diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..dfe0770
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto
diff --git a/.github/workflows/mirror.yaml b/.github/workflows/mirror.yaml
new file mode 100644
index 0000000..62ee6aa
--- /dev/null
+++ b/.github/workflows/mirror.yaml
@@ -0,0 +1,17 @@
+name: Mirror to Gitlab
+
+on: [push]
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: yesolutions/mirror-action@v0.6.0
+        with:
+          REMOTE: 'https://gitlab.com/${{ github.repository }}'
+          GIT_USERNAME: ${{ secrets.ORG_GITLAB_SYNC_UN }}
+          GIT_PASSWORD: ${{ secrets.ORG_GITLAB_SYNC_PW }}
+
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..f500688
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,81 @@
+default:
+  image:
+    name: gcr.io/kaniko-project/executor:debug
+    entrypoint: [ "" ]
+  tags:
+    - ord1-tenant
+
+workflow:
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: never
+    - if: $CI_COMMIT_BRANCH
+      when: always
+
+variables:
+  RELEASE_VERSION: "1.68.0"
+  REF_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
+  FIXED_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
+  DOCKERFILE: ${CI_PROJECT_DIR}/Docker/Dockerfile
+  REGPROXY_URI: ${REGPROXY_URI}
+  LATEST_IMAGE: $CI_REGISTRY_IMAGE:latest
+
+stages:
+  - build
+  - release
+
+build:
+  stage: build
+  before_script:
+    - export HTTP_PROXY=${REGPROXY_URI}
+    - export HTTPS_PROXY=${REGPROXY_URI}
+    - mkdir -p /etc/ssl/certs/ && cat /etc/gitlab-runner/certs/proxy-ca.crt >> /etc/ssl/certs/ca-certificates.crt
+    - mkdir -p /kaniko/.docker
+    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
+  script: |-
+    /kaniko/executor \
+      --context ${CI_PROJECT_DIR} \
+      --dockerfile $DOCKERFILE \
+      --destination $REF_IMAGE \
+      --destination $FIXED_IMAGE \
+      --build-arg VERSION="v${RELEASE_VERSION}"
+  only:
+    changes:
+      - Docker/*
+
+release:
+  stage: release
+  only:
+    refs:
+      - main
+  dependencies:
+    - build
+  before_script:
+    - export HTTP_PROXY=${REGPROXY_URI}
+    - export HTTPS_PROXY=${REGPROXY_URI}
+    - export RELEASE="$CI_REGISTRY_IMAGE":"v${RELEASE_VERSION}"
+    - mkdir -p /etc/ssl/certs/ && cat /etc/gitlab-runner/certs/proxy-ca.crt >> /etc/ssl/certs/ca-certificates.crt
+    - mkdir -p /kaniko/.docker
+    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
+  script: |-
+    /kaniko/executor \
+    --context ${CI_PROJECT_DIR} \
+    --dockerfile $DOCKERFILE \
+    --destination $RELEASE \
+    --build-arg VERSION="v${RELEASE_VERSION}"
+
+release-chart:
+  stage: release
+  image: alpine/helm:3.15.2
+  only:
+    refs:
+      - main
+  dependencies:
+    - build
+  script:
+    - apk add git
+    - helm plugin install https://github.com/chartmuseum/helm-push.git
+    - cd chart
+    - helm repo add helm_repo $REPO_URL --username $REPO_USER --password $REPO_PASS
+    - helm package ./tailscale-derp --version "$RELEASE_VERSION"
+    - helm cm-push ./tailscale-derp helm_repo --version "$RELEASE_VERSION" -f
diff --git a/Docker/Dockerfile b/Docker/Dockerfile
new file mode 100644
index 0000000..81d4438
--- /dev/null
+++ b/Docker/Dockerfile
@@ -0,0 +1,25 @@
+FROM golang:latest AS builder
+WORKDIR /app
+ARG VERSION=${VERSION:-v1.68.0}
+# https://tailscale.com/kb/1118/custom-derp-servers/
+RUN go install tailscale.com/cmd/derper@${VERSION}
+RUN go install tailscale.com/cmd/derpprobe@${VERSION}
+
+FROM ubuntu:noble
+WORKDIR /app
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+COPY --from=builder /go/bin/derper .
+COPY --from=builder /go/bin/derpprobe .
+COPY Docker/entrypoint.sh /app/entrypoint.sh
+COPY Docker/healthprobe.sh /app/healthprobe.sh
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends apt-utils ca-certificates curl jq && \
+    rm -rf /var/lib/apt/lists/* && \
+    mkdir /app/certs && \
+    chmod +x /app/entrypoint.sh && \
+    chmod +x /app/healthprobe.sh
+
+ENTRYPOINT ["/app/entrypoint.sh"]
diff --git a/Docker/entrypoint.sh b/Docker/entrypoint.sh
new file mode 100644
index 0000000..1147aaa
--- /dev/null
+++ b/Docker/entrypoint.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Initialize the command with the executable
+CMD="/app/derper"
+
+# Generate derpmap
+jq -n --arg hostname "${DERP_HOSTNAME}" '{"Regions":{"900":{"RegionID":900,"Nodes":[{"Name":"900","HostName":$hostname}]}}}' > /app/derpmap.json
+
+# Loop through all environment variables
+for VAR in $(env); do
+  # Check if the variable starts with DERP_
+  if [[ $VAR == DERP_* ]]; then
+    # Extract the name and value
+    VAR_NAME=$(echo "$VAR" | cut -d= -f1)
+    VAR_VALUE=$(echo "$VAR" | cut -d= -f2-)
+
+    # Convert the variable name to lowercase and replace underscores with hyphens
+    ARG_NAME=$(echo "$VAR_NAME" | sed 's/^DERP_//' | tr '[:upper:]' '[:lower:]' | tr '_' '-')
+    
+    # Append the argument to the command
+    CMD="$CMD --$ARG_NAME=$VAR_VALUE"
+  fi
+done
+
+# Execute the command
+exec $CMD
diff --git a/Docker/healthprobe.sh b/Docker/healthprobe.sh
new file mode 100644
index 0000000..72fe5eb
--- /dev/null
+++ b/Docker/healthprobe.sh
@@ -0,0 +1,17 @@
+response=$(curl --head -L -w '%{http_code}' -o /dev/null -s -k https://"${DERP_HOSTNAME}"/derp/probe -m "${CURL_TIMEOUT:-2}")
+if [ $? -ne 0 ]; then
+  echo "Error: curl failed"
+  exit 1
+fi
+
+if [[ "$response" -lt "200" ]] || [[ "$response" -ge "400" ]]; then
+    echo "failed curl for ${PROBE_ADDRESS} with response $response" >&2
+    exit 1
+fi
+
+/app/derpprobe --derp-map file:///app/derpmap.json  --once
+
+if [ $? -ne 0 ]; then
+  echo "Error: derpprobe failed"
+  exit 1
+fi
diff --git a/chart/tailscale-derp/.helmignore b/chart/tailscale-derp/.helmignore
new file mode 100644
index 0000000..0e8a0eb
--- /dev/null
+++ b/chart/tailscale-derp/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/chart/tailscale-derp/Chart.yaml b/chart/tailscale-derp/Chart.yaml
new file mode 100644
index 0000000..25003fd
--- /dev/null
+++ b/chart/tailscale-derp/Chart.yaml
@@ -0,0 +1,24 @@
+apiVersion: v2
+name: tailscale-derp
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "v1.68.0"
diff --git a/chart/tailscale-derp/templates/_helpers.tpl b/chart/tailscale-derp/templates/_helpers.tpl
new file mode 100644
index 0000000..8f20e4e
--- /dev/null
+++ b/chart/tailscale-derp/templates/_helpers.tpl
@@ -0,0 +1,69 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "tailscale-derp.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "tailscale-derp.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "tailscale-derp.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "tailscale-derp.labels" -}}
+helm.sh/chart: {{ include "tailscale-derp.chart" . }}
+{{ include "tailscale-derp.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "tailscale-derp.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "tailscale-derp.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "tailscale-derp.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "tailscale-derp.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the derp hostname
+*/}}
+{{- define "tailscale-derp.hostname" -}}
+{{- tpl .Values.derpServerHostname . }}
+{{- end }}
diff --git a/chart/tailscale-derp/templates/cert.yaml b/chart/tailscale-derp/templates/cert.yaml
new file mode 100644
index 0000000..8e905f8
--- /dev/null
+++ b/chart/tailscale-derp/templates/cert.yaml
@@ -0,0 +1,17 @@
+{{- if (.Values.tls).enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations: {{ .Values.tls.annotations | toYaml | nindent 4 }}
+  labels: {{ .Values.tls.labels | toYaml | nindent 4 }}
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  commonName: '{{ tpl ((.Values.tls).domain) . }}'
+  dnsNames:
+  - '{{ tpl ((.Values.tls).domain) . }}'
+  issuerRef:
+    kind: ClusterIssuer
+    name: {{ (.Values.tls).clusterIssuer | default "letsencrypt-prod" }}
+  secretName: {{ .Release.Name }}-tls
+{{- end }}
diff --git a/chart/tailscale-derp/templates/deployment.yaml b/chart/tailscale-derp/templates/deployment.yaml
new file mode 100644
index 0000000..f19b53e
--- /dev/null
+++ b/chart/tailscale-derp/templates/deployment.yaml
@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "tailscale-derp.fullname" . }}
+  labels:
+    {{- include "tailscale-derp.labels" . | nindent 4 }}
+  annotations:
+    {{- tpl (toYaml .Values.deploymentAnnotations) .  | nindent 4 }}
+spec:
+  strategy:
+    type: Recreate
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "tailscale-derp.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- tpl (toYaml .Values.podAnnotations) .  | nindent 8 }}
+      labels:
+        {{- include "tailscale-derp.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "tailscale-derp.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          env:
+            {{- tpl (toYaml .Values.env) . | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            {{- range .Values.service.ports }}
+            - name: {{ .name }}
+              containerPort: {{ .targetPort }}
+              protocol: {{ .protocol | default "TCP" }}
+            {{- end }}
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            {{- tpl (toYaml .Values.volumeMounts) .  | nindent 12 }}
+      volumes:
+        {{- tpl (toYaml .Values.volumes) .  | nindent 8 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/chart/tailscale-derp/templates/network-policy.yaml b/chart/tailscale-derp/templates/network-policy.yaml
new file mode 100644
index 0000000..fa71380
--- /dev/null
+++ b/chart/tailscale-derp/templates/network-policy.yaml
@@ -0,0 +1,52 @@
+{{- range .Values.calicoNetworkPolicy }}
+---
+apiVersion: crd.projectcalico.org/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .name }}
+  namespace: {{ $.Release.Namespace }}
+  annotations: {{ .annotations | toYaml | nindent 4 }}
+  labels: {{ .labels | toYaml | nindent 4 }}
+spec:
+  {{- if .selector }}
+  selector: {{ .selector }}
+  {{- end }}
+  {{- if .egress }}
+  egress: {{ .egress | toYaml | nindent 4 }}
+  {{- end }}
+  {{- if .ingress }}
+  ingress: {{ .ingress | toYaml | nindent 4 }}
+  {{- end }}
+  order: {{ default 200 .order }}
+  types:
+  {{- if .egress }}
+  - Egress
+  {{- end }}
+  {{- if .ingress }}
+    - Ingress
+  {{- end }}
+{{- end }}
+
+{{- range .Values.kubernetesNetworkPolicy }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .name }}
+  namespace: {{ $.Release.Namespace }}
+  annotations: {{ .annotations | toYaml | nindent 4 }}
+  labels: {{ .labels | toYaml | nindent 4 }}
+spec:
+  {{- if .podSelector }}
+  podSelector: {{ .podSelector }}
+  {{- end }}
+  {{- if .egress }}
+  egress: {{ .egress | toYaml | nindent 4 }}
+  {{- end }}
+  {{- if .ingress }}
+  ingress: {{ .ingress | toYaml | nindent 4 }}
+  {{- end }}
+  {{- if .policyTypes }}
+  policyTypes: {{ .policyTypes | toYaml | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/chart/tailscale-derp/templates/service.yaml b/chart/tailscale-derp/templates/service.yaml
new file mode 100644
index 0000000..5698e84
--- /dev/null
+++ b/chart/tailscale-derp/templates/service.yaml
@@ -0,0 +1,44 @@
+{{- if .Values.service.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "tailscale-derp.fullname" . }}
+  labels:
+    {{- include "tailscale-derp.labels" . | nindent 4 }}
+  annotations: {{- tpl (((.Values).service).annotations | toYaml ) . | nindent 4}}
+spec:
+  internalTrafficPolicy: {{ .Values.service.internalTrafficPolicy }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
+  type: {{ .Values.service.type }}
+  ports:
+    {{- range .Values.service.ports }}
+    - name: {{ .name }}
+      port: {{ .port }}
+      targetPort: {{ .targetPort }}
+      protocol: {{ .protocol | default "TCP" }}
+    {{- end }}
+  selector:
+    {{- include "tailscale-derp.selectorLabels" . | nindent 4 }}
+{{- end }}
+{{- if .Values.service.directAttach.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations: {{- tpl ((((.Values).service).directAttach).annotations | toYaml) . | nindent 4}}
+  labels:
+    {{- include "tailscale-derp.labels" . | nindent 4 }}
+  name: {{ include "tailscale-derp.fullname" . }}-direct
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  internalTrafficPolicy: Cluster
+  ports:
+    - port: 1
+      targetPort: attach
+      protocol: UDP
+      name: attach
+  selector:
+    coreweave.cloud/ignore: ignore
+{{- end }}
diff --git a/chart/tailscale-derp/templates/serviceaccount.yaml b/chart/tailscale-derp/templates/serviceaccount.yaml
new file mode 100644
index 0000000..6d96daa
--- /dev/null
+++ b/chart/tailscale-derp/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "tailscale-derp.serviceAccountName" . }}
+  labels:
+    {{- include "tailscale-derp.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}
diff --git a/chart/tailscale-derp/values.yaml b/chart/tailscale-derp/values.yaml
new file mode 100644
index 0000000..c29009a
--- /dev/null
+++ b/chart/tailscale-derp/values.yaml
@@ -0,0 +1,135 @@
+# Default values for tailscale-derp.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+derpServerHostname: 'derp.foo.bar'
+
+replicaCount: 1
+
+image:
+  repository: registry.gitlab.com/coreweave/tailscale-derp
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: false
+  # Automatically mount a ServiceAccount's API credentials?
+  automount: false
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+podLabels: {}
+
+deploymentAnnotations: {}
+
+env:
+  - name: DERP_HOSTNAME
+    value: '{{ include "tailscale-derp.hostname" . }}'
+  # - name: DERP_CERTMODE
+  #   value: "manual"
+  # - name: DERP_CERTDIR
+  #   value: "/app/certs"
+  # - name: DERP_ADDR
+  #   value: ":443"
+  # - name: DERP_HTTP_PORT
+  #   value: "80"
+  # - name: DERP_STUN_PORT
+  #   value: "80"
+  # - name: DERP_STUN
+  #   value: "true"
+  # - name: DERP_DERP
+  #   value: "true"
+
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  enabled: false
+  internalTrafficPolicy: Cluster
+  externalTrafficPolicy: Local
+  annotations:
+      externaldns.alpha.kubernetes.io/hostname: '{{ include "tailscale-derp.hostname" . }}'
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: https
+      port: 443
+      targetPort: 443
+    - name: stun
+      port: 3478
+      targetPort: 3478
+  directAttach:
+    enabled: false
+    annotations: {}
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 2Gi
+  limits:
+    cpu: 2000m
+    memory: 2Gi
+
+livenessProbe:
+  exec:
+    command:
+      - /bin/bash
+      - -c
+      - /app/healthprobe.sh
+  timeoutSeconds: 60
+  initialDelaySeconds: 300 # Needs to grab cert
+readinessProbe:
+  exec:
+    command:
+      - /bin/bash
+      - -c
+      - /app/healthprobe.sh
+  timeoutSeconds: 60
+  initialDelaySeconds: 300 # Needs to grab cert
+
+tls: {}
+  # enabled: true
+  # domain: '{{ include "tailscale-derp.hostname" . }}'
+
+# Additional volumes on the output Deployment definition.
+volumes: []
+# - name: cert
+#   secret:
+#     secretName: '{{ .Release.Name }}-tls'
+
+# Additional volumeMounts on the output Deployment definition.
+volumeMounts: []
+# - name: cert
+#   mountPath: '/app/certs/{{ include "tailscale-derp.hostname" . }}.crt'
+#   subPath: tls.crt
+# - name: cert
+#   mountPath: '/app/certs/{{ include "tailscale-derp.hostname" . }}.key'
+#   subPath: tls.key
+#   readOnly: true
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}