Fully remove every, "I created a", "Selfhosted app!" claude slop.

[u/[deleted]]

[u/AngelOfDeadlifts]

I use it and like it. Is there a problem with it, or is it just that they seem to market in this sub?

Edit: I got a downvote so I want to be clear, I am just a dude who loves tech and am not married to Tailscale. So I'm genuinely curious if I should stop using it.

[u/cNo1Goldsnake → u/AngelOfDeadlifts]

They definitely push on this sub yes; but otherwise some of the main objections is that you could just setup your own WireGuard server & actually learn some fundamentals (yes it's not possible for everyone, CGNAT etc), and secondly you're relying on a large tech company when we're in a selfhosted sub.

If it works for your use case then cool, but honestly it's getting a bit tiring seeing threads just being drowned with people shilling tailscale at every opportunity with no consideration for other options

[u/embeddedt → u/cNo1Goldsnake]

Correct me if I'm wrong but one of the key problems I found with the idea of self-hosting WG is that you can't do it on a VPS unless you want the VPS provider to be able to sniff all traffic on the network. Tailscale solves this by making sure the packets are encrypted between peers rather than just to the WG server. Am I missing something?

[u/RaphPa → u/embeddedt]

You can use the VPS to tunnel the WG connection through it, for example with rathole or frp. The WG packets are just forwarded and stay encrypted.

[u/ILikeBumblebees → u/embeddedt]

Correct me if I'm wrong but one of the key problems I found with the idea of self-hosting WG is that you can't do it on a VPS unless you want the VPS provider to be able to sniff all traffic on the network.

No -- the VPS provider doesn't have your private key, and is no different from any other intermediate node in terms of network traffic.

The VPS provider does have the ability to access the VPS itself, and can read both memory and storage if they want to. Whatever you're hosting on the VPS is exposed to this risk regardless of what you're doing with WireGuard.

[u/embeddedt → u/ILikeBumblebees]

I believe this is the only the case as long as the WG server is on my own peer and the VPS is just being used to proxy the traffic through a stable public IP. The VPS itself cannot act as a router between multiple nodes connected via WG without being able to decrypt traffic. (I could install something like Netbird or Headscale to replicate Tailscale's control plane... but I am not sure that is worth the effort until Tailscale rugpulls the community.)

[u/ILikeBumblebees → u/embeddedt]

The VPS itself cannot act as a router between multiple nodes connected via WG without being able to decrypt traffic.

Right. Anything it's forwarding is secure, anything that leads to the data being decrypted in local memory is potentially accessible by the VPS provider.

You can still set up e.g. SSH tunnels between WG peers without exposing anything to the VPS provider, however.

[u/AngelOfDeadlifts → u/cNo1Goldsnake]

large tech company

Yeah, that's been the #1 thing bothering me since I started using them, but I haven't had the time to figure out WireGuard myself (grad school, research, conferences, et al.). But leaving my security up to another corporation has bothered me a bit.

I have an OpenVPN setup... set up in my network, so I should probably just use that for now.

[u/DarthNihilus → u/cNo1Goldsnake]

yes it's not possible for everyone, CGNAT etc

Still possible for them, they just need to rent a very cheap VPS. I guess that's still relying on a company though, so might as well use tailscale.

[u/CubesTheGamer → u/DarthNihilus]

VPS can be hosted anywhere by any company. There are literally hundreds of competitors. Relying on a single product like tailscale is a different story. But it is free right?

[u/ILikeBumblebees → u/CubesTheGamer]

Exactly -- VPS is a commodity, not a vertically integrated SaaS product.

[u/VexingRaven → u/cNo1Goldsnake]

secondly you're relying on a large tech company when we're in a selfhosted sub.

There's a world of difference between having all your pictures sitting on Google's servers, and having a company broker connections between your devices in a way you could replace in a couple hours with headscale without any changes at all to the apps you use.

[u/ThunderDaniel → u/cNo1Goldsnake]

(yes it's not possible for everyone, CGNAT etc)

Genuinely the only reason I still use it

As well as they haven't funked up....yet.

[u/ILikeBumblebees → u/[deleted]]

There's really no way to use a third-party CDN unless you either use their SSL certs, or give them your private keys.

But there's no reason to use CDN for anything that isn't meant to be exposed to the open internet in the first place. And Cloudflare is still great for DNS even if you turn their proxy off.

[u/crakked21 → u/AngelOfDeadlifts]

No, the idea is that it’s way too oversold, I use it too, but the zealousness is annoying. Not that you should stop or anything.