[HN Gopher] Syncthing Anywhere with Tailscale
___________________________________________________________________
Syncthing Anywhere with Tailscale
Author : tosh
Score : 67 points
Date : 2022-08-07 11:28 UTC (11 hours ago)
(HTM) web link (init8.lol)
(TXT) w3m dump (init8.lol)
| [deleted]
| game-of-throws wrote:
| https://web.archive.org/web/20220807141055/https://init8.lol...
| hank_z wrote:
| Isn't Tailscale similar to the Zerotier which can build a virtual
| LAN across any networks?
| eterps wrote:
| I guess for a single user this doesn't do much (other than
| redundancy)? As being offline for a while with Syncthing will
| just resync when back at home?
| jacooper wrote:
| If only it was possible ot use Tailscale along normal Wireguard
| VPN. Because currently I stopped using Tailscale because I want
| to use ProtonVPN. Yes I know I can use an exit node, and connect
| the exit it self to Proton, but that adds amazing latency.
| ssklash wrote:
| I switched to https://netbird.io/ for this exact reason.
| solarkraft wrote:
| Netbird is interesting! I only found out about them because
| their predecessor company made a cool SATA board for the
| Raspberry Pi 4.
|
| Their community seems to be very small; so could you give a
| short review of what's better/worse about it vs. Tailscale?
| atmosx wrote:
| Can you elaborate? Netbird looks like an exact copy of
| Tailscale. What makes Netbird a good fit for working next to
| ProtonVPN?
| ssklash wrote:
| It allowed me to use a separate Wireguard tunnel with a
| VPN. I found that Tailscale wouldn't let me do that.
| hrdwdmrbl wrote:
| If there was a company providing Syncthing-as-a-service I would
| very much sign up. I want the power of Syncthing (or similar)
| without the hassle of running a server myself.
| qbasic_forever wrote:
| Syncthing is P2P, you're not meant to run it on a server in the
| cloud. You run it on each device like your laptops, your NAS,
| your desktop computers, etc. and it will connect each of them
| together P2P to share files. You can of course run a server in
| the cloud that is always on and sharing your files but it's not
| the primary or required way to use syncthing.
| iansinnott wrote:
| Not sure about syncthing, but you can get hosted nextcloud as a
| service which provdies many (all?) of the syncing beefits in my
| experience.
| memen wrote:
| Syncthing does not require a server. Syncthing is itself the
| server. The application (on either platform you want) connects
| directly to another device (i.e. peer to peer or P2P) and
| sends/receives the folders and files as you setup.
|
| A syncthing server is used for discovery only, which is a free
| service.
| stavros wrote:
| All of the above is true, but I want to note that the GP
| might want to run a "server" (in reality, a third node) so he
| doesn't have to keep other devices online all the time.
|
| I use my NAS for this, that way I don't need to keep my
| desktop turned on for my laptop to sync to it.
| rsync wrote:
| Ok but each "peer" needs to have syncthing installed, correct
| ?
|
| That is, you can't just point syncthing to any old sftp
| endpoint...
|
| I think your parent means "the commercial endpoint" when he
| says "server" ...
| Macha wrote:
| What is "the commercial endpoint"? There's no commercial
| offering of Syncthing.
|
| Every peer needs to have syncthing installed, yes. This is
| how syncthing works. It's P2P (though there is the public
| relay servers for NATed peers).
|
| Even if you ran your own relay network, every peer would
| need Syncthing installed.
|
| What some users might want is an always-on node, so that
| device A could push to that always-on node and then device
| B could later download it without requiring device A and
| device B to be online at the same time, but what that node
| is, is really just a device C that's always on.
|
| I think you're picturing Syncthing as being like a
| centralised file host that offers a client to sync to/from
| it, or maybe like something like Borg or restic. It's not
| that, there's no master node or central repo or anything.
| rsync wrote:
| Your grandparent was asking about a commercial syncthing
| as a service - see upthread ...
| na85 wrote:
| Good grief. It's blatantly obvious that what's being
| discussed is "always online 3rd syncthing peer as a
| service".
| daedalus_j wrote:
| This may become possible using the new Untrusted Device
| feature, allowing you to have a SyncThing client somewhere that
| hosts but cannot access your files.
| (https://docs.syncthing.net/users/untrusted.html)
|
| I use this feature with a friend of mine. We both have NAS',
| and we both have each other's NAS as an untrusted SyncThing
| device. (It's also pretty trivial to run a Linode/DigitalOcean
| low end VPS as an untrusted client. In fact if neither has a
| one-click install I'd be surprised.)
| jiggunjer wrote:
| Doesn't MEGA do something similar? Don't know what OS support
| it has though.
| jarym wrote:
| > assuming I'm not interested yet in a commercial "Zero Trust
| Network" solution that maybe tunnels any TCP/UDP packets through
| a commercial reverse proxy because the packets are not end-to-end
| encrypted.
|
| This isn't (always) true. Some solutions are E2E encrypted.
| zikduruqe wrote:
| or stand up Headscale yourself.
|
| https://github.com/juanfont/headscale
| therein wrote:
| Been using it for at least 6-8 months. Works well everywhere,
| last I checked didn't work on iOS devices due to the
| Tailscale client not caring about the custom preferences
| loaded.
|
| Not a problem for me, the only Apple devices I have are not
| iOS but I'd imagine a dealbreaker for some.
| jacooper wrote:
| Set up*
| adrianmonk wrote:
| "Stand up" is jargon for creating an instance of a service
| and bringing it online.
|
| Among "stand"'s many meanings, it can be a transitive verb
| meaning to put something in a standing or upright position.
| For example, my electric toothbrush has a flat bottom, so I
| can lay it down on its side or stand it up on its end. So,
| basically "stand up" is a lot like "erect" as in "erect a
| fence along the property line".
| jbverschoor wrote:
| No sync you
| jaden wrote:
| I just recently tried using Tailscale IPs for all Syncthing nodes
| to add some privacy. It worked fine except for the Android phone,
| where Syncthing tried to start on the Tailscale static IP but
| hung because it wasn't available. That and having Tailscale use a
| significant amount of battery has convinced me to leave the
| Android connections dynamic.
| nope96 wrote:
| > I somewhat don't trust "cloud" providers and would avoid them
| as much as I can since my paranoid level is kinda high.
|
| Syncthing has a new untrusted feature, which sends encrypted
| blobs to the nodes you set as being "untrusted" (i.e. nodes in
| the cloud)
|
| Here's the specs on how it works:
| https://docs.syncthing.net/specs/untrusted.html
| alphabettsy wrote:
| This works really well if you want to use a cheap VPS to ensure
| you always have a machine available to sync with/through.
| api wrote:
| Isn't syncthing P2P all by itself? Why run it over something
| else? Is it encrypted or is its encryption suspect?
|
| I'm also not a huge fan of the "put thing A on top of general
| purpose thing that can host all things of the same class as A"
| trope. Tailscale gives you a virtual network so you can run
| _absolutely anything that speaks IP_ over it. It 's like "how to
| run (insert random Linux service) in Docker" and similar
| blogspam.
| proactivesvcs wrote:
| Yes, it's P2P by default. It's all TLS-encrypted and I've not
| come across anything suggesting syncthing's implementation is
| suspect, since most of it is just using Go's libraries. You can
| also run your own (private or public) discovery and/or relay
| servers. I agree that this is adding in two additional levels
| of complexity, including managing an online account which could
| be compromised, just to avoid exposing a single service to the
| Internet. At first glance this seems to be undermining the idea
| of keeping the network secure.
|
| One could even have the reverse proxy on port 80 forward
| requests to Syncthing on the inside.
| mleo wrote:
| To prevent any use of the relay servers and have them always
| connect. I disabled the relay on my syncthing services between
| laptop and work VMs. This means they only sync when the laptop
| is connected to VPN.
| nvrspyx wrote:
| From the blog post:
|
| > Tailscale here is optional as Syncthing does the NAT
| traversal for you and also uses a secure protocol. Syncthing
| will do its best to establish a peer to peer connection and
| that's great!
|
| > However, with Tailscale I can access my "shared directory"
| via SAMBA on my other devices, anywhere. And also don't need
| any "Relay Server" only if my device can't talk peer-to-peer as
| Tailscale will do it for me :))
| chrisweekly wrote:
| "don't need any... only if.. can't"
|
| this is so hard to parse, could you rephrase for clarity?
___________________________________________________________________
(page generated 2022-08-07 23:01 UTC)