tf/tailscale: Encode the Tailscale version in Terraform

terraform/global/main.tf

@@ -7,6 +7,17 @@ resource "tfe_variable_set" "global" {
   organization = "polar-sh"
 }
 
+resource "tfe_variable" "tailscale_version" {
+  key             = "tailscale_version"
+  category        = "terraform"
+  description     = "Tailscale release installed on EC2 routers."
+  variable_set_id = tfe_variable_set.global.id
+
+  lifecycle {
+    ignore_changes = [value]
+  }
+}
+
 resource "tfe_variable" "planetscale_organization" {
   key             = "planetscale_organization"
   category        = "terraform"

terraform/modules/ec2_tailscale/main.tf

@@ -100,6 +100,7 @@ resource "aws_instance" "this" {
       tostring(var.tailscale_ssh),
       join(",", var.advertise_routes),
       join(",", var.advertise_tags),
+      var.tailscale_version,
     ]]
   })}"
 

terraform/modules/ec2_tailscale/tailscale-init.sh

@@ -7,6 +7,7 @@ hostname="$3"
 tailscale_ssh="$4"
 advertise_routes="$5"
 advertise_tags="$6"
+tailscale_version="$7"
 
 if [[ -n "$advertise_routes" ]]; then
   sysctl -p /etc/sysctl.d/99-tailscale.conf
@@ -24,7 +25,7 @@ update-ca-trust
 curl --fail --silent --show-error --location --retry 5 \
   https://pkgs.tailscale.com/stable/amazon-linux/2023/tailscale.repo \
   --output /etc/yum.repos.d/tailscale.repo
-dnf install -y tailscale
+dnf install -y "tailscale-${tailscale_version}"
 systemctl enable --now tailscaled
 
 umask 077

terraform/modules/ec2_tailscale/variables.tf

@@ -18,6 +18,16 @@ variable "tailscale_oauth_secret_arn" {
   type        = string
 }
 
+variable "tailscale_version" {
+  description = "Tailscale release to install."
+  type        = string
+
+  validation {
+    condition     = can(regex("^[0-9]+\\.[0-9]+\\.[0-9]+$", var.tailscale_version))
+    error_message = "tailscale_version must be a release version such as 1.104.4."
+  }
+}
+
 variable "tailscale_oauth_secret_kms_key_arn" {
   description = "Customer-managed KMS key encrypting the OAuth client secret, if used."
   type        = string

terraform/production/tailscale.tf

@@ -1,3 +1,8 @@
+variable "tailscale_version" {
+  description = "Shared Tailscale release from the Global Settings variable set."
+  type        = string
+}
+
 resource "aws_secretsmanager_secret" "ec2_tailscale" {
   name = "polar-production-ec2-tailscale"
 
@@ -20,6 +25,7 @@ module "ec2_tailscale" {
   advertise_routes           = module.vpc.private_subnet_cidr_blocks
   advertise_tags             = ["tag:router", "tag:production"]
   tailscale_oauth_secret_arn = aws_secretsmanager_secret.ec2_tailscale.arn
+  tailscale_version          = var.tailscale_version
   permissions_boundary_arn   = data.aws_iam_policy.permission_boundary.arn
 
   tags = {

terraform/sandbox/tailscale.tf

@@ -1,3 +1,8 @@
+variable "tailscale_version" {
+  description = "Shared Tailscale release from the Global Settings variable set."
+  type        = string
+}
+
 resource "aws_secretsmanager_secret" "ec2_tailscale" {
   name = "polar-sandbox-ec2-tailscale"
 
@@ -20,6 +25,7 @@ module "ec2_tailscale" {
   advertise_routes           = module.vpc.secondary_private_subnet_cidr_blocks
   advertise_tags             = ["tag:router", "tag:sandbox"]
   tailscale_oauth_secret_arn = aws_secretsmanager_secret.ec2_tailscale.arn
+  tailscale_version          = var.tailscale_version
   permissions_boundary_arn   = data.aws_iam_policy.permission_boundary.arn
 
   tags = {

terraform/test/tailscale.tf

@@ -1,3 +1,8 @@
+variable "tailscale_version" {
+  description = "Shared Tailscale release from the Global Settings variable set."
+  type        = string
+}
+
 resource "aws_secretsmanager_secret" "ec2_tailscale" {
   count = local.test_enabled ? 1 : 0
 
@@ -27,6 +32,7 @@ module "ec2_tailscale" {
   advertise_routes           = module.vpc[0].secondary_private_subnet_cidr_blocks
   advertise_tags             = ["tag:router", "tag:test"]
   tailscale_oauth_secret_arn = aws_secretsmanager_secret.ec2_tailscale[0].arn
+  tailscale_version          = var.tailscale_version
   permissions_boundary_arn   = data.aws_iam_policy.permission_boundary.arn
 
   tags = {