A word of caution about Tailscale reddit / selfhosted ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 04:42 This probably won't be a popular opinion, but given the volume of Tailscale praising posts this sub gets, I think it's worth noting that while Tailscale is a cool service, it's very much not self-hosting and in is even against the reasons that many people choose to self-host. If you use Tailscale, you're outsourcing a piece of your network to a VC funded company. With a simple change to their TOS this company can do all sorts of things, including charging for a previously free product or monetizing whatever data that can get from you. If there's one thing that we should all already know about VC funded internet startups, it's that they can and will pull the rug from underneath you when their bottom line demands it. See: streaming services cutting content while raising costs, sites like youtube and reddit redesigning to add more and more ads, hashicorp going from open source to close source. There's countless others. In the beginning there is often a honey moon period when a company is flush from cash from VC rounds and is in a "growth at all costs" mentality where they essentially subsidize the cost of services for new users and often offer things like a free tier. This is where Tailscale is today. Over time they eventually shift into a profit mentality when they've shored up as much of the market as they can (which Tailscale has already done a great job of). I'm not saying don't use Tailscale, or that it's a bad service (on the contrary their product UX is incredible and you can't get better than free), just that it's praise in this subreddit feels misplaced. Relying on a software-as-a-service company for your networking feels very much against the philosophy of self hosting. ---------------------------------------------------------------------- mrpink57 · 2023-12-10 04:53 https://github.com/juanfont/headscale ---------------------------------------------------------------------- mightyugly · 2023-12-10 04:53 ZeroTier ftw, you can self host it. ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-12-10 05:06 I would (in good faith) caution you not to gatekeep such a narrow definition of “self-hosting” so as to discredit use of Tailscale under No True Scotsman-esque rhetoric. There are more reasons, modes, and models for self-hosting than can be accounted for in any reasonably efficient discussion because it’s a multivariate continuum. And also, you’re right in two accounts: 1. The sudden surge in posts… well frankly it smells. I’m not making an astroturf accusation, but I wonder. 2. It’s a third party VC-backed SaaS and this is probably the perfect subreddit to talk about the likelihood and impact of enshittification for something that can quickly become an “easy button” for such a critical piece of infrastructure. ---------------------------------------------------------------------- SammyDavidJuniorJr · 2023-12-10 05:17 It’s not true self-hosting until you run a tier 1 network. ---------------------------------------------------------------------- captnmr · 2023-12-10 05:43 Is tailscale such a custom part of your set up that you would avoid it not based on their track record but because they use VC money (Like every company)? If it starts to suck, I'll move to something else. Maybe I'm biased because I know Brad but they aren't about to bait and switch on their power users. That's how they get into enterprise. ---------------------------------------------------------------------- Aurailious · 2023-12-10 05:46 To an extant there is always something you'll need to rely on something else for if you plan on using the internet. However, something like Let's Encrypt is a lot more "friendly". But people's reasons for selfhosting might not always be about "degoogling" or limiting exposure to VC and data collection SaaS. I don't think selfhosting should have that a philophy beyond "here's how to do it yourself", no need to include *why*. But even in those circumstances I would also agree to be cautious. Tailscale *will* enshitify at some point. It definitely won't hurt to add headscale to every conversation on tailscale. ---------------------------------------------------------------------- tribak · 2023-12-10 05:47 Now make one post for Plex. ---------------------------------------------------------------------- MalcolmY · 2023-12-10 05:58 You can also host Headscale. ---------------------------------------------------------------------- zupobaloop · 2023-12-10 06:14 The only way to really self host is to build your own internet. That's what we will do! Build our own internet, host out own network, serve our own media, and kill God. Tailscale will never see it coming. ---------------------------------------------------------------------- sexpusa · 2023-12-10 06:32 Is that the Jellyfin clone? ---------------------------------------------------------------------- literal_garbage_man · 2023-12-10 06:34 You speak the truth! ---------------------------------------------------------------------- vluhdz · 2023-12-10 06:43 Yes, thank you for posting this. There have been far too many posts recently encouraging people to just use tailscale instead of learning more about their options and self hosting in general. ---------------------------------------------------------------------- 7K_K7 · 2023-12-10 06:44 My ISP has gone with the CGNAT route. What are the other alternatives I can use besides Tailscale? Headscale is something I saw on this thread. Another one is zero tier but in my usage it has been very slow. Any other suggestions? ---------------------------------------------------------------------- Darkextratoasty · 2023-12-10 06:47 While you are right that they could switch things up at any moment and screw us over, I'm not really worried about that because they've shown in the past that they actually care about the small scale users. Just a little while ago they changed their free tier for the better, which is a pleasant change of pace, reducing or even removing some of the restrictions it has. Most of the restrictions on the free tier are soft limits anyways, it'll warm you if you go past them, but it won't actually stop you from doing so. To your other point, again, you're technically correct, tailscale itself isn't self hosted, but it is a great tool to use in tandem with your self hosted stuff. It's easy to use and is pretty secure (assuming you trust the company). It's just a good way to access your self hosted services remotely, with the added benefit of not needing to open any ports on your firewall. ---------------------------------------------------------------------- epsiblivion · 2023-12-10 06:53 You have to mine your own rare earth metals. No wait you must first create the universe ---------------------------------------------------------------------- epsiblivion · 2023-12-10 06:53 Run a tunnel to a vps. ---------------------------------------------------------------------- SammyDavidJuniorJr · 2023-12-10 06:54 I mean we’ve all been making our own silicon, right? ---------------------------------------------------------------------- SammyDavidJuniorJr · 2023-12-10 06:56 Wireguard is what tailscale is built on if you want to go deeper. https://www.wireguard.com/ ---------------------------------------------------------------------- oowm · 2023-12-10 06:57 > The only way to really self host is to build your own internet. I know it's not where you were headed but there are a bunch of us out there who run hobbynets: networks with our own IP (IPv6, sometimes IPv4) space, transit and peering links, and services behind them. A relevant blog post: https://quantum5.ca/2023/10/10/what-i-wish-i-knew- when-i-got-my-asn/ ---------------------------------------------------------------------- dxrth · 2023-12-10 07:05 Should probably just have a WireGuard setup running for backup in case we ever lose TailScale. Not a big deal. ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 07:07 I don't disagree with you, but I also don't want to mince words: using tailscale itself is *not* self-hosting. I don't mean that in some no true scotsman way, you are dependent on a profit driven company to run a tunnel through your network, whereas most of the rest of your network you have likely already paid for all your hardware and only depend on an ISP for an internet connection. I agree that Tailscale enables many to self-host in other capacities where they might not have considered it previously. To that end, I hope this post serves as an encouragement to look into things like Wireguard or Headscale to become more autonomous. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 07:08 I think the irony of providing a solution that requires you to be abe to port forward is a little lost on you. If you can port forward, there is no need to use Tailscale since you can use Wireguard. People who use Tailscale are behind CGNAT and can't port forward, so headscale is useless to them. ---------------------------------------------------------------------- adiyasl · 2023-12-10 07:10 You can host headscale on a cheapo VPS somewhere and only open the ports of that vps. No need to port forward the other stuff. ---------------------------------------------------------------------- Teknikal_Domain · 2023-12-10 07:12 Hah. Hahahahahahah. Jellyfin is a fork of emby which is a fork of Plex. It seems to be a rite of passage that self hosted media libraries eventually become walled gardens of paid features and someone forks them to make a free alternative. ---------------------------------------------------------------------- greenphlem · 2023-12-10 07:13 > People who use Tailscale are behind CGNAT and can’t port forward, so headscale is useless to them. That’s… just not true? Sure that’s a percentage of the users but plenty of homelabbers/ professionals use talescale for its many other features ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 07:13 Fully agreed with everything you've said. I'm just hoping to provide a perspective for people using TS that they might not have considered or known about previously. ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 07:17 > I'm not really worried about that because they've shown in the past that they actually care about the small scale users. Just a little while ago they changed their free tier for the better, which is a pleasant change of pace, reducing or even removing some of the restrictions it has. Most of the restrictions on the free tier are soft limits anyways, it'll warm you if you go past them, but it won't actually stop you from doing so. !remindme 5 years ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-12-10 07:17 How long do you think before the enshittification kicks off? ---------------------------------------------------------------------- RemindMeBot · 2023-12-10 07:18 I will be messaging you in 5 years on [**2028-12-10 07:17:25 UTC**](ht tp://www.wolframalpha.com/input/?i=2028-12- 10%2007:17:25%20UTC%20To%20Local%20Time) to remind you of [**this link **](https://www.reddit.com/r/selfhosted/comments/18evofr/a_word_of_cau tion_about_tailscale/kcqoskr/?context=3) [**CLICK THIS LINK**](https://www.reddit.com/message/compose/?to=Remin dMeBot&subject=Reminder&message=%5Bhttps%3A%2F%2Fwww.reddit.com%2Fr%2F selfhosted%2Fcomments%2F18evofr%2Fa_word_of_caution_about_tailscale%2F kcqoskr%2F%5D%0A%0ARemindMe%21%202028-12-10%2007%3A17%3A25%20UTC) to send a PM to also be reminded and to reduce spam. ^(Parent commenter can ) [^(delete this message to hide from others.)] (https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Delete %20Comment&message=Delete%21%2018evofr) ***** |[^(Info)](https://www.reddit.com/r/RemindMeBot/comments/e1bko7/remind mebot_info_v21/)|[^(Custom)](https://www.reddit.com/message/compose/?t o=RemindMeBot&subject=Reminder&message=%5BLink%20or%20message%20inside %20square%20brackets%5D%0A%0ARemindMe%21%20Time%20period%20here)|[^(Yo ur Reminders)](https://www.reddit.com/message/compose/?to=RemindMeBot& subject=List%20Of%20Reminders&message=MyReminders%21)|[^(Feedback)](ht tps://www.reddit.com/message/compose/?to=Watchful1&subject=RemindMeBot %20Feedback)| |-|-|-|-| ---------------------------------------------------------------------- a_sugarcane · 2023-12-10 07:20 > People who use Tailscale are behind CGNAT and can't port forward, so headscale is useless to them. This is the only reason people should use Tailscale. One other option that not enough people talk about is IPv6. I'm behind NAT with IPv4 but since IPv6 deployment on both my mobile and broadband network I don't use a single third party service. ---------------------------------------------------------------------- Darkextratoasty · 2023-12-10 07:23 I mean you're free to be as curmudgeonly as you like, but you have a very similar risk to all open source self hosted options too. They could always be altered or abandoned and you'd be stuck with an old unmaintained version unless you or someone else wants to put in the work to maintain a fork. Going the open source self hosted route means you're not at the mercy of some company, but it also means you're very much at the mercy of the general crowd, again, unless you want to upkeep the security patches and such yourself. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 07:26 You can do the same with Wireguard. Your point? ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 07:27 Like? Giving control to a third party VC backed company? Same people who host everything in the cloud? ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 07:28 You see by the downvotes how people defend their precious Tailscale. ---------------------------------------------------------------------- kuzared · 2023-12-10 07:28 Solid post, I completely agree. I’ve always thought the same of Cloudflare tunnels… ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 07:29 Yeah, but my access won't get shut off with zero recourse, or I won't suddenly be charged for something I was previously not charged for. Worst case scenario with open source is the software that I was already using works the exact same way indefinitely. ---------------------------------------------------------------------- a_sugarcane · 2023-12-10 07:32 Man this sub has weird obsession with down voting any comment that has bit different tone than what this sub sings to. ---------------------------------------------------------------------- Darkextratoasty · 2023-12-10 07:32 Works the same way indefinitely assuming nothing else in the ecosystem ever changes, which is an entirely false assumption. There's a reason security patches exist. However, at this point I'm just being argumentative really. ---------------------------------------------------------------------- hardonchairs · 2023-12-10 07:33 Things like HA, IoT, cloud storage, media management are all a medium to large investment. Either of money or time. Tailscale is really no investment. I am not paying anything, not buying any physical products, not spending any time. They aren't going to brick any of my devices or make me spend a ton of time migrating. It makes no difference if I find an alternative today or later on when they change to the TOS. So I'll just use the crayons instead of keeping them perfect in the box until they get thrown away. ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 07:34 Then I at least have the opportunity to fix it myself, whereas if I was using a paid service with unfavorable terms I have zero options but to accept the new terms. Having the opportunity to DIY is what self hosting is all about IMO. ---------------------------------------------------------------------- Important-Feedback28 · 2023-12-10 07:37 !remindme 2 years ---------------------------------------------------------------------- Whitestrake · 2023-12-10 07:37 None of which is required when using Headscale instead. The GUI wrapper for the Tailscale client is closed-source, but isn't required - the CLI itself is open source. I'm not advocating for Tailscale, I personally prefer to self-host ZeroTier. But both of those platforms provide functionality above and beyond a simple WireGuard VPN. I'm just stating the facts so that people aren't making their decisions based on misinformation. Edit: looks like /u/ElevenNotes blocked me as well... Pretty embarrassing to come on here so confidently incorrect and then just block everyone that doesn't agree. ---------------------------------------------------------------------- Kyojaku · 2023-12-10 07:39 They're getting downvoted because it was a joke that they clearly didn't get. Or got it but felt the need to be weird about it. ---------------------------------------------------------------------- Teknikal_Domain · 2023-12-10 07:39 That's just reddit groupthink... It's on every sub. ---------------------------------------------------------------------- kurosaki1990 · 2023-12-10 07:39 They didn't down vote him because he's stating the facts but because he's responding to joke comment with serious tone. ---------------------------------------------------------------------- k2kuke · 2023-12-10 07:39 The downvotes are because you are arrogant and looking for a fight. For an actual discussion on the topic i’d try and be a bit more humble and curious. You are not talking fully out of your ass but at the end of the day people use what fills their needs. If Tailscale every stops being that then people will find another. Wireguard is great. But the reality is that not everyone wants to port forward and that is okay. ---------------------------------------------------------------------- sauladal · 2023-12-10 07:40 Genuine question for anyone: outside of the CGNAT/port forwarding issue, what are the benefits of tailscale/headscale over Wireguard? ---------------------------------------------------------------------- umataro · 2023-12-10 07:42 Welcome to Reddit. It doesn't matter what you are saying; you're pooing on somebody's favourite toy, so you get downvotes. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 07:45 I'm fully aware. It's just sad. Speak logically with solid arguments against Tailscale/Proxmox/Plex and you sure as hell get banned. That's what happened on /r/homelab where they banned me for saying you can't compare podman/docker to k8s 😂 ---------------------------------------------------------------------- lemniskegg · 2023-12-10 07:47 He can't expose wireguard because he's behind a CGNAT ---------------------------------------------------------------------- mirisbowring · 2023-12-10 07:48 But you could use something like dyndns to port forward behind cgnat via dns instead of ip ---------------------------------------------------------------------- bakterja · 2023-12-10 07:51 Also you share the oxygen, you have to produce your own oxygen ---------------------------------------------------------------------- laterral · 2023-12-10 07:51 One click deployment, no need to configure anything, no need to manage keys ---------------------------------------------------------------------- karlthespaceman · 2023-12-10 07:55 Lemme guess, you don’t make your own sunlight? You rely on a centralized fusion reactor millions of miles away? Yikes. ---------------------------------------------------------------------- ErraticLitmus · 2023-12-10 07:59 What are the arguments against proxmox and Plex? Asking for a friend ---------------------------------------------------------------------- Significant-Neat7754 · 2023-12-10 08:00 Exactly. Why are you being downvoted? This is the very reason I use Tailscale. I don't want to spend money on a VPS (I live in a low-income country and even a cheapo VPS is quite expensive in my currency). Tailscale isn't ideal but it's a way out of CGNAT. ---------------------------------------------------------------------- SammyDavidJuniorJr · 2023-12-10 08:00 Joke’s on you I have cold fusion at home. ---------------------------------------------------------------------- karlthespaceman · 2023-12-10 08:02 “We have cold fusion at home” Cold fusion at home: https://en.m.wikipedia.org/wiki/Adobe_ColdFusion ---------------------------------------------------------------------- jaykayenn · 2023-12-10 08:06 It'll be somewhat inconvenient, but I can continue using the underlying VPN, without the convenience of Tailscale. No biggie. Might be a problem for big complex networks though, who are the (reasonable) target of monetization. ---------------------------------------------------------------------- AuthorYess · 2023-12-10 08:09 Nah Emby is completely separate from Plex. Plex was forked from XBMC. Jellyfin is a fork of Emby, which was named Media Browser a long time ago. Not sure it's part of the XBMC project (which turned into Kodi), but I don't believe so. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 08:10 No that does not work because you can't port forward at all. Your best bet is a VPS with a static IP or Tailscale. I rather use the VPS than Tailscale for the VC backing reason. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 08:16 Depends on the use case you have. Proxmox is a tool but not **the** tool. If your hardware supports ESXi, I would argue in terms of functions, operations and stability as well as clustering, ESXi is the more mature platform and should be first choice if the hardware supports it, if not, use Proxmox. As with Plex. It does not work offline, at least not for the common Plex user. I have Plex offline, but this requires a little more effor than copy/paste a compose.yaml, so my argumenr there is to not use Plex if you can't make it run offline. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 08:17 and you are the perfect use case for it! I guess it actually pisses you off that prople who can port forward or even have static IPv4 are still using Tailscale because it's easier for them to use than plain old Wireguard. ---------------------------------------------------------------------- chaplin2 · 2023-12-10 08:19 What’s the difference between Tailscale and running a Wireguard server in a VPS closed to my location? Unlimited number of devices, all of them can be behind CGNAT. No open port on devices other one in VPs. No client software installed. ---------------------------------------------------------------------- bigmanbananas · 2023-12-10 08:23 Your definition of self-hostung is not applicable to everyone. You should really accept you are a small fish in a big sea and what you consider self-hosting doesn't really mean anything to anyone else. It just comes across as arrogance. ---------------------------------------------------------------------- sparky5dn1l · 2023-12-10 08:24 It is still a little better that using cloudflare tunnel. Tailscale is excellent for mesh vpn setup. For simple vpn usage, selfhosted wireguard is preferable. ---------------------------------------------------------------------- Theon · 2023-12-10 08:25 Next someone in SV stubs their toe and accidentally pops some bubble taking a couple dozen startups with it ---------------------------------------------------------------------- imx3110 · 2023-12-10 08:27 I don't think this is true? All the traffic needs to get routed via the VPS if you're using wireguard whereas with Headscale it's direct connections for the most situations. The VPS just acts as a coordination server. ---------------------------------------------------------------------- macrowe777 · 2023-12-10 08:28 Far simpler deployment and management...that's literally the way it's marketed. ---------------------------------------------------------------------- AltLawyer · 2023-12-10 08:31 It's a joke, and a good one. ---------------------------------------------------------------------- intelatominside · 2023-12-10 08:36 Is the VPS selfhosting? At that point, you can just stick to free Tailscale and save a few bucks. ---------------------------------------------------------------------- 446172656E · 2023-12-10 08:36 He's getting down voted because Emby is not a fork of Plex. It started as a plugin for Windows Media Center. ---------------------------------------------------------------------- purepersistence · 2023-12-10 08:37 I use OpenVPN mainly because it was an easy setup on my opnsense router. I don't really know how it compares with tailscale or headscale or others in a broad sense. Does seem like more true self hosting though. The only thing outside my home that I depend on is the internet, DNS provider, offsite backup. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 08:39 Sure, just use it as STUN or TUN and you are good to go. ---------------------------------------------------------------------- bluecollarbiker · 2023-12-10 08:42 Can you expand on this or point to where one could rtfm for the uninitiated? ---------------------------------------------------------------------- budius333 · 2023-12-10 08:44 In one word: simplicity ---------------------------------------------------------------------- bobbarker4444 · 2023-12-10 08:44 It's not really pooing on someone's toy. It's like getting all snarky over someone drinking Pepsi when you think Coke is better. "Well why would you ask for Pepsi if Coke is clearly on the menu?" kind of thing. Opinions are always great but a point you need to learn to shut up or fuck off ---------------------------------------------------------------------- Kaziopu123 · 2023-12-10 08:45 I moved to netbird ---------------------------------------------------------------------- RydRychards · 2023-12-10 08:45 And that is worth giving somebody else the literal keys to your kingdom? With that argument you might as well continue using hosted services because nothing what we do here is easier than hosted solutions. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 08:46 Setup a TURN server. Setup two TURN clients. Connect both to the TURN server. Get the IP and port via the TURN server. Adjust iptables to TURN IP port and have a successfull whole punched Wireguard connection. That's all that Tailscale does itself. It's not magic or anything. It's not even invented by the team at Tailscale. They just put a GUI on it and that's it. ---------------------------------------------------------------------- RydRychards · 2023-12-10 08:48 My guess is that you still use the tailscale gui when using headscale? The tailscale gui is closed source and from what I see has access to your keys ---------------------------------------------------------------------- Azelphur · 2023-12-10 08:48 Agree with you 100% The subreddit shouldn't be recommending tailscale, imo. ---------------------------------------------------------------------- shoulderknees · 2023-12-10 08:49 Automatic point to point communications. I don't have to worry about setting up a direct connection: I just add the devices to the network and I am done forever. And since that's point to point, in the majority of cases LAN to LAN device stays within the LAN for the actual communication, with just a handshake happening on the headscale server. And if your headscale is hosted in the LAN with a custom DNS rule (my case due to cgnat), then this does not even go outside. ---------------------------------------------------------------------- redditor111222333 · 2023-12-10 08:51 Exactly what I am thinking about this. I am behind a cgnat. Why should I make my setup more complex or expensive than it is with tailscale. If tailscale will change anything in the future I can change accordingly. My time invest in tailscale is so minimal that it doesn't hurt to just throw it away. Would you similarly turn down free gas just because they might change it one day? ---------------------------------------------------------------------- ObjectiveList9 · 2023-12-10 09:05 Thank you! I keep getting sussed out by all the mention of Tailscale. I'm sure it's great, but opening my network to a 3rd party like this feels sketch, and it just sounds like a rug pull is the next logical step. ---------------------------------------------------------------------- Don_Matis · 2023-12-10 09:05 Well said. A week ago decided to test tailscale for a three way site to site VPN after reading a lot of possitive comments. Setup was easy...too easy, I admit but the "magic", internal hosts getting external IP outside my control and ignoring the firewall? That's a huge no for me. Tested the exact same concept with wireguard...yes I had to put some effort to configure it and make some changes to the firewall but in an hour or two had the same exact setup that tailscale had without and issue. And guess what...now I have the full control which is the whole point. ---------------------------------------------------------------------- adiyasl · 2023-12-10 09:06 Tailscale is easier for end users to implement. It uses wireguard under the hood anyways. Not saying it is better than wireguard itself, but if you want to use it without fear of corporate shutdown someday, you absolutely can. That’s about it. ---------------------------------------------------------------------- Significant-Neat7754 · 2023-12-10 09:06 Isn't everything encrypted though? Tailscale can't see anything. The SSL certs are stored locally. Please correct me if I'm wrong. ---------------------------------------------------------------------- adiyasl · 2023-12-10 09:08 No it does not direct traffic through the VPS. It just establishes the connection and then the clients maintain the connection on their own. This is why the tailscale free plan is very generous as they spend minimum infrastructure cost to accommodate free users. ---------------------------------------------------------------------- adiyasl · 2023-12-10 09:10 Nobody is defending tailscale man. If there is a easy to use alternative for end users which is also open source, I’m sure everybody will switch in a heartbeat. It’s just the abstraction provided by tailscale is seamless and works very well and require zero knowledge from the user. ---------------------------------------------------------------------- something_new · 2023-12-10 09:10 You don't need 5 years ---------------------------------------------------------------------- schemen · 2023-12-10 09:13 When deployed with headscale, it is my assumption that the client doesn‘t talk to tailscale at all. I have not verified this though. The tailscale client in ios is great. Features like on demand vpn for when you leave your home it automatically connects to your mesh, providing you add blocking services etc. It‘s justa hasslefree wireguard solution. Need to get your parents connected to you? Send tben a raspi configured to connect to your mesh with correct acl so you control what actual traffic is allowed. It will automatically connect without much configuration. ---------------------------------------------------------------------- send_me_a_naked_pic · 2023-12-10 09:14 I wouldn't want to use Plex, but Jellyfin is not there yet. Especially if you want to share your Linux distros with family and friends. ---------------------------------------------------------------------- SevosIO · 2023-12-10 09:18 I see no reason not to set up my own Wireguard. ---------------------------------------------------------------------- imx3110 · 2023-12-10 09:20 Any guide to doing that? This seems overly complicated by your description. Specially this section: **Adjust iptables to TURN IP port and have a successful whole punched Wireguard connection.** Does a TURN server handle all the scenarios that Tailscale does? [https://tailscale.com/blog/how-nat-traversal- works/](https://tailscale.com/blog/how-nat-traversal-works/) ---------------------------------------------------------------------- imx3110 · 2023-12-10 09:24 Are you talking about Tailscale or Wireguard here? Wireguard does not create direct connection between clients without intervention. It needs a server to route traffic through and all connections are through the server rather than direct connections. I tried to do that and failed miserably due to CGNAT. Tailscale does try to create direct connections, it coordinates the direct connections and connects via the underlying Wireguard implementation directly. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 09:25 It is complicated, but hole punching is only needed behind CGNAT, the argument of my initial statement. If you don't have a restricted WAN, there is absolutely no need for Tailscale. ---------------------------------------------------------------------- austozi · 2023-12-10 09:25 Hopefully those who use it already know this. It's not that different from using cloudflare tunnel in terms of entrusting your key to a third party provider. People still do it because they deem the risk acceptable. Not just tailscale, but any project can change the licence and leave you out in the cold. If it's open source, we hope the community will just fork it. We all take some risks when we decide to selfhost things. We all take other risks for the things we decide not to selfhost but entrust them to a third party provider instead. We all assess differently whether the risks are acceptable for our individual cases. I don't think there's a right or wrong answer except what we consider to be acceptable. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 09:26 That's the issue I take on a sub called *self*hosted: Zero knowledge. ---------------------------------------------------------------------- ZenoArrow · 2023-12-10 09:28 netbird looks promising, thanks for the recommendation. ---------------------------------------------------------------------- RydRychards · 2023-12-10 09:28 The client is closed source, so... Maybe. And only until further (non) notice. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 09:30 Not really because Tailscale is not FOSS, while Wireguard is. It's more like saying reading a book is better than listening to the audiobook. ---------------------------------------------------------------------- cmsj · 2023-12-10 09:33 The Android client seems to be open source. No idea why the iOS/other ones aren’t. https://github.com/tailscale/tailscale-android ---------------------------------------------------------------------- dotinho · 2023-12-10 09:35 I agree your concern. But to host head scale you need a VPS or your ISP is not CGNAT, correct? ---------------------------------------------------------------------- ijustlurkhere_ · 2023-12-10 09:42 I'm outsourcing my email hosting to another company. Sometimes it makes sense. ---------------------------------------------------------------------- deadlock_ie · 2023-12-10 09:47 Is it really self-hosting if you don’t have redundant links to at least two tier 1 carriers? ---------------------------------------------------------------------- Croatwink · 2023-12-10 09:47 I'm not sure exactly what Tailscale is but I know it's related to Wireguard and access to home LAN I guess. Well I pay 6 dollars a month for a VPS that I setup with Terraform. And it is the hub in a hub-and-spoke setup including all my devices like smartphone, laptop and so forth. This creates a private LAN where I can host services and reach all my devices across, wherever they may be. I even host prometheus like this, so for example my prometheus server polls node exporter on my laptop over the wireguard VPN. And this does not route all traffic, only the subnet for my VPN. If I want a "real" VPN I set that up separately. ---------------------------------------------------------------------- PovilasID · 2023-12-10 09:49 a) People are not as stupid as you think. I agree with VC honey moon period... However, assuming that most people are not aware of that risk is not seam to based on anything. Though you may be not wrong you are also and ass. b) Barrier of entry lowering effect or 'accessibility'. Starting self hosting is hard. You need to spend a lot of time and TS helps get you faster to some results. TS also can help learn about networking to be able to progress to something. c) Selfhosting. Both Tailscale and Zerotier (most popular mesh VPNs) have an option to be selfhosted avoiding. Corporate infrastructure at all. People have addressed the 'this is not selfhosting' argument already, so I will not add to it. Here is real risk that I think can be overlooked: a) Permissive defaults. TS default is 'every peer can access every other peer'. That is against the principal of least permissions and if one node or protocol gets compromised... It may have a risk for the entire network, so a lot more OPSEC education has to go down. In my opinion not only TS should by default expire their keys but also by default expire their all to all config. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 10:02 Wireguard absolutely can do that by using a TURN server, just like Tailscale does. ---------------------------------------------------------------------- adiyasl · 2023-12-10 10:09 Sorry talking about tailscale. ---------------------------------------------------------------------- adiyasl · 2023-12-10 10:10 That’s the point here. Tailscale is easy to use. Of course other ways might be better and open sourced, but they are complicated. That’s the only reason people love tailscale. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 10:13 Plex/Jellyfin is complicated too. Yet on this sub you see no one promoting Netflix, do you? ---------------------------------------------------------------------- Tone866 · 2023-12-10 10:24 Same with Cloudflare ---------------------------------------------------------------------- itsmesid · 2023-12-10 10:25 I think wireguard does not do https://tailscale.com/blog/how-nat- traversal-works/ ---------------------------------------------------------------------- tenekev · 2023-12-10 10:25 Don't pat yourself on the back. It's not the Tailscale VC fanboys that got you. It's common sense. Headscale on a VPS is as as functional as Taiscale. So is wireguard. There are many ways to avoid Tailscale but none are simpler/faster. You are getting downvoted because you are condescending and snarky while missing things. I don't understand what's with you. Every once in a while you carpet bomb these subreddits with shitty, high-browed arguments. It's like another person is using the account. ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-12-10 10:40 ACLs, built-in DNS, NAT traversal, easy config, peer-to-peer with DERP Relay failover. ---------------------------------------------------------------------- leaflock7 · 2023-12-10 10:40 although your post itself has good validity and brings up good points, your comments can only be characterized as childish or ignorant. The way you put it no one is self hosting, not even you because you don't have your own carrier to get internet. And even then you really to other carriers to communicate to the rest of the world. and to show how childish it is : in order to self host you need \- 2 locations with at least 2 redundant links from 2 different providers. \- a 3rd location where your back ups are, again with redundant links from 2 carriers. \- we will skip the physical security pasts, access cards, cameras etc for the sake of the argument, but we need to consider that the locations are either personal owned buildings or rented buildings/storage that only you have access and not the owner. all of those because you are not actually self hosting, unless there is redundancy. So again, your original post that Tailscale as a service needs to be met with caution as any other VC or private owned provided service is very valid and correct. What is not, are your comments of stating that someone is not "truly" self hosting if they use Tailscale or use of a product that comes from a private company. Also , no, you cannot fix it yourself, because you assume you know how to fix the code that you are hosting which is from someone else. So if you know how to create a jellyfish, a headscale, etc on your own, then and only then you are self hosting. ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-12-10 10:43 >but the "magic", internal hosts getting external IP outside my control and ignoring the firewall? That's a huge no for me. Are you talking about Tailscale funnel? As for "firewall", you can configure with ACLs which node groups can access which groups and resources/ports. ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-12-10 10:45 >I moved to netbird And achieved what exactly? It's also a VC-backed company. ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-12-10 10:46 I feel like people don't really understand how much "open source self- hosted" stuff is actually created by a VC-backed company. Tailscale people have shown multiple times that they care about community, they even made some changes to improve support for the unofficial Headscale server. ---------------------------------------------------------------------- until0 · 2023-12-10 10:48 Who do you use? ---------------------------------------------------------------------- Eoghann_Irving · 2023-12-10 10:48 Next people are going to be telling me that I'm not truly self-hosting because I pay a company for an internet connection instead of building my own. ---------------------------------------------------------------------- ryukhei · 2023-12-10 10:49 Hello there! I would like to replicate this setup, did you follow any guide in particular? ---------------------------------------------------------------------- StorkReturns · 2023-12-10 11:01 The difference is that there are tons of VPSes (a NAT VPS will cost a few bucks a year), you can use open source code that is transferable between them. If a VPS raises price or goes bust, you can move your VM to a different one. Tailscale is a lock-in. Sure, if they enshitify their product, you can move to a VPS, but I prefer to do it beforehand to save my time and disappointment later on. ---------------------------------------------------------------------- Don_Matis · 2023-12-10 11:06 Yes i saw the ACLs and i get it we can configure rules there, but still it is a managed interface that is not local. As said already, the moment they decide to add a new paragraph on their terms & conditions they can ignore the ACLs and get whatever they like. It is fine if you like it....but allow me to pass and try for find a better solution :) ---------------------------------------------------------------------- TBT_TBT · 2023-12-10 11:12 Copy Pasta doesn’t make it more correct. ---------------------------------------------------------------------- Don_Matis · 2023-12-10 11:13 Started with [https://ubuntu.com/server/docs/wireguard-vpn- site2site](https://ubuntu.com/server/docs/wireguard-vpn-site2site) and few other examples found on the internet Here is the example that i managed to create, a similar config goes to the other two sites to create a three way network. Of course you will need to also open the UDP port on each firewall `[Interface]` `# local` `Address = 192.168.x.x/29` `MTU = 1300` `PostUp = wg set %i private-key /etc/wireguard/%i.key` `ListenPort = 51xxx` `[Peer]` `# site A` `PublicKey = siteA-public-key-here` `AllowedIPs = ,192.168.x.x/29` `Endpoint = external-ip:51xxx` `PersistentKeepalive = 25` `[Peer]` `# zero site` `PublicKey = siteB-public-key-here` `AllowedIPs = ,192.168.x.x/29` `Endpoint = external-ip:51xxx` `PersistentKeepalive = 25` ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-12-10 11:14 It's a virtual interface, that normally works by creating peer-to-peer encrypted connections between your nodes, if they can't communicate directly and can't traverse the NAT, the traffic will go via relay server that is unable to decrypt it because it doesn't have keys to do so. Each node contains a list of nodes that can communicate with it and only the keys required for that communication. You can also use your normal firewall to only allow UDP Tailscale traffic from selected addresses. I believe you can also configure the client to not use relays. You can also host your own coordination server if you don't trust them. ---------------------------------------------------------------------- villan · 2023-12-10 11:14 I don’t think anyone is under the impression that Tailscale is self hosting. People use it because it facilitates other peoples access to your self hosting. I’ve tried a dozen different VPN setups over the years to share services with my family, and they all failed because they were too complicated for the end user. I’m a techie, and I don’t mind the complicated setups.. but I want my mum, dad and 90 year old pop to be able to use this stuff. With tailscale they download it on their device and login.. that’s it. They never need to think about it again. No other setup I managed to build ever came close to be as easy to use for my family as Tailscale. I’d happily pay for it if needed. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-10 11:16 Tailscale STUN and ICE to help two nodes behind NAT establish a *direct* connection to each other, so everything after the initial handshake uses the full bandwidth between those two nodes, without passing through an intermediate server. If you use a VPS the nodes can get out from behind NAT to the VPS but they can't talk to each other. If you establish your own tunnel on the VPS, for each two nodes that you want to talk to each other you will have to establish a different tunnel, that tunnel will share a slice of the VPS total bandwidth, and you will have to juggle authentication keys for each node combination. And that's just simple peer-to-peer connections. If you want to do more advanced routing you're looking at days of poring over WireGuard configs. You can use Headscale to take care of all that, but it's very much not the kind of thing I would want to maintain by hand, even for a small number of devices. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-10 11:17 I can offer you some good home-grown methane. ---------------------------------------------------------------------- TBT_TBT · 2023-12-10 11:19 Using a 3rd party service to enable easy access to your own self hosted stuff is not stopping anyone from „learning about self hosting“. ---------------------------------------------------------------------- Frozen_Gecko · 2023-12-10 11:19 I've seen you around so many subs I lurk in. This is the first time I see any of your comments get downvoted hard, lol. I do agree with you, though, just one thing about headscale. I think it's good to have options. I would recommend wg over hs any day of the week, but it's nice to have an extra option. Although I guess there are more options out there, but still. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-10 11:23 > only depend on an ISP for an internet connection. This is where your argument falls down. Get rid of this dependency, host your own DNS and email, become a registrar while you're at it, run your own power generator, then we'll talk about "true selfhosting". You single out one 3rd-party service while you're undoubtedly using a dozen others as we speak. ---------------------------------------------------------------------- TBT_TBT · 2023-12-10 11:29 Funny the coincidence. Tailscale sent this email titled „Understanding our pricing“ out to its users on 8th of December: „The purpose of this email is to help you understand our pricing so that you can feel confident in Tailscale for the long term. Our Free plan is free forever and does not require a credit card on file, meaning there is no chance for you to get an accidental bill. If you are using Tailscale at work, the Free plan gives you access to most of the available features so you can test anything you need to test before rolling it out to a larger group. You can think of it like a free trial with no end date. The key limit is how many users you can have on the Free plan, which is currently three users. Once you’d like to add more than three users to your Tailscale network, you will need to upgrade to one of our paid plans.“ They get traction with the power users and those users bring it into their workplace where the added features are important. What everybody seems to forget: one user / Tailnet doesn’t really cost Tailscale much at all, the minuscule bit of traffic for doing what it does (negotiating hole punch, NAT traversal, exchanging keys, etc.) doesn’t cost a thing really nowadays. Funnel would cost more traffic, because it uses their servers/traffic but that is not the main use case. So they can afford to give away a generous free tier. Another point: there are several other controller based Wireguard VPNs out there. If they would ever screw their users over, the power users would switch to those options and the shitstorm would be humongous. ---------------------------------------------------------------------- chaplin2 · 2023-12-10 11:31 In the standard solution that I mentioned, you don’t need nat transversal. All nodes make outbound connections to a private vps. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-10 11:33 Depends on what you mean by that. Tailscale doesn't care about the free tier, it's only there to create word of mouth. Their business is built around the paid tiers, which are targeted at companies. Their killer feature is the user accounts and their management; the mesh VPN that the free users are all "wow" about is par for the course on all their plans, not a differentiator. If one day they decided to discontinue the free tier a home user could consider that enshittification but it would not be a change of Tailscale's business model, just a reduced investment in advertising. ---------------------------------------------------------------------- chaplin2 · 2023-12-10 11:35 Nodes VPN into VPS and ping each other there. That’s what I do. It’s very fast, since I selected the VPS server to be in the same city. It’s direct connection speed. ---------------------------------------------------------------------- FrankDarkoYT · 2023-12-10 11:47 Eh, if you get a domain and set up a reverse proxy, sharing a jellyfin server is easy, and you can limit access to specific IP addresses, so as long as you are ready to update it when their ISP gives them a new one they can access. Or passwords on any users so nobody can access your media even if they gain access to the interface (and no management rights for any “show on log in screen” users) ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 11:47 Not the first time. I also got banned from /r/homelab for making such statements and disturbing the peace over there. I agree that headscale is a use case but if you can headscale you can Wireguard too, so there goes the argument. Tailscale is IMHO just a fancy Wireguard client that is run by a VC backed company that has not invented a single thing of what they are using under the hood, and that's a bit sad. You also know that I mostly only help people, but on topics like this I like to argue, and maybe change someones mind and that would be a win in my book. ---------------------------------------------------------------------- 10leej · 2023-12-10 11:49 Just run it on a VPS? Or you know buy an internet connection that allows a static IP then run wireguard on an unblocked port. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 11:54 I think you confuse me with my downvoters. ---------------------------------------------------------------------- DavethegraveHunter · 2023-12-10 12:02 It’s a good thing I have [a great apple pie recipe](https://youtu.be/7s664NsLeFM?si=4V-BSRf08BI9gw64). ---------------------------------------------------------------------- Diablosblizz · 2023-12-10 12:09 Not OP but I paid for the "Lifetime" plan at MXRoute. Been solid for the 1+ years I've been with them. ---------------------------------------------------------------------- ryukhei · 2023-12-10 12:10 Thank you! ---------------------------------------------------------------------- Financial-Issue4226 · 2023-12-10 12:11 I am a Isp. It took 6 months to get asn and Ip4 and Ip6 blocks. As world uses BGP even then you are not self hosted by your own statement. Cogent is one of the worlds largest isp companies primarily from data center to data center. But even they rely on BGP connections of other isp companies ---------------------------------------------------------------------- itsmesid · 2023-12-10 12:17 Hmm . Bandwidth and throughout are gonna be the issue there. ---------------------------------------------------------------------- TheZaxAttax · 2023-12-10 12:18 Offering my specific reason to use Tailscale over the Wireguard on VPS option. In part, I'd like to hear if I'm just not thinking of a better way to get the same performance as my current solution. I use it to stream games from my desktop PC in my apartment to my girlfriend's TV in her apartment. Both have Tailscale installed, and we are both behind CG-NAT, on the same provider even. After the initial DERP server relay, we get a direct connected through each other's ISP internal IPs. I find that the latency is really low this way, as there's no bounces. I think that doing this with Wireguard on a VPS would lead to quite an increase in latency. I'm using Sunshine + Moonlight to do this, and while I have at times requested and received a private IP from my ISP, they keep putting me back on a shared one after a month or so. ---------------------------------------------------------------------- durty_nutrag · 2023-12-10 12:23 >If you are a professional you don't need Tailscale, if you do, you are not a professional. I'll have to strongly agree with this. Never used tailscale, just seems a bit off to me, their business model. ---------------------------------------------------------------------- Legitimate_Farm_3095 · 2023-12-10 12:25 pretty sure there was one recently ---------------------------------------------------------------------- capecodcarl · 2023-12-10 12:29 Working around restrictive firewalls. My BYOD wireless network at work and the guest network at my son's high school both only allow HTTP/HTTPS through on port 80 and 443 TCP respectively and block anything else like the UDP ports that Wireguard uses. I could use OpenVPN on 443/TCP, and do, but Tailscale makes setup simpler since I also run a reverse proxy for public services and have to multiplex access to 443 to get OpenVPN working on the same IP address. Unfortunately my one complaint about Tailscale is I can't find a way to make the Android client start using an exit node automatically and have to select one manually every time it starts so I can tunnel all my Internet traffic, otherwise I can only access my Tailscale nodes and other traffic goes direct. ---------------------------------------------------------------------- Avanchnzel · 2023-12-10 12:40 Aside from headscale, you can also use [Tailnet lock](https://tailscale.com/kb/1226/tailnet-lock/), which requires specific existing machines in your tailnet to sign in new machines. That way een Tailscale (the company) can't add any nodes maliciously to your tailnet. ---------------------------------------------------------------------- Shadowtemplar · 2023-12-10 12:41 Headscale server has its own GUI for managing keys and clients if you choose. Otherwise its CLI based for configuration. The tailscale client for android is open source, the others say that the core code is opensource. ---------------------------------------------------------------------- stringfellow-hawke · 2023-12-10 12:53 Unless you’re writing your own code, everything depends on something. It’s good to note that a solution has a less certain future out of our control, but I suspect most people here are tinkerers and don’t envision their stack never changing, and the prospects of forced change in the future is not a driving concern. If “extreme self hosting” is your thing, that’s cool, but don’t browbeat people who don’t share that view. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 12:54 I'm not missing anything. There is a clear agenda behind Tailscale and it's not long before the free tier is gone and people have to move to the next free thing that they will praise to the heavens, while Wireguard is still here still available for free and open source. I have no problem being condescending on such topics. Anyone using Tailscale that is not behind CGNAT has not understood what the **self** part of **self**hosting means. You included. ---------------------------------------------------------------------- dontquestionmyaction · 2023-12-10 12:56 Tailscale Lock. They literally don't have the keys if you use that, which you should. ---------------------------------------------------------------------- maderfarker8 · 2023-12-10 12:58 You’re still hosting your own content though. Imagine, if Plex disappeared tomorrow, your stuff is still there. ---------------------------------------------------------------------- jeremy_fritzen · 2023-12-10 13:07 From what I know, Tailscale tunnels are P2P and encrypted. Network communications are "direct" and don't go through Tailscal, except at the beginning of the process to know the routes. Am I right? Is it more complicated than that? ---------------------------------------------------------------------- Frozen_Gecko · 2023-12-10 13:07 Yeah people just don't like hearing and seeing things that don't match with their idea's. I imagine that a lot of people here run tailscale and do not like hearing that it's not the end all and be all of solutions out there. Cognitive dissonance and such. ---------------------------------------------------------------------- dontquestionmyaction · 2023-12-10 13:07 Everything depends on something. Doing this no true scotsman BS is majorly annoying. Same fight as the people arguing about a VPS not being real selfhosting. If you're worried, Headscale exists. If Tailscale begins to mess with you, just...switch. Tailscale Lock also changes the network to require signing new nodes into your tailnet, so it's impossible for Tailscale themselves to intercept your traffic. I've yet to find ANYTHING comparable to their stack. I've tried a lot, and none of it worked nearly as well. I may like selfhosting, but my time is also worth something. I could write a custom Wireguard config for every single device, only to end up with a worse result, or I could just not do that and focus on anything else. And no, putting Wireguard on a VPS and connecting everything to that is absolutely not a solution. If that was all people needed, they would *do that*. It's trivial. Tailscale has hole-punching, DERP, ACLs and a lot more. ---------------------------------------------------------------------- Patient-Tech · 2023-12-10 13:19 Luckily there’s things like Zero Tier and a few others that are also available to use. Or, there’s Headscale and you just self host. It’s not quite as slick and frictionless, but we’ll manage. ---------------------------------------------------------------------- Patient-Tech · 2023-12-10 13:20 Get a micro VPS server in the cloud (Google and AWS free tiers might work) and self host away from all corporate entities. ---------------------------------------------------------------------- Patient-Tech · 2023-12-10 13:25 I’d flip them a few bucks for a personal tier. I value their product and convenience. But if they’d expect $10 a month, that’s just too much. There’s other options that I’d migrate to. Kinda like the Evernote fiasco. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 13:25 I find it especially sad because all they do is downvote. They can't even make an argument for their product. If you tell me you need Tailscale because you are behind CGNAT, that's completly fine and valid, but if your argument would be because you could not make Wireguard work and you just picked the next easiest solution that everyone recommended to you, you are bound to hear from me. I want that people become self sufficent and not reliant on big corps. ---------------------------------------------------------------------- ijustlurkhere_ · 2023-12-10 13:34 MXRoute, worth every penny. ---------------------------------------------------------------------- vluhdz · 2023-12-10 13:43 No it is not, but when commenters tell people new to the hobby to just use tailscale and not bother with anything else, that does. ---------------------------------------------------------------------- bytepursuits · 2023-12-10 13:44 > How long do you think before the enshittification kicks off? could be years but it will absolutely happen 100%. ---------------------------------------------------------------------- Oujii · 2023-12-10 13:44 I mean, I don’t host my own network, only the services behind it. ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-10 13:45 It's objectively not self-hosting. How is this even debatable? It's an external proprietary service. You're not hosting it yourself. ---------------------------------------------------------------------- [deleted] · 2023-12-10 13:46 [deleted] ---------------------------------------------------------------------- TBT_TBT · 2023-12-10 13:47 „Self Hosting“ is not a religion where you need to go the hard way out of some wrong sense of „you have to do everything by yourself“. Using what is best and easiest goes a long way for most people. ---------------------------------------------------------------------- bytepursuits · 2023-12-10 13:49 mxroute, some companies are like that - socially responsible. we need more like that. btw - i'm cracking up every time I read the service limits: ``` 2. No marketing. 3. Definitely no unsolicited marketing. 4. No marketing. 5. No marketing. 6. “Cold outreach” is unsolicited marketing, stop trying to trick people by changing the words. ``` also the list of banned networks lol "fuckthesenetworks.sh": https://mxroutedocs.com/presales/networkblocks/ ---------------------------------------------------------------------- Oujii · 2023-12-10 13:49 !remindme 5 years ---------------------------------------------------------------------- ijustlurkhere_ · 2023-12-10 13:52 Lol i love these guys. I'm very tempted to buy a lifetime, but a little apprehensive because i'd have to transfer my current setup over by myself - which is fine, just gotta find the time. But i'm really really glad to be their customer; email is one of the few services that i wouldn't ever want to host myself. ---------------------------------------------------------------------- Cylian91460 · 2023-12-10 13:55 >who use Tailscale are behind CGNAT and can't port forward, True but they should still be able to make holes in the firewall, they can't redirect ( x local port to y port). Also IPv6 does exist (but not in use for obvious reasons) ---------------------------------------------------------------------- Oujii · 2023-12-10 13:55 You always have to trust someone. It’s either your privacy respecting ISP, your definitely not shady VPS provider, a VC backed network controller. Even if you are running your network, someone can always fuck you up. ---------------------------------------------------------------------- Oujii · 2023-12-10 13:58 Gatekeeping has always been the spirit of this sub. Didn’t you know that we only got so far by gatekeeping people here? ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 14:03 I think you did not read the VPS part of my comment. That having a VPS for headscale defeats the purpose of using Tailscale at all and you are better off using just Wireguard. ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-12-10 14:05 That’s the point. **ONLY** and ISP? How about power? How about domain registration? Are you paying your ISP _even more_ for a static IP? How do you solve for inbound traffic, a VPS? Running your own data center and laying your own fiber to the backbone (instead of using a VPS) is self-hosting. So is ripping your DVD collection to a local Samba share and using VLC (instead of using Netflix). Let’s not be too high and mighty here. ---------------------------------------------------------------------- zupobaloop · 2023-12-10 14:07 That's pretty cool. I was just teasing the way we draw somewhat arbitrary lines between what is self hosted and what is facilitated by some corporation. Apparently people do not appreciate it. ---------------------------------------------------------------------- RydRychards · 2023-12-10 14:08 I wonder if using tailscale, headscale and tailnet lock is really simpler than just using wireguard 😅 Is tailnet lock open source? It doesn't say on their homepage and I couldn't find the code ---------------------------------------------------------------------- NotEvenNothing · 2023-12-10 14:11 Headscale looks nice. Another option that I don't see mentioned much is Slack's Nebula (https://github.com/slackhq/nebula). ---------------------------------------------------------------------- Avanchnzel · 2023-12-10 14:13 Tailnet lock is for when you don't want to use headscale and instead rely on the coordination server of Tailscale (the company). It's a feature of the client, and that is open source: [https://github .com/tailscale/tailscale](https://github.com/tailscale/tailscale) ---------------------------------------------------------------------- kagayaki · 2023-12-10 14:14 Tailscale and Headscale are both basically just front ends for WireGuard, so that's another alternative. I setup my stuff using WireGuard on its own before I was aware of Tailscale and it's great. I use it both for a VPN usecase and a reverse proxy use case. Of course, the issue with just WireGuard is that it doesn't scale when you have to deal with multiple users or if you have a lot of flux when it comes to onboarding/offboarding systems. Tailscale/Headscale definitely makes it easier to manage that kind of stuff from what I know of them. ---------------------------------------------------------------------- CactusBoyScout · 2023-12-10 14:16 It’s more about Plex’s massive head start with clients. And overall app quality. ---------------------------------------------------------------------- pandaeye0 · 2023-12-10 14:23 So happen I often come across posts from evernote sub, and I couldn't agree with you more. ---------------------------------------------------------------------- king_hreidmar · 2023-12-10 14:30 Last I checked no support on the tailscale app in IOS of pointing to a self hosted headscale instance. ---------------------------------------------------------------------- Cyberlytical · 2023-12-10 14:40 The only thing I disagree with OP is about using tailscale. We have our homelabs to LEARN, and host cool stuff. But it seems like 90% of this sub doesn't even understand how a VPN works. Everyone is told to use tailscale "cause it just works." If you don't understand how a simple VPN works, you shouldn't be using one, let alone have a 3rd party in control of it. ---------------------------------------------------------------------- tribak · 2023-12-10 14:43 Same with tailscale, all your devices are still there. ---------------------------------------------------------------------- persiusone · 2023-12-10 14:50 It could be. If you have all of the services and infrastructure setup yourself to connect with your client devices, wherever they are, then you don't really need any tier 1 if your clients can still connect. Some of us run our own external networks (optical, wireless, cellular, etc), have private arrangements with others to connect with private peering, and make our services available without any dependencies on the internet. Granted the audience is much smaller and more target specific, but isn't that what self hosting is about too? ---------------------------------------------------------------------- a-mcf · 2023-12-10 14:51 Nebula doesn’t get enough attention. ---------------------------------------------------------------------- Ahrotahntee_ · 2023-12-10 14:52 You can do it now, Tailscale actually went out of their way to support it ---------------------------------------------------------------------- bevdberg · 2023-12-10 14:55 Thank you for your contribution. ---------------------------------------------------------------------- Excellent_Ad3307 · 2023-12-10 14:57 they stated that they decided to open source clients for open source platforms (android, linux), while keeping it closed for proprietary platforms (ios, mac, windows). I forgot the logic behind it, not sure if they even had one. use open source operating systems (???). ---------------------------------------------------------------------- ieatrox · 2023-12-10 14:57 I don’t know Avery but people I trust the opinion of have spoken highly of him since long before tailscale was a thing and from the few things I’ve read on his blog ( https://apenwarr.ca/log/ ) and the way they embrace headscale, I feel like tailscale is one of those unicorns that tries to walk the walk when they talk the talk. Fuck, I’ve got a synology here that’s built entirely on the back of open source, refuses to contribute back, and basically just daring anyone to sue them over it. They got their huge and now the rules don’t apply anymore. Fucking infuriating. ---------------------------------------------------------------------- InfamousAgency6784 · 2023-12-10 14:58 What you said is entirely correct. However there is little you can do when people are happy about a product. What **I** would like to see more in this sub specifically would be a little caveat sentence, or something along those lines, to warn potential users about the fact that you rely on 3rd-party servers with it. Like > From what you describe, I think Tailscale would be a good fit to setup a VPN like what you want. It's not purely self-hosted though: you depend on 3rd party servers to manage the wireguard connections for you but it's free, convenient and there is actually even a self- hosted implementation that exists: headscale. But I know it's a bit long. Might be worth asking a mod to stick a post about it at the top so that people can refer to it. Barred that, yeah people are enthusiastic. It's a really good product that supplements homelabs extremely well. Most of the alternatives I've seen are not there feature-wise and at least two of them have a dreadful code base. That means that unless they go through heavy- handed refactoring pretty soon, those products will die an early death as adding more features will become impossible. ---------------------------------------------------------------------- Initial-Repeat9146 · 2023-12-10 15:00 OP, I get what you're saying but I'm pretty sure people are able to come to their own conclusions and reason the risk. ---------------------------------------------------------------------- laxweasel · 2023-12-10 15:06 I too share concerns that we will see Tailscale go through enshittification (although things like Home Assistant give me hope that it isn't inevitable). However to gatekeep and say it doesn't count as self hosting because you're not owning that piece...eh. There's a space where your home network meets the broader internet that it is inevitable we will be outsourcing to some degree. Are you self hosting if you use let's encrypt? What if you use a third party 2FA? What if you use an email provider or discord or Whatsapp for notifications?What about using Unraid, VMWare, pfSense or Windows? What about the Docker/Dockerhub dust up a while ago? What if you rent a VPS as a bastion host? You don't own that hardware and they could rug pull you any time. Heck the entire Internet as we know it is gatekept by ISPs and companies all of whom are generally profit driven monsters. So beyond developing an alternative, decentralized communications network (and the projects are put there) there will inevitably be an area of "self hosting" that interacts with some form of corporate monster. I think it's healthy to talk about, and you can generally see when companies and services cross over from "generally acceptable compromise" to "out of bounds and doing something invasive" a là Plex. I think it's productive to engage in conversation that encourages more and more control over your own services (run your own router/firewall/DNS, run headscale, unified push services etc). But to gatekeep something that may be key moving someone away from cloud driven services is silly as a community. ---------------------------------------------------------------------- rocketmonkeys · 2023-12-10 15:11 There really should be a website like this that keeps track of popular & useful "free" things, documents the things they promise, and then tracks the date at which they turn into crap. A bit like https://killedbygoogle.com/, but for the enshittification of cloud services. ---------------------------------------------------------------------- sarinkhan · 2023-12-10 15:15 I use tailscale because I managed to set it up. I tried openvpn on my pfsense box, and it had 1 million steps, it didn't work, and I understood nothing of what I did. With tailscale I globally understood what it did, that none of my trafic goes trough their stuff. So I am happy, and it is easy for me to use/deploy. That being said, I do agree that one part of my infrastructure relies on something I can't control. I didn't use wiregard because I am new to opening my homelab, and twingate was what networkchuck made a video on. But I am not opposed to using tailscale or wiregard or whatever. I simply have no clue of the differences between those solutions. I think I want a reverse proxy also to allow some access to external people without having to add them to tailscale. I also take note that some people say you can run headscale to have your own tailscale. As to why one or the other, I have no idea. As for me, if the community vets the security, if it is open source, and works, I am happy. ---------------------------------------------------------------------- onecobra · 2023-12-10 15:18 I agree with your post. If TS does something I don’t like, I’ll go back to basic Wireguard or port forwarding. None of my selfhosted apps are critical, so downtime is fine. It’s a hobby for me and I expect things to break :) ---------------------------------------------------------------------- theonetruelippy · 2023-12-10 15:20 I remember reading an article at the time that suggested that tailscale 'took the money even though they didn't need it', and just kept it as a backstop. That seems either disingenuous or naive, and either way it is a strange way of doing business, assuming that the original article is accurate. ---------------------------------------------------------------------- dakjelle · 2023-12-10 15:25 Most of us is using tailscale because we left something else behind and moved to self-hosted solutions. If tailscale turns "evil" we will leave them to. ---------------------------------------------------------------------- harperthomas · 2023-12-10 15:31 I think the answer is to use whatever you like but always be prepared for it to disappear tomorrow. I will happily use tailscale until one day it will no longer be suitable either due to money or T&C changes and I will change to something else. Its hardly a big issue. ---------------------------------------------------------------------- fellipec · 2023-12-10 15:32 Exactly. And my 2018 TV can install Plex but can't install Jellyfin, so the former works better to me. ---------------------------------------------------------------------- tripazardly · 2023-12-10 15:32 Came here to say exactly this, but also happy cake day! ---------------------------------------------------------------------- fellipec · 2023-12-10 15:33 One thing I don't want to do anymore is to run a mail server. I'm with you on this one ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 15:34 In my own internal network stack? No, I don't have any paid service there outside of my internet gateway and energy company (both of which are at least semi-regulated by the government and do *not* act like a VC backed company). Yes, of course, like everyone else I use paid services for things but I don't think it's particularly interesting or worthy of discussion. ---------------------------------------------------------------------- TheePorkchopExpress · 2023-12-10 15:36 If Plex/jellyfin is the level of complexity we're talking about here, I'm golden. Thanks for the inadvertent boost of confidence. ---------------------------------------------------------------------- Aurailious · 2023-12-10 15:37 This is where I am too. Its easy to use now and I know enough to swap to other's, like tossing in headscale or using plain wireguard. But doing those other things is a bit harder, so like most of my choices with selfhosting its about convenience. ---------------------------------------------------------------------- zrail · 2023-12-10 15:38 The free tier is way more than that. It lets business users (typically an IT department) try it out without getting out a credit card or begging accounting for a purchase order. It also costs close to nothing to run because virtually no traffic transits Tailscale pipes. Everything is peer to peer after the control plane helps the clients negotiate NAT, and if that's impossible traffic is (as far as I understand it) pretty severely throttled. ---------------------------------------------------------------------- Aurailious · 2023-12-10 15:40 Its good enough for me to use, but it still has that feeling of "jank". Its getting better though. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 15:42 I'm not, I can guarantee that. ---------------------------------------------------------------------- isThisRight-- · 2023-12-10 15:43 You’re right, it’s an unpopular opinion. Self-hosted purists, and purists in general are so tiring. We understand that potential pitfalls of using a third party service for anything critical for anything. Is there any room for pragmatism here? ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 15:43 Who knows. A lot of times company founders truly do mean what they say but they're often not there by the time the enshittification happens. Idealistic founders take the company as far as they can but when their board becomes dissatisfied with profitability or investors want to see a return then a changing of the guard happens and suddenly the decision makers aren't as idealistic. ---------------------------------------------------------------------- InfamousAgency6784 · 2023-12-10 15:47 > I'm not missing anything. Sure... > clear agenda behind Tailscale... while Wireguard is still here still available for free and open source. How about you start comparing apples to apples? That would make the first assertion above a bit more reasonable. Tailscale is a management backplane for Wireguard. Wireguard creates VPN tunnels. The difference might look tiny, like the difference between `dhclient` and `wpa_supplicant` but it's huge in practice and explains why people are so enthusiastic about it. In a word without DHCP, having DHCP, albeit a proprietary one, is a big deal. You can say all you want you'll laugh when people can't do DHCP anymore with that provider, with your static IPs all over the place. But unless you only have to manage a couple fixed static machines, with all the main endpoints accessible from the internet already, your static world will crumble and become unmanageable very fast. I'm not sure about the agenda. The risk is real and I do think that it's likely something like that could happen... though it's becoming increasingly harder with `headscale` that just works too. And a risk is a risk. It's your call to take it or not. As I see it, it's a fair bit like running your own DHCP server on your LAN or letting your (proprietary) router do it. One is fully in your hands, you control everything. The other one does the same while being convenient: it's in the router, it's just easy. And while people speak at this level, grumpy you come saying "I use static IPs! Don't rely on that proprietary shit you don't control."... Tailscale fulfills a need, pretending the need does not exist does not come around as "I'm not missing anything" but as "I've missed the whole point". Plus there is a difference treating a risk as a risk and judging people for actions they have not taken. Yep, Tailscale can pull the rug if that makes sense to them at any point, they are a company, they make money (or try to at the very least)... The practice of changing terms to become viable is something all companies do, mostly out of necessity rather than pleasure. It's not good for the customer but the company going bankrupt is not good either... Yep I agree too that this subreddit would become obnoxiously loud for a while even if it shouldn't in principle, so I'll just mute it for a couple months. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-10 15:47 So using paid services instead of selfhosting is not worthy of discussion, but using Tailscale *for free* is not "real selfhosting" and somehow shilling? Pray tell, what are Tailscale posts even shilling for? Home users in /r/selfhosted will never pay $6/mo for it no matter how useful it is, nevermind the more expensive tiers. And if you're the kind of professional working for a company that would be interested in Tailscale you hang out in /r/sysadmin not here. ---------------------------------------------------------------------- katatondzsentri · 2023-12-10 15:47 Tailscale is also convenient. I have services published, containers with client baked in, etc, etc. If they start to charge, I'll just revert to openvpn as it was before tailscale and swallow the maintenance cost as before. Until that happens - I'm good, thanks ---------------------------------------------------------------------- fellipec · 2023-12-10 15:47 Is kind of renting a computer inside a datacentre. Not "self" in the sense the computer is yours (is rented) but "self" in the sense you do what you install and configure this computer (or better, virtual machine) as you please. IMHO is a good compromise and not expensive, some are 3 bucks a month ---------------------------------------------------------------------- bigmanbananas · 2023-12-10 15:48 Ahh, reddit. A place where no one is happy to let people just be what they want. So self-hostung doesn't exist if you are using the Internet because you are using someone else's infrastructure Well done. ---------------------------------------------------------------------- r3tryfail · 2023-12-10 15:51 block people after you reply like a fucking baby. Goddamn worthless users ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 15:51 Are you running the Wireguard server at home opening a port at your house for it which would be opposite of what I'm doing and that's why CGNAT is an issue? Just trying to make sense out of the comments about CGNAT in these threads. I don't use Tailscale, I use Wireguard and a VPS. I see people say they have issues with Wireguard and CGNAT which always puzzles me since I use AT&T Fiber yet have zero issues with Wireguard. My home machines connect to my VPS (Oracle Cloud) where I run Wireguard, traffic coming in from the Internet to the VPS is routed by Wireguard automatically to my home instances. Or is it a limitation of Tailscale's Wireguard use that has issues with CGNAT? ---------------------------------------------------------------------- jwink3101 · 2023-12-10 15:52 What is the difference between something like this and FRP? ---------------------------------------------------------------------- InfamousAgency6784 · 2023-12-10 15:52 The TL;DR is "you can replicate everything that tailscale does manually stitching everything by yourself" or you can use Tailscale (with or without Headscale)... They do no magic but they provide all the right bits in the right place for you: you have one service to manage everywhere instead of literally half a dozen that you have to keep in sync yourself. ---------------------------------------------------------------------- jmeador42 · 2023-12-10 15:58 This is why I’ve always preferred Nebula. https://github.com/slackhq/nebula ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 15:58 I use a VPS, traffic goes to the VPS, Wireguard running on the VPS is routed to my home machine which runs all my services and then back out on the public VPS IP. My home machine is the "server" in the context of providing services and the VPS is the "server" in the context of running Wireguard that the home machine connects to. The home machine can be moved across the country, booted and it establishes a connection to the VPS Wireguard and starts receiving traffic. To the public, the IP never changes. ---------------------------------------------------------------------- cdhowie · 2023-12-10 16:03 Agreed. I was looking for something like this to replace hand-edited Wireguard configurations and finally found Nebula. We've been using it across our server fleet and it's fantastic. The built-in firewall is amazing and allows us to issue a certificate to all developers to have ssh access across the fleet without having to worry that they have direct access to internal service ports. ---------------------------------------------------------------------- BitterSparklingChees · 2023-12-10 16:07 I'm not sure what you mean about shilling, I'm not accusing anyone of that. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:08 AT&T Fiber uses CGNAT and there are people exposing Wireguard apparently without issue: https://www.reddit.com/r/WireGuard/comments/pc0p8k/does_wireguard_get_ blocked_by_att/ https://www.reddit.com/r/WireGuard/comments/rmw43p/can_wireguard_effec tively_bypass_a_cgnat/ https://www.reddit.com/r/HomeNetworking/comments/cx1rl3/i_am_on_carrie rgrade_nat_cgn_and_port_forwarding/ Maybe some ISP's who use CGNAT are doing port blocking but it doesn't seem to be a specific issue with CGNAT or not all CGNAT implementations. ---------------------------------------------------------------------- jmeador42 · 2023-12-10 16:08 Not unless you’re self hosting headscale, you’re reliant upon Tailscales relay servers. ---------------------------------------------------------------------- tribak · 2023-12-10 16:09 You may have answered the wrong person, but I agree, if you use the self hosted solution you keep your devices and your vpn ---------------------------------------------------------------------- dralth · 2023-12-10 16:10 After this and the recent Plex post, I appreciate that much of what this sub offers is awareness. For each service, we choose to self host or leverage third parties to varying amounts. One saying they would never self host email AND that you won’t rely on 3rd party infra for VPN, does not imply hypocrisy. Each service is different in its criticality to the individual, vulnerability to privacy concerns, etc, and we all make compromises where we are individually comfortable doing so. I’m glad that this sub creates the awareness for us to each make these decisions for ourselves. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:12 Why do people keep insisting CGNAT interferes with selfhosting? I've been using AT&T for more than 2 years, they use CGNAT, no issues here. https://www.reddit.com/r/selfhosted/comments/18evofr/comment/kcs1hmp/? utm_source=share&utm_medium=web2x&context=3 ---------------------------------------------------------------------- lemniskegg · 2023-12-10 16:12 That's new to me, but my ISP doesn't seem to implement it :( ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:15 I have nothing against Tailscale. I selfhost to control my destiny as much as possible. I use a public (free with Oracle Cloud, BTW) VPS running the Wireguard server and my home client (which is the server) runs all my services. No third party is involved. ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-10 16:20 You can be whatever you want, but Tailscale is *objectively* not self- hosted. Facts are facts. I don't know what you want from me, and I don't understand why this bothers you so much. Netflix isn't self-hosted. Gmail isn't self-hosted. Nobody takes issue when your say these obvious things. But you say Tailscale isn't self- hosted, an objectively and demonstrably true statement, and a bunch of people here get upset. I genuinely don't get it. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:23 I do all of that with Wireguard and a VPS, I do the config files myself using my brain but I 100% control it all. Tailscale might make it easy but that's all it adds. Tailscale is not needed. ---------------------------------------------------------------------- bigmanbananas · 2023-12-10 16:24 Great. Let people be people then. No-one is 100% so let's not.be dicks about it. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:25 Incorrect. Zero issues here using Wireguard and a free public VPS (Oracle Cloud). ---------------------------------------------------------------------- didact · 2023-12-10 16:27 These are all VPN solutions leveraging wireguard, they wouldn't supplant the need for load balancing and presentation via reverse proxy - I would think you always need that for sanity's sake. ---------------------------------------------------------------------- ashebanow · 2023-12-10 16:31 Good point, but even when you write your own code you are still dependent on others. Your OS, the software in your routers and switches, etc. It's pretty much impossible not to be dependent these days. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 16:32 Netflix is convinent too, so is Azure or AWS. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:34 Tailscale DERP doesn't have a bandwidth cap? That's nice, I will still use a VPS I 100% control. Oracle Cloud gives me 10TB bandwidth for free. ---------------------------------------------------------------------- m00ph · 2023-12-10 16:34 I mean, Slack free tier is still decent. So it can last. ---------------------------------------------------------------------- fab_space · 2023-12-10 16:38 it’s like cloudflare but.. with less independent auditing and compliance assessments then it’s less secure especially in the SaaS flavor. ---------------------------------------------------------------------- itsmesid · 2023-12-10 16:39 Oracle is not the one I recommend ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-10 16:44 Which post had anybody being a dick about it? ---------------------------------------------------------------------- Ejz9 · 2023-12-10 16:48 Indeed. This is not the first post about Tailscale on this sub. But it still feels like a fear monger to an open source service. Also, although if they ever chose to go back on their word, this is not a lose data scenario. You just have to switch the VPN client on your devices. Which should not be an issue considering you have them self hosted on your premises etc if that’s the central idea of it. Self hosting has so many definitions though. Also Tailscale just gets praise cause they are that good. If a user isn’t knowledgeable of these risks with a service like this either; I’d have to question how they got into hosting things themselves. Plus if I remember right when using the free tier, you do not have to put in card info so they technically can’t auto charge you nor could they without you agreeing to a new contract. Many people will pay for Tailscale too and you can vouch for the idea “what if they get compromised” well if you’re thinking of that you know your risks. Everyone should understand the data they put in places, tailscale has made it though where your talent can’t be initially just jumped into by a malicious user but you have to go and enable these things. OP, it’s not a bad post. I just hate how much I have seen it and don’t like fear mongering regardless how subtle. (Maybe I’m just tripping though too) ---------------------------------------------------------------------- didact · 2023-12-10 16:49 Sounds like a bunch of your pain points are just related to needing an online CA or ICA. But, looking through the Nebula docs I don't know that it supports things like CRL addresses where you could host the CRL, or OCSP responders. Someone got support for an OCSP responder but never submitted a PR with completed code: https://github.com/slackhq/nebula/issues/72 Also, I see the HSM feature request is just sitting there for the last 3 years: https://github.com/slackhq/nebula/issues/328 - that would be the piece that would give you an unstealable private key without airgapping. ---------------------------------------------------------------------- Decent-Finish-2585 · 2023-12-10 16:52 6 months feels blazing fast, nice work. It’s been a while for me, but it took me over a year to do the same. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:53 This is what I do: ``` # # Client (the actual self-host local server) # [Interface] ## This Desktop/client's private key ## PrivateKey = ## Client ip address ## Address = 10.10.123.2/24 [Peer] ## Ubuntu 20.04 server public key ## PublicKey = ## set ACL ## #AllowedIPs = 10.10.123.0/24 # setting to 0.0.0.0/0 routes all outbound through the vpn and out the public vps AllowedIPs = 0.0.0.0/0 ## Your Ubuntu 20.04 LTS server's public IPv4/IPv6 address and port ## Endpoint = :12345 ## Key connection alive ## PersistentKeepalive = 15 ``` ``` # # Server (in the Wireguard context, exposed to the Internet), public VPS, for example # [Interface] ## My VPN server private IP address ## Address = 10.10.123.1/24 ## My VPN server port ## ListenPort = 12345 ## VPN server's private key i.e. /etc/wireguard/privatekey ## PrivateKey = # Route any desired ports, these are the ones I route to my "client" which is the "server" which runs my services: PostUp = iptables -i eth0 -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.10.123.2 PostUp = iptables -i eth0 -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to-destination 10.10.123.2 PostUp = iptables -i eth0 -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.10.123.2 PostUp = iptables -i eth0 -t nat -A PREROUTING -p tcp --dport 465 -j DNAT --to-destination 10.10.123.2 PostUp = iptables -i eth0 -t nat -A PREROUTING -p tcp --dport 993 -j DNAT --to-destination 10.10.123.2 PostUp = iptables -i eth0 -t nat -A PREROUTING -p tcp --dport 995 -j DNAT --to-destination 10.10.123.2 PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -i eth0 -t nat -D PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.10.123.2 PostDown = iptables -i eth0 -t nat -D PREROUTING -p tcp --dport 25 -j DNAT --to-destination 10.10.123.2 PostDown = iptables -i eth0 -t nat -D PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.10.123.2 PostDown = iptables -i eth0 -t nat -D PREROUTING -p tcp --dport 465 -j DNAT --to-destination 10.10.123.2 PostDown = iptables -i eth0 -t nat -D PREROUTING -p tcp --dport 993 -j DNAT --to-destination 10.10.123.2 PostDown = iptables -i eth0 -t nat -D PREROUTING -p tcp --dport 995 -j DNAT --to-destination 10.10.123.2 PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE [Peer] ## Desktop/client VPN public key ## PublicKey = ## client VPN IP address (note the /32 subnet) ## AllowedIPs = 10.10.123.2/32 # Add any more peers if desired. ``` ``` # # Server - Ensure these are set in the server if using Ubuntu ufw firewall (or similar?) # Anywhere on ens3 ALLOW FWD Anywhere on wg0 Anywhere on wg0 ALLOW FWD Anywhere on ens3 Anywhere on wg0 ALLOW FWD Anywhere on wg0 Anywhere (v6) on ens3 ALLOW FWD Anywhere (v6) on wg0 Anywhere (v6) on wg0 ALLOW FWD Anywhere (v6) on ens3 Anywhere (v6) on wg0 ALLOW FWD Anywhere (v6) on wg0 ``` ``` # # Server - Ensure ipv4 routing is on (and ipv6 if you're using it) # # In /etc/sysctl.conf net.ipv4.ip_forward=1 # Then run "sysctl -p". ``` ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 16:55 OK. It's the one I recommend, so far, works great. ---------------------------------------------------------------------- AviationAtom · 2023-12-10 16:57 One of the Slack Nebula devs commented on a Hacker News article before, IIRC. He touched on them having an internal deployment framework that they use, when someone pointed on the pain points of administering Nebula. ---------------------------------------------------------------------- brianly · 2023-12-10 16:57 The “critical piece of infrastructure” gives me some comfort. The vast majority of VC-funded companies are not even close to being critical for their niche never mind an infrastructure component. Caution is still warranted for any selfhoster that is motivated by independence, openness etc. again, this being critical infra means there are great alternatives. The positive posts are at least partly from the segment of people without significant networking experience. I know and have worked with a ton of devs who are not particularly keen on networking yet are comfortable with lots of other server stuff. They see products like this and are delighted. Arguably it’s safer for them to be using TS than deploying but not maintaining something else. ---------------------------------------------------------------------- AviationAtom · 2023-12-10 16:58 I think the big issue is darned near every device and service opens up a path inbound to your network these days ---------------------------------------------------------------------- MonkAndCanatella · 2023-12-10 17:02 Seems legit. Lifetime for $129 includes unlimited domains and email addresses, and 10gb storage (which is more than enough for email). This would allow you to spin your own fastemail type thing where you can make a separate email for every service, hiding your actual inbox. ---------------------------------------------------------------------- TheReverend403 · 2023-12-10 17:04 > That's what happened on r/homelab where they banned me for saying you can't compare podman/docker to k8s I'm sure it had nothing to do with your general attitude towards other people... ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-12-10 17:09 I’d go as far as saying that SINCE they’re vc funded. You can absolutely expect them to force profits eventually. ---------------------------------------------------------------------- Sir_JackMiHoff · 2023-12-10 17:11 [https://tailscale.com/compare/wireguard/](https://tailscale.com/compa re/wireguard/) Tailscale has a good blog post explaining the differences between their additions and base wireguard. There are scenarios where tailscale will act as a relay of encrypted messages, but private keys are only client side (the client is open source) so tailscale is unable to decrypt the messages. I'm guessing if you didn't need this feature you could disable it and tailscale will only resort to relaying if other more direct routes are unavailable. ---------------------------------------------------------------------- mrpink57 · 2023-12-10 17:16 It is in iOS settings. https://github.com/juanfont/headscale/blob/main/docs/iOS-client.md ---------------------------------------------------------------------- primalbluewolf · 2023-12-10 17:20 I like the file names, but the "no refunds" post confirms that they aren't a company I've any interest in doing business with. Such signage is not legal here. ---------------------------------------------------------------------- primalbluewolf · 2023-12-10 17:22 >. And my 2018 TV can install Plex but can't install Jellyfin What sort of TV do you have? ---------------------------------------------------------------------- Patient-Tech · 2023-12-10 17:26 Most VPS’s have bandwidth caps. At least the lower priced ones do. Tailscale avoids being a middleman. Besides, I don’t have to deal with authentication and keys and all that. So I like it for what it does. ---------------------------------------------------------------------- primalbluewolf · 2023-12-10 17:27 > pfSense or Windows? Why would pfsense or Windows not count as self hosting? ---------------------------------------------------------------------- cdhowie · 2023-12-10 17:28 OCSP support would be nice. For now we just use Puppet-generated Nebula configs, so I can update the certificate blacklist on the Puppetmaster and know that it will replicate to the hosts soon. HSM would be nice to protect the private key, but doesn't protect against the creation of malicious signatures. Right now we just secure communication for ephemeral hosts differently (via TLS primarily). ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 17:29 Attitude doesn't matter. If you don't like it, don't read it. People don't have to bend to your will or your moral compas. ---------------------------------------------------------------------- ElGatoPanzon · 2023-12-10 17:29 My home network is behind an odd setup where every outgoing connection comes from a different ip in all sorts of ranges. I was able to collect a list of them, there's about 10 different ones before it starts reusing previous ones. Port forwarding on my side didn't allow access through any of those IPs, which I expected honestly. Because of that I couldn't simply use Wireguard to a vps when the vps couldn't access my home network. I also didn't want to use Tailscale. In the end I setup a hybrid homelab which connects a local gateway with a remote one over an OpenVPN connection, then connected a bunch of local server nodes and remote vps nodes with Wireguard. ---------------------------------------------------------------------- TheReverend403 · 2023-12-10 17:32 We don't need a lot of things but we still use them because it makes things easier. Imagine if we applied your logic to DNS. > I do all of that with a notepad and pen, I write the IPs down myself using my brain but I 100% control it all. DNS might make it easy but that's all it adds. DNS is not needed. ---------------------------------------------------------------------- Bruceshadow · 2023-12-10 17:34 well said ---------------------------------------------------------------------- laxweasel · 2023-12-10 17:46 It's in the vein of "you don't totally control this software supply chain so they could screw you and change the TOS at any time" Technically true (pfSense just did some licensing shenanigans) but was more to illustrate the point that you will likely at some point compromise with how much of the software/infrastructure supply chain you control...and that doesn't make it "not self hosting" but rather just means it comes with caveats. ---------------------------------------------------------------------- GenerousAccord · 2023-12-10 17:57 Hopefully the selfhosted moderators will look into why my honest, polite and true comment was downvoted. ---------------------------------------------------------------------- 64mb · 2023-12-10 18:04 You’re not a true self hoster unless you mine your own copper and gold to build your own servers. ---------------------------------------------------------------------- Znomon · 2023-12-10 18:14 This is it for me. Friends and family can download the app on their old Playstation, new consoles, phones, roku, Android TV, tablets, smart TVs. Basically anyhring. There is a lot of value in that, I'd love to leave plex, but I haven't found an alternative with even half the app support. ---------------------------------------------------------------------- uberbewb · 2023-12-10 18:18 Honestly, the setup for opnsense and Wireguard is simple enough this is pointless software. At first it can seem complicated, but once you see how to setup the config files it's as easy as changing out a few keys. ---------------------------------------------------------------------- jschwalbe · 2023-12-10 18:31 I don't see why you couldn't use wireguard to a VPS as your sole VPN. I used to be behind a CG-NAT (which sounds like your case). As long as the VPS doesn't change IPs (why would it?) you can connect from your home server to the VPS over wireguard. If you're on your phone, you connect to the VPS also, and it routes you into your home network. ---------------------------------------------------------------------- ElGatoPanzon · 2023-12-10 19:04 I thought that Wireguard config on each side had to know the ip of each? ---------------------------------------------------------------------- jschwalbe · 2023-12-10 19:06 Nope. Otherwise you’d never be able to connect as a “road warrior”. That may be true of other vpns, but not WireGuard, so long as one side remains the same. ---------------------------------------------------------------------- g0dSamnit · 2023-12-10 19:09 If/when you need to switch, you've only "wasted" a mere few minutes (if even) setting up Tailscale. Nothing compared to the time sink of keeping your own WG instance maintained, etc. So I guess anytime it's recommended, the caveat of potentially having to switch solutions in the future needs to be mentioned. But arguably, self-hosted software can have this issue too, if something is no longer maintained and encounters serious vulnerabilities. ---------------------------------------------------------------------- Evajellyfish · 2023-12-10 19:22 no no you're thinking of VLC ---------------------------------------------------------------------- ElGatoPanzon · 2023-12-10 19:25 I'll have to try a configuration like that. I only know how to setup site-to-site. Thanks ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-12-10 19:26 Cloudflare decrypts your traffic on the edge, Tailscale doesn't hold the keys needed to decrypt anything, the communication can be purely peer-to-peer and if it's not, it's still being forwarded in an encrypted state. Headscale also exists, which lets you use 100% self- hosted Tailscale infrastructure. ---------------------------------------------------------------------- VE3VVS · 2023-12-10 20:06 When you say: Nebula doesn’t get enough attention Is that in development or use, I was looking at it to implement on my system, was just curious as to you thoughts ---------------------------------------------------------------------- DazzlingTap2 · 2023-12-10 20:13 Port forwarding + reverse proxy and you're good to go, or vpn to a free oracle vps and route traffic that way if you have cgnat or live in a dorm. I'd think for plex it sharing for remote access would be similar but youd reverse proxy a different port (32400), or is there something special about plex that allows easy access? Also a hot take about clients. A firetv, chromecast or android TV is C$30-$70 depending on sale, features, specs while plex premium is C$160. And that box would be able to use smarttubenext, kodi, a wide range of p!rcy friendly apps, a real browser with ublock and many android apps, which is likely not available with a smart TV. My not so hot take is that you could install both plex and jellyfin, plex for direct play on smart TV and jellyfin for transcoding and mobile playing. And use trakt to sync the watch progress. ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-12-10 20:41 That’s a great point, initial setup and getting it working is one thing but long term maintenance is quite another - much more complex/ difficult. ---------------------------------------------------------------------- betahost · 2023-12-10 20:41 https://github.com/juanfont/headscale not to mention but Tailscale has a very good culture, I’m sure they would give notice if they pull the rug. There are also many alternatives such as Zerotier and more are showing up every day and open source options. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-12-10 20:47 But the benefit of Tailscale / Headscale / Netmaker is it creates a mesh for you, and automates ongoing config management. Obviously that's not critical to everybody, but I have a dozen VPS distributed across OCI and Azure, and Tailscale (and similar apps, such as Netmaker) make it a breeze to stand up a mesh. To achieve this with vanilla wireguard is akin to being into BDSM... if its your kink, go for it. To the OP's point though, yes this will come to an end one day. ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-12-10 20:58 Tailscale itself is not self-hosted, no. The point is your phrasing was such to imply that any self-hoster using Tailscale is somehow invalid or doing it wrong. ---------------------------------------------------------------------- didact · 2023-12-10 21:19 Got it, you're after more than just securing the private key on that front. Do you trust your idp? Would you trust if both your deployment pipeline and puppet both told you that a host needs a signed Nebula cert? Pretty straightforward if you've got something you can actually trust to hit most of the points you need for ephemeral hosts with near-airgap... ---------------------------------------------------------------------- laxweasel · 2023-12-10 21:19 Agreed, I feel like if/when Tailscale does something crappy, then absolutely call them on the carpet. But there are plenty of companies with open source/built on open source projects that seem to have not screwed up yet (Proxmox, Home Assistant, Nextcloud). Save the ire for things that deserve it like Plex switching to needing central authentication then monitoring it the usage on *your home server*, pfSense pushing the Homelab license then rug pulling it (among many other transgressions) or any of the other *actual* enshittification examples. ---------------------------------------------------------------------- send_me_a_naked_pic · 2023-12-10 21:35 > you could install both plex and jellyfin I've never thought about this but I could try. I don't know if there are downsides though. ---------------------------------------------------------------------- Yankluf · 2023-12-10 21:40 👌🏻✨ ---------------------------------------------------------------------- hereisjames · 2023-12-10 22:10 Two Wireguard-based alternatives to Tailscale/Headscale which you can self host : Netmaker (https://www.netmaker.io/) Netbird (https://netbird.io/) I slightly prefer Netbird since they added SSH support, but really they're fairly similar for the moment. Netmaker will draw an overlay topology diagram, which is helpful if your setup is partially meshed and you need to visualise it. They also both have fairly generous managed SaaS tiers that will cover most homelabs, if you don't want to self host the management layer to start. If you prefer Nebula there's also a managed SaaS offering for that : Defined Networking (https://www.defined.net/) Generally I try out the SaaS version and see if I like it, then migrate to self hosted if I do. ---------------------------------------------------------------------- thehoffau · 2023-12-10 22:11 I run this too. Use my own DERP server and disabled all the tail scale ones. Yup it's a slight pain but I get what I want and the latency profiles I want and don't have to use wireguard. ---------------------------------------------------------------------- thehoffau · 2023-12-10 22:12 Slack is owned by salesforce.. so same problem as OP, a change in the organisation and could be stuck.. ---------------------------------------------------------------------- sir_dancealot · 2023-12-10 22:16 yeah people are underestimating how the free tier costs Tailscale basically nothing because only the key coordination actually runs in tailscale’s servers ---------------------------------------------------------------------- Critical-Rhubarb-730 · 2023-12-10 22:41 Being critical is always a smart way to choose software solutions. But in this case you can go selfhosted with the completely free headscale open source version Part of being critical is doing your homework. ---------------------------------------------------------------------- fellipec · 2023-12-10 23:00 LG with WebOS. Just one version before the one supported by Jellyfin. ---------------------------------------------------------------------- a-mcf · 2023-12-10 23:26 First, let’s get it out of the way that Tailscale is easier, and has more features. What I like about Nebula is that your external hosts, the lighthouses, don’t control access. Rather access is controlled via PKI. A hosts group is baked into its certificate and inbound firewall rules are in the nebula configuration file. You get distributed network access but no central host handling the entire control plane to worry about. You DO get to worry about PKI though, and it doesn’t do things like handle DNS on mobile. That said, I found the battery life on iOS to be much better than Tailscale. Defined networking does have some cloud hosted control plane stuff but I haven’t really looked into it. ---------------------------------------------------------------------- VE3VVS · 2023-12-10 23:34 Thanks thats quite a good write up. The one thing I liked about was the lighthouse concept. As they are external and have nothing to do with authentication its one less thing to worry about. ---------------------------------------------------------------------- ripnetuk · 2023-12-10 23:39 To misquote Nabulungi, tailscale isn't a product, it is an idea. It works brilliantly for me, and I trust that if they do do the dirty on me (as in charge me more than Netflix costs), there will be half a dozen self hosted and free alternatives which work as well (which is a high bar, hence my love for.it ATM). At the very least, it solves a problem that I could solve myself with dozens of wireguard.conf files, but my interest ATM isn't this, I'm playing with other nerd toys, and this just makes it easier. ---------------------------------------------------------------------- JollyRoger8X · 2023-12-11 00:21 > If there's one thing that we should all already know about VC funded internet startups, it's that they can and will pull the rug from underneath you Sure, but then you just use some other solution, which often won't be as easy to setup and use. That's not much of a big deal, really. ---------------------------------------------------------------------- DazzlingTap2 · 2023-12-11 00:53 Well the only downside would be you have to manage 2 services instead of 1. Same goes for your users. I heard online you could use trakt sync or other sync scripts to sync you and your users watch data between plex and jellyfin. Plex and jellyfin might also display, manage your media differently. ---------------------------------------------------------------------- anderspitman · 2023-12-11 01:02 Nebula doesn't use WireGuard ---------------------------------------------------------------------- didact · 2023-12-11 01:05 Fixed ---------------------------------------------------------------------- primalbluewolf · 2023-12-11 02:19 [https://jellyfin.org/posts/webos- july2022/](https://jellyfin.org/posts/webos-july2022/) apparently WebOS 2, 3, 4 and 5 do support Jellyfin, but not the version on the store. You'd have to download it and manually install it. Unless 2018 means WebOS version 1, in which case you are out of luck :/ ---------------------------------------------------------------------- fellipec · 2023-12-11 02:40 Yeah I saw that, and tried to manually download and find a difficult I don't remember now, but instead of messing with something to sideload it, I went with plex,because it is on store and I don't need to do anything non standard on the TV ---------------------------------------------------------------------- Brave-Film9475 · 2023-12-11 02:47 I’m surprise that no one mention about Zerotier. I don’t understand why people don’t use it. It is fully open source ---------------------------------------------------------------------- primalbluewolf · 2023-12-11 03:04 Fair. I've not tried to play with webOS before, no idea if it's supposed to be hard or not. ---------------------------------------------------------------------- dungta0321 · 2023-12-11 03:25 nebula has lest features than headscale ---------------------------------------------------------------------- Stuffinator · 2023-12-11 08:16 Hm I wouldn't compare the two. Plex technically only knows about my viewing and listening habits. I don't have any qualms with that and I doubt many people do. Tailscale and cloudflare are on a different level, because the information that travels through them is on a way different scale and also has lots of security implications. ---------------------------------------------------------------------- Impressive-Self9135 · 2023-12-11 08:19 What will you say about ZeroTier? ---------------------------------------------------------------------- freedomlinux · 2023-12-11 09:06 Don't know why, but I assumed it would be [this musical version](https://www.youtube.com/watch?v=zSgiXGELjbc) of the same scene. ---------------------------------------------------------------------- DidQ · 2023-12-11 09:36 But Nebula is shared under MIT licence, so if they would like to change something there, it can be just forked and developed independently of Salesforce. ---------------------------------------------------------------------- InfamousAgency6784 · 2023-12-11 10:24 > I found the battery life on iOS to be much better than Tailscale Yes, they have a very big problem on that front. Their mobile apps don't use the mobile OSes' native event system yet **and** there are "silly" bugs like Tailscale sending handshakes forever when the phone says it should have connection but it doesn't (or it's very unreliable). Also the Android app really is shit UI- and UX-wise. --- I had heard about Nebula before but never really had a look (because, AFAIK, not based on wireguard and PKI is what IPsec/OpenVPN/you-name- it use) and performance don't look stellar (though they might be enough for lots of use-cases, including mine!). The code base looks very decent too. But where Nebula "fails" for most home-labers, is when one needs to change the rules (like "my HTPC now serves my files over Jellyfin, let's make that accessible to my laptops and NAS"). Again AFAIK, this would require recreating CAs with different groups and redeploy everything. I'm not sure how the old certs are managed then (does Nebula maintain a blacklist? or is it just safer to restart from a brand new certificate each time you redeploy?). At any rate, Nebula looks pretty perfect in situations where people deploy their infra instead of growing it organically. And home-labers tend to belong to the second group. Also, your ACL list, in Tailscale/Headscale, can be readily put on git and deployed as needed. Again AFAIK, you'll have to come up with your own solution with Nebula. ^ Any of this can turn out wrong: that's what I have gathered and in my opinion why Nebula has not taken off as a home-lab network backplane. But I'm happy to be told I was wrong and learn more about Nebula! ---------------------------------------------------------------------- DavethegraveHunter · 2023-12-11 10:57 I was thinking of melodysheep when I wrote the comment, if that counts. 🤣 ---------------------------------------------------------------------- [deleted] · 2023-12-11 11:03 [deleted] ---------------------------------------------------------------------- midcoast207 · 2023-12-11 11:57 RMS has entered the chat. ---------------------------------------------------------------------- ithakaa · 2023-12-11 12:03 Headscale ---------------------------------------------------------------------- chic_luke · 2023-12-11 16:12 True, but sometimes it's about what you can do. For example, if you are stuck under CGNAT - what are your options? Paying for a remote server to do the VPN yourself? Paying for your ISP to give you a static IP and put you out of the CGNAT? For a lot of people, Tailscale is actually a very good middle ground. It's **incomparable** to not self-hosting at all, and often the practical solution to get your feet in the water, or begin building your homelab on a limited budget. ---------------------------------------------------------------------- vnprc · 2023-12-11 17:03 They slurp up your metadata. No telling how they will decide to profit from it in the future, or even whether they already are. ---------------------------------------------------------------------- shenanigansbud · 2023-12-11 21:27 Yeah I have run plain Wireguard, but I have a life and Tailscale simplifies the process immensely. I think the part we miss sometimes is also the learning aspect, and the novelty of trying other services (like zerotier or netbird) ---------------------------------------------------------------------- Financial-Issue4226 · 2023-12-11 21:52 Ip4 space was the hardest to get but once had my Ip6 was able to get it much quicker. Then was able to get 5 digits asn. Still debating if sell my original but as 7 digits has no value on marketplace The Ip4 address are getting vary expensive. ---------------------------------------------------------------------- k2kuke · 2023-12-12 03:41 U/ElevenNotes is fully whack and just searching for self validation without any of the work. Wonder if he is the type of senior who just talks shit even if the junior did a better job than he could. He asked for actual reasoning and discussion but outright just says that he will ban everyone commenting at him and that was all fhe reasoning he was waiting for. Pathetic. ---------------------------------------------------------------------- k2kuke · 2023-12-12 03:43 U/ElevenNotes is fully whack and just searching for self validation without any of the work. Wonder if he is the type of senior who just talks shit even if the junior did a better job than he could. He asked for actual reasoning and discussion but outright just says that he will ban everyone commenting at him and that was all fhe reasoning he was waiting for. Pathetic. ---------------------------------------------------------------------- king_hreidmar · 2023-12-12 15:31 Thanks. For the heads up. It was t long ago there was a super long GitHub thread where tailscale devs were saying that the UX experience was why they didn’t want to add an option for custom control servers. Folks even suggested they use a hidden menu. I was tracking that a long while and eventually gave up. Glad to see it’s finally supported