Headscale includes and embedded DERP server but you need to run it. Their example yaml does have it disabled by default though.
Comment on Tailscale n00b questions
meschbach@piefed.social 3 weeks agoJust a heads up: Headscale will use the official Tailscale DERP servers to resolve NAT traversal.
Toribor@corndog.social 2 weeks ago
irmadlad@lemmy.world 3 weeks ago
I know you’re trying to tell me something brother, but at this moment in time, I seem more stupid than normal, so if you would, unpack that for me in relation to what I was explaining to OP about Tailscale security.
Toribor@corndog.social 2 weeks ago
DERP is the service that actually relays packets between tailscale connected devices when they are crossing a NAT (leaving one private network and going across the internet to another private network).
If you host headscale (the self-hosted community version of the tailscale control plane) and use it with tailscale, by default it will still use the public Tailscale DERP servers. Your traffic is still encrypted and not visible to them, but it does still rely on their centralized architecture even though you are hosting the control plane yourself.
That being said, you can also just selfhost DERP or use the embedded DERP that ships with headscale, although there are some other considerations when doing that because it will need to be publicly on the internet, probably with a proper domain name and publicly trusted certificate.
irmadlad@lemmy.world 2 weeks ago
Thanks for explaining. I really didn’t mean it as a Headscale v Tailscale. kind of thing as far as data security goes. I’ve heard a lot of great things about Headscale. OP was just worried about his data being compromised, and I was just pointing out that it’s pretty tight.