3 ms·
If you're looking for a tailscale alternative (ish), I built a plugin for HashiCorp Vault to manage Wireguard keys: https://github.com/candiddev/vault-plugin-se
by candiddevmike 4y ago
If you're looking for a tailscale alternative (ish), I built a plugin for HashiCorp Vault to manage Wireguard keys: https://github.com/candiddev/vault-plugin-secrets-wireguard https://github.com/candiddev/vault-plugin-secrets-wireguard
It's a bit more involved than Tailscale with the benefit that it uses Vault's robust authentication options.
- Operyl 4y agoBut completely missing the thing that makes Tailscale great, imho: ACLs.
- candiddevmike 4y agoThis was focused more on secure key distribution. The plugin could be extended to include tags and firewall rules for the groups/peers similar to Tailscale's design and convert them to PostUps that modify nft or iptables.
- Operyl 4y agoYup! And that's where it gets significantly more complicated quickly.
- jdoss 4y agoIt's a shame that this is getting downvotes. This looks fantastic. Thank you for posting it.
- CGamesPlay 4y agoDoes the vault read command produce a full mesh network? I’m assuming that’s what it does, but it isn’t spelled out in the readme.
- candiddevmike 4y agoYea, reading the `/wg-quick` endpoint will produce a rendered config for a wg-quick interface that contains all of the peers in the group. Combined with the Vault agent example, it will update the node automatically as peers are added/deleted.
- jacooper 4y agoThere is also Netbird.io A fully open source Tailscale alternative. But honestly, headacale is better and more advanced than it.