tailscale VS headscale

Tailscale has made all of their client source code available for anyone to view so if you want to confirm that you’re not sending unencrypted data or keys through their servers you’re more than free to do so.

https://github.com/tailscale/tailscale

I think there is some merit to setting up wireguard (e.g. you want more devices than what Tailscale offers for free, or their servers become unreliable for some reason)

But people who push the “scarey boogeyman will look at your data” with Tailscale are either technically illiterate or overly-paranoid.

For example, the home networking, personal VPN, we may use Tailscale. https://tailscale.com/ which is also listed on the Umbrel App Store.

Here then comes VPN (Virtual Private Network) which is basically establishes a protected network connection when using public networks. I already have relevant experiences with this one as some of my previous projects involves private repositories that can only be accessed by connecting into the client's VPN. There are many solutions for this specific use case like WireGuard, but in this particular blog, I chose Tailscale.

I had 2 old laptops sitting around, both 10 years old. I turned both into a home server. Installed Ubuntu Server, set up Docker, and now I run all my containers remotely. With Tailscale, I can securely connect to it like it's on the same network. This way, my MacBook doesn't have to run MongoDB, Redis, or RabbitMQ anymore. That alone freed up a lot of memory. I can even run other services like HomeAssistant, MailHog, Immich, etc.

Then I wanted to add Tailscle which besides being a "best in class VPN" for the homelabbers, allows you to add k8s services directly into your tailnet. What does it mean? The Tailscale operator allows you to access your k8s applications only when you are logged into your private network (tailnet), with the usage of your domain for ended with ts.net. You can configure it in two ways on the resource side, with ingress or with service annotation.

here's the GitHub issue tracking the problem:

https://github.com/tailscale/tailscale/issues/3363

We actually have that nowadays... the config file support to tailscaled, as Irbe mentioned on the bug Jan 2024: https://github.com/tailscale/tailscale/issues/1412#issuecomm...

I dunno if the CIA would trust them but I like Amcrest cameras

https://amcrest.com/

because they have a wide range of different price points and capabilities. Use these with software like

https://zoneminder.com/

which you could run on a cheap Linux box. For secure access use

https://tailscale.com/

Vertical scaling this language also gets into painful territory quite often, I’ve had to workaround this problem before but never with a thing that felt like this: https://github.com/tailscale/tailscale/blob/main/syncs/shard...

I've always been on the outside looking in, so I've never used Tailscale or its open-source brethren.

Would this service be comparable to Headscale[0]?

[0] https://github.com/juanfont/headscale

I think it would be neat if headscale allowed peering / federating between instances. (Maybe after the ACL rework.) One of the main problems is address collisions.

So here's my proposal: commit to ipv6-only overlay network in the unique local address (ULA) range, then split up the remaining 121 bits into 20 low bits for device addresses (~1M) and 101 high bits that are the hash of the server's public key. Federate by adding the public key of the other instance and use policy and ACLs to manage comms between nodes.

I think it's a nice idea, but the maintainer kradalby said it's out of scope when I brought it up in 2023: https://github.com/juanfont/headscale/issues/1370

I think it does:

https://sourcegraph.com/search?q=context:global+repo:github....

https://github.com/juanfont/headscale/pull/847

I’m not sure how well does it support it though, and I can’t open the docs for some reason right now.

root@hz-headscale-tmp-1:~# export HEADSCALE_VERSION="0.23.0" \ && export HEADSCALE_ARCH="arm64" \ && wget --output-document=headscale.deb "https://github.com/juanfont/headscale/releases/download/v${HEADSCALE_VERSION}/headscale_${HEADSCALE_VERSION}_linux_${HEADSCALE_ARCH}.deb" <...redacted for brevity..> 2024-09-28 12:24:54 (189 MB/s) - ‘headscale.deb’ saved [17022910/17022910]

> I still have to rely on a landlord.

This is a very good point. Counterpoint is self-hosting Headscale which I mentioned in another comment here: https://github.com/juanfont/headscale

Works with native Tailscale clients with a few config changes. I use it myself.

headscale - Open source implementation of Tailscale control server. Can be used with Tailscale's official open source client. Written in Go.

Headscale

You can always use headscale. https://github.com/juanfont/headscale

One more thing, you can host Tailscale Control Server yourself if you want, which is a plus.