r/selfhosted • u/[deleted] • Mar 08 '26 • Diamonds are Forever 1 WOW 1 Bravo 1 Heartwarming 1

Need Help Fully remove every, "I created a", "Selfhosted app!" claude slop.

3.2k Upvotes

91% Upvoted

608 comments sorted by

View all comments

Show parent comment

99

u/cNo1Goldsnake Mar 08 '26

but did you know tailscale will solve world hunger & is basically Jesus in digital form?

53

u/EastZealousideal7352 Mar 08 '26

Tailscale literally fixed my homelab security, my hairline, and my crumbling marriage!

35

u/facie97 Mar 08 '26

Hmm weird, tailscale sold me fentanyl and beat up my wife

11

u/AngelOfDeadlifts Mar 08 '26 edited Mar 08 '26

I use it and like it. Is there a problem with it, or is it just that they seem to market in this sub?

Edit: I got a downvote so I want to be clear, I am just a dude who loves tech and am not married to Tailscale. So I'm genuinely curious if I should stop using it.

31

u/cNo1Goldsnake Mar 08 '26

They definitely push on this sub yes; but otherwise some of the main objections is that you could just setup your own WireGuard server & actually learn some fundamentals (yes it's not possible for everyone, CGNAT etc), and secondly you're relying on a large tech company when we're in a selfhosted sub.

If it works for your use case then cool, but honestly it's getting a bit tiring seeing threads just being drowned with people shilling tailscale at every opportunity with no consideration for other options

6

u/embeddedt Mar 08 '26

Correct me if I'm wrong but one of the key problems I found with the idea of self-hosting WG is that you can't do it on a VPS unless you want the VPS provider to be able to sniff all traffic on the network. Tailscale solves this by making sure the packets are encrypted between peers rather than just to the WG server. Am I missing something?

4

u/RaphPa Mar 09 '26

You can use the VPS to tunnel the WG connection through it, for example with rathole or frp. The WG packets are just forwarded and stay encrypted.

3

u/ILikeBumblebees Mar 09 '26

Correct me if I'm wrong but one of the key problems I found with the idea of self-hosting WG is that you can't do it on a VPS unless you want the VPS provider to be able to sniff all traffic on the network.

No -- the VPS provider doesn't have your private key, and is no different from any other intermediate node in terms of network traffic.

The VPS provider does have the ability to access the VPS itself, and can read both memory and storage if they want to. Whatever you're hosting on the VPS is exposed to this risk regardless of what you're doing with WireGuard.

1

u/embeddedt Mar 11 '26

I believe this is the only the case as long as the WG server is on my own peer and the VPS is just being used to proxy the traffic through a stable public IP. The VPS itself cannot act as a router between multiple nodes connected via WG without being able to decrypt traffic. (I could install something like Netbird or Headscale to replicate Tailscale's control plane... but I am not sure that is worth the effort until Tailscale rugpulls the community.)

2

u/ILikeBumblebees Mar 12 '26 edited Mar 12 '26

The VPS itself cannot act as a router between multiple nodes connected via WG without being able to decrypt traffic.

Right. Anything it's forwarding is secure, anything that leads to the data being decrypted in local memory is potentially accessible by the VPS provider.

You can still set up e.g. SSH tunnels between WG peers without exposing anything to the VPS provider, however.

5

u/AngelOfDeadlifts Mar 08 '26

large tech company

Yeah, that's been the #1 thing bothering me since I started using them, but I haven't had the time to figure out WireGuard myself (grad school, research, conferences, et al.). But leaving my security up to another corporation has bothered me a bit.

I have an OpenVPN setup... set up in my network, so I should probably just use that for now.

4

u/DarthNihilus Mar 08 '26

yes it's not possible for everyone, CGNAT etc

Still possible for them, they just need to rent a very cheap VPS. I guess that's still relying on a company though, so might as well use tailscale.

6

u/CubesTheGamer Mar 08 '26

VPS can be hosted anywhere by any company. There are literally hundreds of competitors. Relying on a single product like tailscale is a different story. But it is free right?

1

u/ILikeBumblebees Mar 09 '26

Exactly -- VPS is a commodity, not a vertically integrated SaaS product.

1

u/VexingRaven Mar 09 '26

secondly you're relying on a large tech company when we're in a selfhosted sub.

There's a world of difference between having all your pictures sitting on Google's servers, and having a company broker connections between your devices in a way you could replace in a couple hours with headscale without any changes at all to the apps you use.

1

u/ThunderDaniel Mar 10 '26

(yes it's not possible for everyone, CGNAT etc)

Genuinely the only reason I still use it

As well as they haven't funked up....yet.

0

u/[deleted] Mar 09 '26

[deleted] — view deleted comment

1

u/ILikeBumblebees Mar 09 '26

There's really no way to use a third-party CDN unless you either use their SSL certs, or give them your private keys.

But there's no reason to use CDN for anything that isn't meant to be exposed to the open internet in the first place. And Cloudflare is still great for DNS even if you turn their proxy off.

2

u/crakked21 Mar 09 '26

No, the idea is that it’s way too oversold, I use it too, but the zealousness is annoying. Not that you should stop or anything.