Submitted 1 day ago by mrnobody@reddthat.com to selfhosted@lemmy.world
Playing around with a new self-host NAS OS, finally thought about Tailscale. But, I see it wants a login to an account. Checking online, seems I have to use Google, Apple, MS, Github or OIDC (which iassume costs money based on the site).
So how tf y’all setting to your tail scale stuff? I’m not using a big brother us tech account for auth on this thing. Think I’d rather go back to regular wireguard if that’s the case.
If you have a VPS, consider setting up either Headscale or Netbird if you don’t want to use any of Tailscale’s built-in auth methods (with all necessary security precautions taken of course). If that’s not an option I’d suggest going back to Wireguard for sure.
You can self host the control plane for Tailscale using a community project called Headscale. I use that along with Headplane which gives you a nice admin web UI.
Since when can you use regular email? That’s odd. When i checked it out it wasn’t possible and there was even a post why. That tailscale is no identity provider and such things
I went with Google.
I went with GitHub. In the end it’s just an OAuth service, to provide identity. It’s not used to gather data on you (just the same we already share by visiting regular websites).
I’m still gonna lookup Headscale and Wireguard because It’s been on my radar.
Problem with plain Wireguard is if you can’t open ports on some devices to get a direct connection. It should be just fine with hub and spoke model, but NAT Traversal of Tailscale makes a huge difference. I can get a direct connection between 2 devices connected to mobile data and behind CG-NAT.
And also the config management if you have too many devices.
Hub and spoke, you just add new devices to Wireguard on the main device, and the new peer. Full mesh, oof.
But as far as configuring Wireguard goes, that’s pretty simple. And then there’s the weird stuff with MTU and fragmentation… but that’s not something Wireguard-specific.
I don’t want to risk any data compromise at some point
What data compromise are you worried about?
I’m not the Tailscale sales person Go with whatever suites your threat model. I am just curious what data compromise you are concerned with. If it’s the metadata aspect, you already blew that away when you made the post here at Lemmy, even assuming you are using a VPN.
Just a heads up: Headscale will use the official Tailscale DERP servers to resolve NAT traversal.
I know you’re trying to tell me something brother, but at this moment in time, I seem more stupid than normal, so if you would, unpack that for me in relation to what I was explaining to OP about Tailscale security.
I use Pocket-ID for my OIDC and it was easy to set up with Tailscale, you just have a custom domain which I do and I just login with my OIDC Account which is 100% self hosted on my local server.
headscale /thread
Is there a good guide? I tried setting up headscale and tailscale and I got everything running and linked, but it doesn’t pass traffic for the routes I’ve enabled and I’m not sure how to troubleshoot it.
most of the guides can be outdated because the software changes a lot. You’d find some better support writing on their Discord guild
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| NAT | Network Address Translation |
| VPN | Virtual Private Network |
| VPS | Virtual Private Server (opposed to shared hosting) |
[Thread #131 for this comm, first seen 3rd Mar 2026, 00:00] [FAQ] [Full list] [Contact] [Source code]
dieTasse@feddit.org 1 day ago
I will teach you a trick. Login with e.g. github. Create a tailnet. Create new user invite link, use it yourself - you can setup login with passkey to this second user. Promote to admin. Leave with your github user. Voila you have an account and tailnet with only passkey, no big brother oauth or anything.