Tailscale

[mid_gen]

Slowly building up infrastructure for getting my studio off the ground. Today was 'sort out remote access' day for my self-hosted services.

Just had to say what an awesome product Tailscale is. I was dreading faffing around with routing and VPN servers and the like.....but to be able to just install an app on my phone and servers and be BAM done, got a secure VPN using oauth.

Now I can shut down the port forwarding I was using to access my Synology DSM while out of the house....vast improvement. And properly free for 3 users.

Tested out granting access to my CI server to another dev I'm working with....just generate a link and bam done, controlled access for an external client to just my server.

Super cool product, and reasonably priced when I do need to scale.

 

[mid_gen]

What's the advantage in using Tailscale or equivalent? Security? I have a Wireguard VPN at router level which I use to dial into my home network which works fine. For Tailscale it seems I'd have to install it on all my devices in order to use which would be a bit time consuming and some devices don't have Tailscale apps either

As mentioned, the advantage is that I don't need to open any ports on my router to the internet....I've never been comfortable about the port I had open to my NAS for DS camera assistant. Now I can keep my home network secure and have tailscale punch through the NAT.

Got tailscale clients installed on my desktop, server, NAS, phone, mac air. Probably do my HomeAssistant box too (seems to be an addon for it).

 

[mid_gen]

Set it up yesterday, it’s solved an issue where I have some OCI instances I always need to update the security list for as I have a dynamic IP. No requirement now since I just ssh over the tailnet.

I’ll have to spend time and read the docs a bit as currently I can’t reach my LAN devices when on my mobile away from home, no doubt some dumb config I’m missing or likely DNS related. I will at some point move over to Headscale but so far I like it.

I've not quite figured the DNS....using my local machine names doesn't always resolve when I'm external (i.e. https://computer:5000 )....but using the tailnet domain always works, so I'm just using them (https://computer.silly-name.ts.net) for things that I want to use remotely.....and that's working perfectly.

Migrating all my photos to a self-hosted Immich server atm....having tailscale sort the secure remote access in a way that I'm happy with has opened the door to ditching quite a few cloud services.