/route table. GL's e750v2 build remaps these; not applied here.