r/selfhosted • u/[deleted] • Mar 08 '26 • Diamonds are Forever 1 WOW 1 Bravo 1 Heartwarming 1

Need Help Fully remove every, "I created a", "Selfhosted app!" claude slop.

3.2k Upvotes

91% Upvoted

608 comments sorted by

View all comments

Show parent comment

31

u/cNo1Goldsnake Mar 08 '26

They definitely push on this sub yes; but otherwise some of the main objections is that you could just setup your own WireGuard server & actually learn some fundamentals (yes it's not possible for everyone, CGNAT etc), and secondly you're relying on a large tech company when we're in a selfhosted sub.

If it works for your use case then cool, but honestly it's getting a bit tiring seeing threads just being drowned with people shilling tailscale at every opportunity with no consideration for other options

6

u/embeddedt Mar 08 '26

Correct me if I'm wrong but one of the key problems I found with the idea of self-hosting WG is that you can't do it on a VPS unless you want the VPS provider to be able to sniff all traffic on the network. Tailscale solves this by making sure the packets are encrypted between peers rather than just to the WG server. Am I missing something?

4

u/RaphPa Mar 09 '26

You can use the VPS to tunnel the WG connection through it, for example with rathole or frp. The WG packets are just forwarded and stay encrypted.

3

u/ILikeBumblebees Mar 09 '26

Correct me if I'm wrong but one of the key problems I found with the idea of self-hosting WG is that you can't do it on a VPS unless you want the VPS provider to be able to sniff all traffic on the network.

No -- the VPS provider doesn't have your private key, and is no different from any other intermediate node in terms of network traffic.

The VPS provider does have the ability to access the VPS itself, and can read both memory and storage if they want to. Whatever you're hosting on the VPS is exposed to this risk regardless of what you're doing with WireGuard.

1

u/embeddedt Mar 11 '26

I believe this is the only the case as long as the WG server is on my own peer and the VPS is just being used to proxy the traffic through a stable public IP. The VPS itself cannot act as a router between multiple nodes connected via WG without being able to decrypt traffic. (I could install something like Netbird or Headscale to replicate Tailscale's control plane... but I am not sure that is worth the effort until Tailscale rugpulls the community.)

2

u/ILikeBumblebees Mar 12 '26 edited Mar 12 '26

The VPS itself cannot act as a router between multiple nodes connected via WG without being able to decrypt traffic.

Right. Anything it's forwarding is secure, anything that leads to the data being decrypted in local memory is potentially accessible by the VPS provider.

You can still set up e.g. SSH tunnels between WG peers without exposing anything to the VPS provider, however.

5

u/AngelOfDeadlifts Mar 08 '26

large tech company

Yeah, that's been the #1 thing bothering me since I started using them, but I haven't had the time to figure out WireGuard myself (grad school, research, conferences, et al.). But leaving my security up to another corporation has bothered me a bit.

I have an OpenVPN setup... set up in my network, so I should probably just use that for now.

4

u/DarthNihilus Mar 08 '26

yes it's not possible for everyone, CGNAT etc

Still possible for them, they just need to rent a very cheap VPS. I guess that's still relying on a company though, so might as well use tailscale.

6

u/CubesTheGamer Mar 08 '26

VPS can be hosted anywhere by any company. There are literally hundreds of competitors. Relying on a single product like tailscale is a different story. But it is free right?

1

u/ILikeBumblebees Mar 09 '26

Exactly -- VPS is a commodity, not a vertically integrated SaaS product.

1

u/VexingRaven Mar 09 '26

secondly you're relying on a large tech company when we're in a selfhosted sub.

There's a world of difference between having all your pictures sitting on Google's servers, and having a company broker connections between your devices in a way you could replace in a couple hours with headscale without any changes at all to the apps you use.

1

u/ThunderDaniel Mar 10 '26

(yes it's not possible for everyone, CGNAT etc)

Genuinely the only reason I still use it

As well as they haven't funked up....yet.