Tailscale is pretty useful

I used to expose my workstation RDP directly but with a non-standard port. Then I became a "homelabber", and paranoid, and added a mix of nginx with basic auth in front of Guacamole. The UX in browser is so abysmal that I used it to configure direct RDP when I really needed to work remotely when traveling. Then I learned Tailscale and it is really liberating. Just direct RDP with negligible (for me) risks. I run OneDrive, JetBrains Toolbox, Podman just visible in the tray and what else as services, such as OpenVPN, etc. I keep Tailscale running only when I travel. I think paranoia should stop at some point, yet I still read the top comment about security/trust very attentively.

Yeah, fully local LLM+TTS setup.

Use jupyter notebook to fetch the stock and weather info and feed that into a local LLM and convert that to speech using opensource TTS.

https://github.com/smy20011/MorningRadio

Downvotes on this comment, nice. It's about reducing exposure in a possible trade war.

> * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale once a node is connected to the tailnet.

At the very least there's ACLs so you can tag devices and restrict access down to specific ports and protocols based on either user identity or device tag.

At my org we use tailscale much like a VPN, to give users access to a few internal web apps, and with ACLs those users can only hit the webserver on 443 and nothing else to that node. This way the web server itself has no ports exposed on the host, ufw deny all incoming.

I can't answer if the VPN model is really the way to go, long term - probably not, but for our use case Tailscale has been absolutely perfect, and we accepted the tradeoffs were worth it over a more "complete" zero-trust approach, and the complexities that come along with it.

What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host.

I guess that's all to say, I/we don't see Tailscale as a zero-trust solution, but more or less a more convenient VPN with easier to use ACLs. Cloudflare Tunnel and the likes are much better suited to implementing a zero trust approach.

I think there's still value though. A zero trust approach is the correct way for most organizations, but there's still a big niche for Tailscale especially for small-medium orgs and self-hosters/homelabbers.

Tailscale is great. I put my whole company on it shortly after joining (we had some servers with RDP exposed to the internet...). It has had ~0 problems in the last year, and non-technical people are able to use it with ease.