I do more or less exactly this.

CloudFlare domain that has a bunch of listings which point to my reverse proxy, which is only available via Tailscale.

I then share that proxy node and a TSIDP node with the tailnets of my "users" (this avoids the user limit, they don't have to switch between tailnets, and I don't need to share a new machine wherever I add a new app)

They go to the public URL of a given app > CloudFlare sends them to the proxy > they authenticate via TSIDP > and are auto logged into the app.

So far, works pretty well.

I had the same concern and posted on reddit about it long ago before deleting my reddit. Basically chose github at sign up as I didn't even know what OIDC was at the time. Then built a whole network around it with github as a single point of failure. There's no way to migrate it to another sign in method. Email sign up is not offered. The reasoning from Tailscale is that then they need to manage the whole extra user identification thing as well. Anyway this is old but the solution is either tear down the network and start again with OIDC (can use codeberg for that). Or if like me that means reconfiguring 40 docker containers and a whole network built around the magic dns there is another option. You need to login and add another user and give that user admin rights as well. I ended up adding that and then setting it up so they can sign in using yubikey. Tailscale recommend doing this regardless.

We run a headscale service that exposes a magic dns for the tailscale clients. Everything that needs to be reachable gets an entry in a static ip table with names {service}.ts.example.com resolved by headscale's magic DNS. Everything is accessible in the tailscale network and nothing from outside of it.

We did not enable https for inside the TS network since it's all wireguard anyhow.

nah its ok to be condessending thats what i get for being lazy lol thanks for the in depth explanation

Obligatory just search it bro.

But anyway, I guess everyone starts somewhere. So I'll try my best to give you a summary. I'll try to make it super simple. Sorry if it comes off as condescending, that's not my intention. Also, I'm not an expert by any means when it comes to networking. So please correct me if I make a mistake.

You first need to know what VPNs are. If you're thinking about stuff like ProtonVPN, then yes they are VPN, but we mean it in a broader sense. VPNs are simply tunnels in a network that make it looks like the traffic is coming from somewhere where it's not actually coming from. Imagine you're a kid, and your parents had an argument. Now you're stuck repeating one parent's words to another. That's a VPN. Your government doesn't want you to be able to interact with some site, VPNs can basically send you that data through somewhere else, which your government isn't blocking. That's the use for the commercial VPNs.

But the other use, which is more relevant to this discussion, is simply being able to connect to a remote machine. Let's say you want to access your home PC when traveling. You're definitely not on the same network, but VPNs can create a tunnel which will let you act like you're in the same network. It'll essentially repeat/proxy whatever data/command you want to the remote machine, and vice versa.

The industry standard for VPNs is wireguard. It's meant to be ultra lightweight, super fast, and super secure. It's now part of the Linux kernel, so basically available on most machines by default. While it's not hard to setup, it's not easy either. You need to manage your credentials, make sure that there are ports open so that the machines can reach each other, etc. It can get pretty complicated pretty quickly if you're stuck behind a CGNAT.

Tailscale attempts to simplify that process. It uses wireguard-go (a userspace implementation of wireguard written in Go) under the hood to make these connections, but it takes care of the problems mentioned above automatically. So you have an account with them (the free tier is probably fine, or you can self-host using headscale), and you can simply start connecting devices and each device can talk to the other one as if they're on the same network. Tailscale essentially creates wireguard tunnels between each pair of devices, and manages all the networking quirks.

It's by no means unique. There are services like Nebula, Netmaker etc. that attempt to do the same. Tailscale is just a good implementation of this idea. It also has apps for nearly every device you may want to use. Hope that cleared things up for you.

Some of my services (eg headscale) are public and a firewall would block those since it doesn't know what a domain name is, just IPs and ports.

I do have a firewall fwiw but it keeps 443 open. Otherwise a remote device wouldn't be able to connect to the headscale node and get onto my tailnet.

It's usually preferable to use a firewall rather than telling Caddy to bind to a specific address. Or do both. What I mean though is, you shouldn't neglect also configuring a firewall if this machine is public.

thanks!

It sounds like it's running as an automatic service. Try going into Services (search in start menu) and looking for a Tailscale service. You can set it to Manual instead of Automatic or disable it entirely.

I think it’s fine to have multiple as long as they are paid accounts. But free only allows one.

https://www.reddit.com/r/github/s/16bWFqYxax

Is that is against TOS then every dev I know is fucked, we all have a personal and work account. My work requires an account made with a work email to use fucking coopilot, and I need a personal account.

I have a personal and one account for my company.

having multiple accounts on GitHub itself is against their ToS

Ah, ok. I didn't realize that. Great! This gives me a good reason to delete the other account and complete my migration to Codeberg! Thanks!

WireGuard (that Tailscale is built on) is another alternative that doesn’t require a login. https://tailscale.com/compare/wireguard

Migrate to another provider now if it’s a genuine concern. Migrate to OIDC if you have a server that you can make accessible publicly (though this creates the issue of why use tailscale if you’re opening your server to the web for this)

Alt: use headscale and stop relying on corpo bullshit. Then you can earn the ire of microsoft and still maintain remote access

Thanks for sharing. Iirc, having multiple accounts on GitHub itself is against their ToS. I fear it might increase the chance of getting banned for violating their TOS. Correct me if I’m wrong though.

This doesn't answer your question, but I created a completely new GitHub account and exclusively use it for logging into Tailscale.