diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
new file mode 100644
index 0000000..ea9c92e
--- /dev/null
+++ b/.github/workflows/build-image.yml
@@ -0,0 +1,11 @@
+name: Build Image
+
+on:
+  release:
+    types: [published]
+  push:
+
+jobs:
+  build-and-deploy:
+    name: Build and deploy
+    uses: chukysoria/workflows/.github/workflows/build-image-simple.yml@624bd5750a5e2f4ffc50b89977fd840b66c4f1c1 # v1.1.38
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
deleted file mode 100644
index 142d9e2..0000000
--- a/.github/workflows/docker-publish.yml
+++ /dev/null
@@ -1,97 +0,0 @@
-name: Docker image builds
-
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-on:
-  push:
-    branches: [ "main" ]
-    # Publish semver tags as releases.
-    tags: [ 'v*.*.*' ]
-  pull_request:
-    branches: [ "main" ]
-
-env:
-  # Use docker.io for Docker Hub if empty
-  REGISTRY: ghcr.io
-  # github.repository as <account>/<repo>
-  IMAGE_NAME: ${{ github.repository }}
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      # This is used to complete the identity challenge
-      # with sigstore/fulcio when running outside of PRs.
-      id-token: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-      # Install the cosign tool except on PR
-      # https://github.com/sigstore/cosign-installer
-
-      - name: Install cosign
-        if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
-        with:
-          cosign-release: 'v2.1.1'
-
-      # Set up BuildKit Docker container builder to be able to build
-      # multi-platform images and export cache
-      # https://github.com/docker/setup-buildx-action
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
-
-      # Login against a Docker registry except on PR
-      # https://github.com/docker/login-action
-
-      # Login against a Docker registry except on PR
-      # https://github.com/docker/login-action
-      - name: Log into registry ${{ env.REGISTRY }}
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # Extract metadata (tags, labels) for Docker
-      # https://github.com/docker/metadata-action
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-
-      # Build and push Docker image with Buildx (don't push on PR)
-      # https://github.com/docker/build-push-action
-      - name: Build and push Docker image
-        id: build-and-push
-        uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-
-      # Sign the resulting Docker image digest except on PRs.
-      # This will only write to the public Rekor transparency log when the Docker
-      # repository is public to avoid leaking data.  If you would like to publish
-      # transparency data even for private images, pass --force to cosign below.
-      # https://github.com/sigstore/cosign
-      - name: Sign the published Docker image
-        if: ${{ github.event_name != 'pull_request' }}
-        env:
-          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
-          TAGS: ${{ steps.meta.outputs.tags }}
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        # This step uses the identity token to provision an ephemeral certificate
-        # against the sigstore community Fulcio instance.
-        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
\ No newline at end of file
diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
new file mode 100644
index 0000000..d5d6531
--- /dev/null
+++ b/.github/workflows/draft-release.yml
@@ -0,0 +1,14 @@
+name: 'Release Drafter'
+
+on:
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  update_release_draft:
+    name: Release
+    uses: chukysoria/workflows/.github/workflows/new-release.yml@624bd5750a5e2f4ffc50b89977fd840b66c4f1c1 # v1.1.38
+    with:
+      simple-build: true
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
new file mode 100644
index 0000000..4fdf61e
--- /dev/null
+++ b/.github/workflows/labels.yml
@@ -0,0 +1,21 @@
+---
+   
+name: Sync labels
+            
+on:
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - .github/labels.yml
+  schedule:
+    - cron: "34 5 * * *"
+  workflow_dispatch:
+                                                                                            
+                                                                                                  
+jobs:
+  labels:
+    name: ♻️ Sync labels
+    uses: chukysoria/workflows/.github/workflows/labels.yml@624bd5750a5e2f4ffc50b89977fd840b66c4f1c1 # v1.1.38
+                                                                                                                            
diff --git a/.github/workflows/permissions.yml b/.github/workflows/permissions.yml
new file mode 100644
index 0000000..c869a50
--- /dev/null
+++ b/.github/workflows/permissions.yml
@@ -0,0 +1,10 @@
+name: Permission check
+on:
+  pull_request_target:
+    paths:
+      - '**/run'
+      - '**/finish'
+      - '**/check'
+jobs:
+  permission_check:
+    uses: chukysoria/workflows/.github/workflows/init-svc-executable-permissions.yml@624bd5750a5e2f4ffc50b89977fd840b66c4f1c1 # v1.1.38
diff --git a/README.md b/README.md
index c52fa9b..30ac165 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 # The Tailscale universal Docker mod
-
+ 
 This Docker mod lets you slipstream Tailscale into
 [linuxserver.io](https://linuxserver.io) containers. This lets you
 have applications join your tailnet.
@@ -11,7 +11,7 @@ use to configure it.
 
 | Environment Variable   | Description                                                                                                                                                                                                                                                                                                   | Example                                  |
 | :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :--------------------------------------- |
-| `DOCKER_MODS`          | The list of additional mods to layer on top of the running container, separated by pipes.                                                                                                                                                                                                                     | `ghcr.io/tailscale-dev/docker-mod:main`  |
+| `DOCKER_MODS`          | The list of additional mods to layer on top of the running container, separated by pipes.                                                                                                                                                                                                                     | `chukysoria/docker-mod:main`  |
 | `TAILSCALE_STATE_DIR`  | The directory where the Tailscale state will be stored, this should be pointed to a Docker volume. If it is not, then the node will set itself as ephemeral, making the node disappear from your tailnet when the container exits.                                                                            | `/var/lib/tailscale`                     |
 | `TAILSCALE_AUTHKEY`    | The authkey for your tailnet. You can create one in the [admin panel](https://login.tailscale.com/admin/settings/keys). See [here](https://tailscale.com/kb/1085/auth-keys/) for more information about authkeys and what you can do with them.                                                               | `tskey-auth-hunter2CNTRL-hunter2hunter2` |
 | `TAILSCALE_HOSTNAME`   | The hostname that you want to set for the container. If you don't set this, the hostname of the node on your tailnet will be a bunch of random hexadecimal numbers, which many humans find hard to remember.                                                                                                  | `wiki`                                   |
diff --git a/build.yaml b/build.yaml
new file mode 100644
index 0000000..87d4369
--- /dev/null
+++ b/build.yaml
@@ -0,0 +1 @@
+----
diff --git a/config.yaml b/config.yaml
new file mode 100644
index 0000000..407227c
--- /dev/null
+++ b/config.yaml
@@ -0,0 +1,8 @@
+---
+image:  tailscale-mod
+version: v1.1.8
+name: TailscaleMod
+description: "Tailscale Mod Install Tailscale VPN within a container."
+ext_release: 1.1.0
+arch:
+  - all
diff --git a/flake.lock b/flake.lock
deleted file mode 100644
index a28d087..0000000
--- a/flake.lock
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "locked": {
-        "lastModified": 1678901627,
-        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1680487167,
-        "narHash": "sha256-9FNIqrxDZgSliGGN2XJJSvcDYmQbgOANaZA4UWnTdg4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "53dad94e874c9586e71decf82d972dfb640ef044",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flake.nix b/flake.nix
deleted file mode 100644
index 3e854b4..0000000
--- a/flake.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  description = "Flake utils demo";
-
-  inputs.flake-utils.url = "github:numtide/flake-utils";
-
-  outputs = { self, nixpkgs, flake-utils }:
-    flake-utils.lib.eachDefaultSystem (system:
-      let pkgs = nixpkgs.legacyPackages.${system}; in
-      {
-        devShells.default = pkgs.mkShell {
-          buildInputs = with pkgs; [ dive tree go_1_20 go-tools gotools gopls ];
-        };
-      }
-    );
-}
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..dc121a2
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>chukysoria/renovate-config"
+  ]
+}
\ No newline at end of file
diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale-postinstall/run b/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale-postinstall/run
index 24cc8c8..3d7eab6 100755
--- a/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale-postinstall/run
+++ b/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale-postinstall/run
@@ -2,10 +2,6 @@
 
 set -euo pipefail
 
-dir="$(mktemp -d)"
-pushd .
-cd "${dir}"
-
 GOARCH=""
 
 case `uname -m` in
@@ -19,6 +15,9 @@ case `uname -m` in
     riscv64)
         GOARCH="riscv64"
         ;;
+    armv7l)
+        GOARCH="arm"
+        ;;
     *)
         echo "Unknown CPU type $(uname -m), please file a bug at https://github.com/tailscale-dev/docker-mod"
         exit 125
@@ -28,12 +27,28 @@ esac
 tarball="$(curl 'https://pkgs.tailscale.com/stable/?mode=json' | jq -r .Tarballs.${GOARCH})"
 version="$(echo ${tarball} | cut -d_ -f2)"
 
-curl "https://pkgs.tailscale.com/stable/${tarball}" -o tailscale.tgz
+if [ -f /usr/bin/tailscale ]; then
+  installed_version="$(tailscale -V | head -n1)"
+else
+  installed_version=""
+fi
+
+if [[ $version == $installed_version ]]; then
+  echo "[mod-tailscale] Tailscale ${version} already installed"
+else
+  dir="$(mktemp -d)"
+  pushd .
+  cd "${dir}"
+  
+  echo "[mod-tailscale] Downloading Tailscale ${version}"
+
+  curl "https://pkgs.tailscale.com/stable/${tarball}" -o tailscale.tgz
 
-tar xzf tailscale.tgz
+  tar xzf tailscale.tgz
 
-cp -vrf "tailscale_${version}_${GOARCH}"/tailscale /usr/bin/tailscale
-cp -vrf "tailscale_${version}_${GOARCH}"/tailscaled /usr/sbin/tailscaled
+  cp -vrf "tailscale_${version}_${GOARCH}"/tailscale /usr/bin/tailscale
+  cp -vrf "tailscale_${version}_${GOARCH}"/tailscaled /usr/sbin/tailscaled
 
-popd
-rm -rf "${dir}"
+  popd
+  rm -rf "${dir}"
+fi
diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale/run b/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale/run
index 26ba791..cb15646 100755
--- a/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale/run
+++ b/root/etc/s6-overlay/s6-rc.d/init-mod-universal-tailscale/run
@@ -1,15 +1,19 @@
 #!/usr/bin/with-contenv bash
 
-## Ubuntu
-if [ -f /usr/bin/apt ]; then
-    echo "\
-        jq \
-        iptables" >> /mod-repo-packages-to-install.list
+if [ ! -f /usr/bin/curl ] || [ ! -f /usr/bin/jq ] || [ ! -f /usr/sbin/iptables ]; then
+    ## Ubuntu
+    if [ -f /usr/bin/apt ]; then
+        echo "\
+            curl \
+            jq \
+            nftables" >> /mod-repo-packages-to-install.list
 
-fi
-# Alpine
-if [ -f /sbin/apk ]; then
-    echo "\
-        jq \
-        iptables" >> /mod-repo-packages-to-install.list
+    fi
+    # Alpine
+    if [ -f /sbin/apk ]; then
+        echo "\
+            curl \
+            jq \
+            nftables" >> /mod-repo-packages-to-install.list
+    fi
 fi
diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-tailscale b/root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-mod-tailscale
similarity index 100%
rename from root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-tailscale
rename to root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-mod-tailscale
diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-tailscale-up b/root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-mod-tailscale-up
similarity index 100%
rename from root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-tailscale-up
rename to root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/svc-mod-tailscale-up
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/dependencies.d/init-mod-universal-tailscale-postinstall b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/dependencies.d/svc-mod-tailscale
similarity index 100%
rename from root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/dependencies.d/init-mod-universal-tailscale-postinstall
rename to root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/dependencies.d/svc-mod-tailscale
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/run b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/run
similarity index 86%
rename from root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/run
rename to root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/run
index e430208..838c41e 100755
--- a/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/run
+++ b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/run
@@ -1,6 +1,6 @@
 #!/usr/bin/with-contenv bash
 
-FLAGS=""
+FLAGS="--stateful-filtering"
 
 # configure `tailscale up`
 if ! [ -v TAILSCALE_AUTHKEY ]; then
@@ -29,15 +29,19 @@ fi
 
 tailscale up $FLAGS
 
-# configure serve or funnel
+# configure serve or funnel, or reset if not set/removed
 if [ -v TAILSCALE_SERVE_PORT ] && [ -v TAILSCALE_SERVE_MODE ]; then
 
     if [ -v TAILSCALE_FUNNEL ]; then
         tailscale funnel --bg --"${TAILSCALE_SERVE_MODE}"=443 http://localhost:"${TAILSCALE_SERVE_PORT}"
     else
+        tailscale funnel reset
         tailscale serve --bg --"${TAILSCALE_SERVE_MODE}"=443 http://localhost:"${TAILSCALE_SERVE_PORT}"
     fi
-    
+
+else
+    tailscale serve reset
+    tailscale funnel reset 
 fi
 
 
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/type b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/type
similarity index 100%
rename from root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/type
rename to root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/type
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/up b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/up
new file mode 100644
index 0000000..201da9a
--- /dev/null
+++ b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/up
@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/svc-mod-tailscale-up/run
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale/dependencies.d/init-mod-universal-tailscale-postinstall b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/dependencies.d/init-mod-universal-tailscale-postinstall
similarity index 100%
rename from root/etc/s6-overlay/s6-rc.d/svc-tailscale/dependencies.d/init-mod-universal-tailscale-postinstall
rename to root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/dependencies.d/init-mod-universal-tailscale-postinstall
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale/run b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/run
similarity index 94%
rename from root/etc/s6-overlay/s6-rc.d/svc-tailscale/run
rename to root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/run
index fd43e95..24c37b9 100755
--- a/root/etc/s6-overlay/s6-rc.d/svc-tailscale/run
+++ b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/run
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash
 
 FLAGS=""
 
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale/type b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/type
similarity index 100%
rename from root/etc/s6-overlay/s6-rc.d/svc-tailscale/type
rename to root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/type
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/up b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/up
new file mode 100644
index 0000000..6a33ea9
--- /dev/null
+++ b/root/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/up
@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/svc-mod-tailscale/run
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/up b/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/up
deleted file mode 100644
index 86df500..0000000
--- a/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/up
+++ /dev/null
@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/svc-tailscale-up/run
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale/up b/root/etc/s6-overlay/s6-rc.d/svc-tailscale/up
deleted file mode 100644
index 86df500..0000000
--- a/root/etc/s6-overlay/s6-rc.d/svc-tailscale/up
+++ /dev/null
@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/svc-tailscale-up/run
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/dependencies.d/svc-tailscale b/root/etc/s6-overlay/s6-rc.d/user-bundles.d/user/contents.d/svc-mod-tailscale-up
similarity index 100%
rename from root/etc/s6-overlay/s6-rc.d/svc-tailscale-up/dependencies.d/svc-tailscale
rename to root/etc/s6-overlay/s6-rc.d/user-bundles.d/user/contents.d/svc-mod-tailscale-up