52
Tailscale n00b questions (reddthat.com)
submitted 8 months ago by to c/selfhosted@lemmy.world
17 comments fedilink hide all child comments

all 18 comments

sorted by: hot top controversial new old
[–] 14 points 8 months ago

If you have a VPS, consider setting up either Headscale or Netbird if you don't want to use any of Tailscale's built-in auth methods (with all necessary security precautions taken of course). If that's not an option I'd suggest going back to Wireguard for sure.

  • permalink
  • fedilink
  • source
    •
    [–] 9 points 8 months ago*

    You can self host the control plane for Tailscale using a community project called Headscale. I use that along with Headplane which gives you a nice admin web UI.

    Then you just use the tailscale client on devices like normal but you authenticate new clients with your endpoint instead of the centralized one.

  • permalink
  • fedilink
  • source
    •
    [–] 7 points 8 months ago

    Since when can you use regular email? That's odd. When i checked it out it wasn't possible and there was even a post why. That tailscale is no identity provider and such things

  • permalink
  • fedilink
  • source
    •
    [–] 6 points 8 months ago* (5 children)

    I don’t want to risk any data compromise at some point

    What data compromise are you worried about?

    • End-to-End Encryption: Tailscale utilizes WireGuard
    • No Centralized Servers: Tailscale creates a direct peer-to-peer connection between devices
    • Minimal Metadata: Tailscale may collect some metadata to facilitate connections, but this info does not include the content of your data.
    • User-Controlled Access: You have control over which devices can connect
    • Tailscale does not, and cannot inspect your traffic

    I'm not the Tailscale sales person. Go with whatever suites your threat model. I am just curious what data compromise you are concerned with. If it's the metadata aspect, you already blew that away when you made the post here at Lemmy, even assuming you are using a VPN.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 5 points 8 months ago (4 children)

    Just a heads up: Headscale will use the official Tailscale DERP servers to resolve NAT traversal.

    https://tailscale.com/docs/reference/derp-servers

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 8 months ago (2 children)

    I know you're trying to tell me something brother, but at this moment in time, I seem more stupid than normal, so if you would, unpack that for me in relation to what I was explaining to OP about Tailscale security.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 8 months ago* (1 child)

    DERP is the service that actually relays packets between tailscale connected devices when they are crossing a NAT (leaving one private network and going across the internet to another private network).

    If you host headscale (the self-hosted community version of the tailscale control plane) and use it with tailscale, by default it will still use the public Tailscale DERP servers. Your traffic is still encrypted and not visible to them, but it does still rely on part of their centralized architecture even though you are hosting the control plane yourself.

    That being said, you can just use the embedded DERP that ships with headscale, although there are some other considerations when doing that because it will need to be publicly on the internet, probably with a proper domain name and publicly trusted certificate.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 8 months ago

    Thanks for explaining. I really didn't mean it as a Headscale v Tailscale. kind of thing as far as data security goes. I've heard a lot of great things about Headscale. OP was just worried about his data being compromised, and I was just pointing out that it's pretty tight.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 8 months ago* (last edited 8 months ago)

    Headscale includes an embedded DERP server but you need to enable it. Their example yaml has it disabled by default, which I assume is because it needs to be publicly available on the internet, requires HTTPS, and thus a certificate and other network/security considerations.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 4 points 8 months ago

    I use Pocket-ID for my OIDC and it was easy to set up with Tailscale, you just have a custom domain which I do and I just login with my OIDC Account which is 100% self hosted on my local server.

  • permalink
  • fedilink
  • source
    •
    [–] [B] 2 points 8 months ago* (last edited 8 months ago)

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

    Fewer Letters More Letters
    HTTP Hypertext Transfer Protocol, the Web
    HTTPS HTTP over SSL
    NAT Network Address Translation
    SSL Secure Sockets Layer, for transparent encryption
    VPN Virtual Private Network
    VPS Virtual Private Server (opposed to shared hosting)

    [Thread #131 for this comm, first seen 3rd Mar 2026, 00:01] [FAQ] [Full list] [Contact] [Source code]

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 8 months ago* (last edited 8 months ago) (3 children)

    I went with Google.

    Edit: I am just saying what I went with. I didn't have another fitting option.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 3 points 8 months ago (2 children)

    I went with GitHub. In the end it's just an OAuth service, to provide identity. It's not used to gather data on you (just the same we already share by visiting regular websites).
    I'm still gonna lookup Headscale and Wireguard because It's been on my radar.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 8 months ago (1 child)

    Problem with plain Wireguard is if you can't open ports on some devices to get a direct connection. It should be just fine with hub and spoke model, but NAT Traversal of Tailscale makes a huge difference. I can get a direct connection between 2 devices connected to mobile data and behind CG-NAT.
    And also the config management if you have too many devices.

    Hub and spoke, you just add new devices to Wireguard on the main device, and the new peer. Full mesh, oof.

    But as far as configuring Wireguard goes, that's pretty simple. And then there's the weird stuff with MTU and fragmentation... but that's not something Wireguard-specific.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 8 months ago

    I avoided tailscale for so long because I was already using wireguard and I didn't know you could self-host with headscale. But once I started using it with headscale the mesh design really is a big improvement to usability. I don't miss having to carefully manage my config files and ip route rules.

    I need to get setup with app connectors and then I think it'll finally be a high enough wife-usability factor for me to remove some things I still have exposed over the internet.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 0 points 8 months ago (2 children)

    headscale /thread

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 1 point 8 months ago (1 child)

    Is there a good guide? I tried setting up headscale and tailscale and I got everything running and linked, but it doesn't pass traffic for the routes I've enabled and I'm not sure how to troubleshoot it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •