Comment

Comment on Tailscale serve and sharing devices

I don’t know the answer, just commenting because I’m curious. Can you just create a second tailnet and add your server but not your own devices to it?

source

Sort:hotnew top

rtxn@lemmy.world ⁨1⁩ ⁨day⁩ ago
It’s problematic, but possible: jamesguthrie.ch/…/multi-tailnet-unlocking-access-…

source
Whooping_Seal@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
Yes, there is two ways you can go about this. The way that you are thinking of (and the way that I would ideally like to go about this) is as listed on this help article. This is perfect for sharing a home server to some friends, and letting them access a given service without seeing any of your personal devices.

The other option is to have just one tailnet, but having multiple users as detailed here. Notably this can be a security regression (if you don’t limit access on a per-user basis with ACLs), but is ideal for sharing access to your entire network with your spouse / older children perhaps.

For example, I have a friend who has shared a minecraft server with me and that is an ideal example of sharing one node to a seperate tailnet. I am an admin of the server, and can manage the docker container for it + the backup sidecar and the SMB share, but that is where my access to his network structure ends.

This contrasts the situation with my partner for example, where we share a tailnet (with seperate user logins) to make things like gamestreaming just that much easier to setup. Hypothetically I can use ACLs to limit access to stuff like the Cockpit web-management portal, or block the SSH port, but I don’t feel like I need to in my specific case.

source
- DougPiranha42@lemmy.world ⁨19⁩ ⁨hours⁩ ago
  Cool, thanks! What do you use for RSS?
  
  source
  - Whooping_Seal@sh.itjust.works ⁨4⁩ ⁨hours⁩ ago
    As of now I am currently using FreshRSS, although before I properly deploy this to other users in my family / friends I might give Tiny Tiny RSS (tt-rss) a shot as well. I don’t think the differences will matter for end-users as the majority of mine will likely all be using it through the API via a mobile app (e.g NetNewsWire (ios & mac), FluentReader (desktop), CapyReader (android) etc. etc.)., however the main difference that will dictate which one I stick with is the filtering capabilities and the ease of setup of article-collection with readibility / mercury to remove extrenuous content / ads.
    
    I am also quite interested in miniflux, although it is quite intentionally bare bones. It lacks a plugin api (a potential security improvement), and instead natively supports many of the things people would use plugins for (native youtube-nocookie embedding / invidious embedding, integrations with readlater services like instapaper and wallabag, etc., integrated article fetching and parsing with readibility [and can change user agent / cookies to bypass bot protections]). It also seems to have a bit better security stance (supporting modern web browser features like passkeys, content sanitization, sanitizing url parameters in share links automatically etc.).
    
    Miniflux definitely feels like the best ratio of ootb functionality + security, but the UI of FreshRSS feels more natural if you envisage less techy users to use it (and in my case I see one person using the website over an app).
    
    source
irmadlad@lemmy.world ⁨1⁩ ⁨day⁩ ago
Yes, you can create a second Tailnet in Tailscale and add your server without including your personal devices. You’ll have to create a separate account with a separate email address. Then you can join this second Tailnet with your server while leaving your other devices out. The separation allows you to manage connectivity and network policies independently.

source