Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An open source, self-hosted implementation of the Tailscale control server

github.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: An open source, self-hosted implementation of the Tailscale control server

#71

Post by mynameisvlad »

Happily2020 wrote: post #33

If you're interested in self-hosting your orchestration server, you can look into Netbird. It's a very similar tool, but has the server open sourced as well. So you have a self-hosted control server with a nice GUI and all the features the paid version does. https://netbird.io/knowledge-hub/tailscale-vs-netbird

I've been slowly moving everything over from Tailscale to Netbird and aside from some shenanigans with Tailscale taking over the entire CGNAT route, it works wonderfully!

Tailscale is still running for now, but I'm getting closer and closer to decommissioning it and switching entirely to Netbird.

Re: An open source, self-hosted implementation of the Tailscale control server

#72

Post by miki123211 »

pilif wrote: post #12

Keep in mind that for many use cases (mobile access, GUI on macOS), this relies on the official Tailscale clients keeping the ability to set the control server. The moment the inevitable enshitification will start at Tailscale, this feature will go away. I’m saying this as a currently super happy Tailscale customer who was burned multiple times in the past by other companies being sold or running out of VC money

I may be misremembering, but I think they have said somewhere that Headscale is actually revenue positive for them.

That feels right to me. Headscale is mostly used by home labbers and small hobby users, it competes with self-hosted OpenVPN and WireGuard, not Pulsesecure, Cisco Anyconnect or GlobalProtect. It's a way to introduce Tailscale to people who love to try new shiny tech in their spare time, but don't want to give up control over their infrastructure.

Those people will then bring their Tailscale expertise and enthusiasm to work. Work really doesn't like managing IT infrastructure unless it's one of their core competencies.

Sure, some companies will actually choose Headscale over Tailscale proper, but I suspect that's a small minority (especially if you take company size and the money involved into account). That's just cost of revenue, not unlike Facebook advertising or billboards on the side of a road in Silicon Valley.

Re: An open source, self-hosted implementation of the Tailscale control server

#73

Post by sshine »

benley wrote: post #24
sshine wrote: post #20

Earlier quoted context omitted.

I’d love to see a write-up on that. Especially in the unlikely event that you used Nix for the deployment.

I've done exactly that: headscale in production at work, a few hundred client devices, infrastructure mostly powered by nix. What would you want to hear about it?

> headscale in production at work

  - How much effort do you put into key management compared to plain WireGuard?
  - How automated is the onboarding process; do you generate and hand over keys?
  - How do you cope without the commercial Tailscale dashboard?
  - Do you run some kind of dashboard or metrics system?
  - How long did it take to set up?
  - Were there any gotchas?

Re: An open source, self-hosted implementation of the Tailscale control server

#74

Post by comex »

miki123211 wrote: post #72
pilif wrote: post #12

Keep in mind that for many use cases (mobile access, GUI on macOS), this relies on the official Tailscale clients keeping the ability to set the control server. The moment the inevitable enshitification will start at Tailscale, this feature will go away. I’m saying this as a currently super happy Tailscale customer who was burned multiple times in the past by other companies being sold or running out of VC money

I may be misremembering, but I think they have said somewhere that Headscale is actually revenue positive for them. That feels right to me. Headscale is mostly used by home labbers and small hobby users, it competes with self-hosted OpenVPN and WireGuard, not Pulsesecure, Cisco Anyconnect or GlobalProtect. It's a way to introduce Tailscale to people who love to try new shiny tech in their spare time, but don't want t…

> I think they have said somewhere that Headscale is actually revenue positive for them.

I have the same memory. But they may not feel that way forever. Many a company started by attracting developers with a generous free tier or open-source offering, then started to clamp down once the going got tough.

Heck, it happened to one of Tailscale's competitors, ZeroTier, which used to release their client software under GPLv3 but eventually switched to BSL.

Re: An open source, self-hosted implementation of the Tailscale control server

#75

Post by unixfox »

Happily2020 wrote: post #33

If you're interested in self-hosting your orchestration server, you can look into Netbird. It's a very similar tool, but has the server open sourced as well. So you have a self-hosted control server with a nice GUI and all the features the paid version does. https://netbird.io/knowledge-hub/tailscale-vs-netbird

No IPv6 though. Which is real deal breaker: https://github.com/netbirdio/netbird/issues/46

Re: An open source, self-hosted implementation of the Tailscale control server

#76

Post by avtar »

sshine wrote: post #73
benley wrote: post #24

Earlier quoted context omitted.

I've done exactly that: headscale in production at work, a few hundred client devices, infrastructure mostly powered by nix. What would you want to hear about it?

> headscale in production at work - How much effort do you put into key management compared to plain WireGuard? - How automated is the onboarding process; do you generate and hand over keys? - How do you cope without the commercial Tailscale dashboard? - Do you run some kind of dashboard or metrics system? - How long did it take to set up? - Were there any gotchas?

> How do you cope without the commercial Tailscale dashboard?

There are a couple open source dashboard options but right now only this one comes to mind: https://github.com/tale/headplane

Re: An open source, self-hosted implementation of the Tailscale control server

#77

Post by avtar »

udev4096 wrote: post #23
usagisushi wrote: post #9

Earlier quoted context omitted.

It's a mesh VPN, so peers communicate directly without additional delay. I opted for Netbird myself because Headscale's UI felt too basic for me back then. Has that improved over the years probably?

How is netbird? Is it more stable than tailscale/headscale? How is your performance while streaming a video?

Netbird seems (or perhaps is?) newer. It didn't have some basic features baked in when I last looked into it, e.g. you couldn't switch accounts on the client https://github.com/netbirdio/netbird/issues/3273 and if I had an account associated with a single team, then that account couldn't be invited to or be associated with additional teams.

Re: An open source, self-hosted implementation of the Tailscale control server

#78

Post by pilif »

dcow wrote: post #62
pilif wrote: post #55

Earlier quoted context omitted.

> Specifically mobile clients and battery usage. yes. Battery usage is super bad, mainly because of their DNS features which forces every DNS resolution to go through their network extension. At least recent updates have stopped the background power usage when you disconnect from the network in the app. >But tunneling traffic through them is extremely worrysome. it only does that in case of super bad NATs that make t…

On the battery topic I’m curious if you have anything more than anecdotal evidence. A basic full tunnel wg network extension doesn’t affect battery in a noticeable or unacceptable way, in my experience. Is tailscale’s implementation doing more in a way you can isolate and attribute to poor battery?

Tailscale on my iPhone is unusable while connected in the background. The battery consumption reporting diagram is all 100% filled light blue bars, all attributed to Tailscale.

I’m using their MagicDNS feature with three domains and I think that’s the reason

Re: An open source, self-hosted implementation of the Tailscale control server

#79

Post by pilif »

pilif wrote: post #78
dcow wrote: post #62

Earlier quoted context omitted.

On the battery topic I’m curious if you have anything more than anecdotal evidence. A basic full tunnel wg network extension doesn’t affect battery in a noticeable or unacceptable way, in my experience. Is tailscale’s implementation doing more in a way you can isolate and attribute to poor battery?

Tailscale on my iPhone is unusable while connected in the background. The battery consumption reporting diagram is all 100% filled light blue bars, all attributed to Tailscale. I’m using their MagicDNS feature with three domains and I think that’s the reason

here's the GitHub issue tracking the problem:

https://github.com/tailscale/tailscale/issues/3363

Re: An open source, self-hosted implementation of the Tailscale control server

#80

Post by kradalby »

gpi wrote: post #17
wutwutwat wrote: post #16

Earlier quoted context omitted.

maintainer's employment != security audit

My thinking is their time is divided now and could lead to less efforts spent on headscale.

Person with split time here,

I definitely have more time to spend on it now, I have half a work week vs sometime in the evenings or weekends if I had excess energy after having my other job.

Post reply on HN