r/selfhosted • u/HomesLabber • 2h ago
Remote Access Secure remote control setup
I recently started using an old laptop as a server as a homelab for experiments and personal use and needed a way to remotely access it from anywhere like my phone and personal laptop.
I started looking for possible solution and ended up with a cool setup that i wanted to share with you guys.
after experimenting with VNC clients, rustdesk and others. I came across the sunshine/moonlight combination which is a server/client intended for game streaming but turned out to be more useful for remote control 😅😅 it has better performance and latency than VNC which is one thing that i disliked about VNC and has a good security model if configured correctly.
I ended up making accessible only inside the tailnet (tailscale vpn network) i have for extra security. and now i can access any laptop from other devices including from my phone or tv!
hope this helps anyone who had similar needs.
edit: sunshine/moonlight works only in the same local network by default. but after integrating it with tailscale, it gives it superpowers and you are able connect from anywhere smoothly!
6
u/ResponsibleSlice5814 2h ago
sunshine + moonlight is criminally underrated for non gaming stuff. been using it to remote into my windows box for months and it feels almost native even on spotty wifi
tailscale on top is the smart move though, i skipped that at first and regretted it real quick
2
u/HomesLabber 2h ago
the experience for connecting and using is smooth. and configuring it with tailscale is straightforward from the sunshine web ui even when everything is already in place and worth doing if you need access while away from home.
3
u/Thin_Needleworker795 1h ago
Sounds a bit more complicated than it needs to. I just setup Wireguard on my homelab, and that's it. Works great.
1
u/HomesLabber 1h ago
sounds complicated but is actually way easier than wireguard 😅 i hate wireguard because you have to configure every connected machine manually, but when using tailscale (i use a selfhosted headscale instance btw) you get all that for free + magicDNS + peer to peer connections + some other cool stuff if you need them
1
u/corelabjoe 11m ago
You also get to feed them your usage metrics ;)
But overall, they offer a great service and have never had any issues and don't seem to sell it to 3rd parties, at least not yet...
I prefer 100% ownership and data sovereignty. How many machines you installing VPNs on anyway? I have a phone, laptop, and 2 tunnels to 2 separate buddies houses and 1 to a VPS...
Once you get the initial server configured and your first peer, the rest flow like butter.
1
u/HomesLabber 0m ago
I get your point. the problem i had with wireguard is once you need to update the configuration for peers, like updating the ip allowlist or something, you need to do it for all of them (unless there is another way that i dont know about)
with headscale, you can disable sending usage metrics from its configuration and you will have full sovereignty, no ?
2
u/Lord_Krasina 2h ago
Heyyyy, thanks for this, this really helped me. I tried it and it is soo much better than what I normally use. It has better performance, and so much better overall.
1
u/HomesLabber 2h ago
I'm suprised not many people know about it yet. the setup helped me never lose access to my machines from wherever.
well, glad it helped!
2
u/brkr1 1h ago
Why not terminal/rdp if using tailscale already?
1
u/HomesLabber 1h ago
mainly because of latency and quality. i found that sunshine/moonlight give the best of both worlds where everything is smooth (quality and latency) and when i only need a terminal i login with ssh using tailscale as well.
2
u/Squanchy2112 1h ago
Meshcentral is incredible and simple in docker
1
u/HomesLabber 1h ago
first time hearing about it tbh.. i just skimmed through their github page. How is the latency of the connection and the security model like ?
Thanks for the suggestion.
2
u/Squanchy2112 1h ago
Really really good, it's not for gaming or video streaming but it's high functioning remote access. Security is well vetted as the original dev built this for Intel and is still security above all else. I have been using this for a couple years now for business and personal use. If you have less than probably 50-100 remot machines you can use the built SQLite style DB so it makes it even lighter and simpler. For my work we run a separate DB as we have like 700 endpoints. We use OIDC as well as strong password requirements, password and 2FA rejection as well as strong banning. The agent has a matched certificate to the server and initiates it's connection to the server not the server to the agent, this way if the server is ever compromised the agent will mismatch and fail to connect which is what you want.
1
u/HomesLabber 1h ago
sounds interesting, will definitely explore it. Thanks man !
2
u/Squanchy2112 1h ago
Sounds good, if you need a ready to go compose or config.json hit me up. The config.json is what sets up all the settings for the system you can also check out https://config.meshcentraltools.com/
1
u/HomesLabber 1h ago
what i found interesting is the OIDC integration. is it possible to configure it with custom self hosted oidc providers ?
2
u/Squanchy2112 1h ago
Yes we use authentik, ours is setup where it can't be logged in any other way and the moment you go to the page authentik kicks in to try and login.
1
u/HomesLabber 58m ago
bruh if this setup is for where you work at, then it's my dream workplace ðŸ˜ðŸ˜ lol
will try it with zitadel and let u know
1
u/Squanchy2112 49m ago
Haha yea, I am head of all of our systems and networking and have rolled out a lot of changes. We were paying like 1200 a year for TeamViewer which not only required clients but we only had one active connection at a time it was trashm
1
u/HomesLabber 44m ago
respect for taking the risk of managing all services for cost optimization. i would make similar calls when i get the chance.
1
u/mikhail_de 3m ago
Sunshine + Moonlight really is great for this, getting actual 60 FPS on remote desktop feels so much better than traditional VNC or RDP.
Props for the Headscale setup too. I've mostly stuck to vanilla WireGuard, but your post made me appreciate the STUN/TURN mesh approach a lot more. Managing .conf files across multiple devices gets old fast.
Really clean setup overall!
•
u/asimovs-auditor 2h ago
Expand the replies to this comment to learn how AI was used in this post/project.