11–20 of 114 posts
It's a bit more involved than Tailscale with the benefit that it uses Vault's robust authentication options.
If you're looking for a tailscale alternative (ish), I built a plugin for HashiCorp Vault to manage Wireguard keys: https://github.com/candiddev/vault-plugin-secrets-wireguard It's a bit more involved than Tailscale with the benefit that it uses Vault's robust authentication options.
That's great! What about iOS?
This has apparently been possible for a long time on iOS but you have to use an MDM profile to change the setting. https://news.ycombinator.com/item?id=28573354
Doing business out in the open like Tailscale is doing is so refreshing. Having seen Brad Fitz communicate in other places, it is obvious he isn't doing the right thing for the user only because these conversations will be scrutinized in public. Tailscale has a lot of great technical people who actually are even better communicators.
This is the lesson for me in this thread: remember to optimize hiring good communicators and not just good technical people. This conversation would have quickly gone south if it was purely about the technical or business reasons for doing it. After all, the root word of communication is commune: to connect. We often forget that.
Earlier quoted context omitted.
This has apparently been possible for a long time on iOS but you have to use an MDM profile to change the setting. https://news.ycombinator.com/item?id=28573354
They say this, but then looking at a recent issue they say it's not done in iOS yet, only macOS: https://github.com/tailscale/tailscale/issues/4299
I wonder if Headscale can also use internal credentials? As far as I remember with tailscale you had to log in with Google or Microsoft which is another total deal-breaker. But I haven't looked at it in ages as the hosted variety was a non starter anyway. Edit: Indeed they now have local logins, but still I would want to be the only one who controls access :)
I don't have a problem with paying for a good product, it's just the control that's an issue for me. For something as crucial to security as this, it needs to lie with me alone. Though I do prefer to just buy software outright instead of subscription models. Since I will do my own hosting, I don't think this is too much to ask. Perhaps they could offer a paid tier for people using headscale.
Earlier quoted context omitted.
They say this, but then looking at a recent issue they say it's not done in iOS yet, only macOS: https://github.com/tailscale/tailscale/issues/4299
Yep it doesn't work on iOS, hopefully the Tailscale team add a similar debug menu that they added on Android and make the login server URL configurable through there, or a working configuration through a .mobileconfig would also be fine!
Big for tailscale IMO. Will just drastically increase the footprint of tailscale even when different control servers. Might lead to some form of federation protocol.