4 ms·

While this is cool I've had luck just purchasing a domain (not that expensive), and manually setting up DNS through that. Some advantages that this doesn't loo

While this is cool I've had luck just purchasing a domain (not that expensive), and manually setting up DNS through that. Some advantages that this doesn't look like this would replicate, (1) I can have multiple domains for the same device, say gitea.mytsnetwork.com and netxcloud.mytsnetwork.com can go to the same device (2) I can get real HTTPS certificates for those domains which I consider necessary nowadays if only just to prevent errors (3) it's "real" DNS so when my browser decides to ignore my system settings and use DNS-over-HTTPS instead everything still works. EDIT: It looks like (2) is solved by the tailscale cert command. I'd replace that point by saying owning the domain is important to controlling the certificate for me. All that said, the more I read into this, this looks like a really well thought-out feature.

mynameisvlad 4y ago
Tailscale has supported real certificates via LE for over a year now: https://tailscale.com/blog/tls-certs/ https://tailscale.com/blog/tls-certs/
mholt 4y ago
Just wait'll you see what's possible with Caddy+Tailscale (currently, and coming soon)!
- michael_j_ward 4y ago
  > (1) I can have multiple domains for the same device, say gitea.mytsnetwork.com and netxcloud.mytsnetwork.com can go to the same device I tried setting up caddy on a machine and then using caddy to reverse-proxy requests to each service i.e. `grafana.my-machine.tail-hex.ts.net` and `controller.my-machine.tail-hex.ts` Obviously, `caddy` has no problem with the reverse proxy bit, but I did fail at being able to point multiple routes or subnet routes at the same machine via tailscle / magic-dns. I'm sharing because it feels like something I should be able to do, and feel dumb not being able to figure it out.
  - xena 4y ago
    This is exactly what we've been working on. Stay tuned ^^
    - danrochman 4y ago
      Stoked!!
  - philsnow 4y ago
    I'm just running a dnsmasq and using that to alias machines / workloads. For my network I needed to make sure a route to the dnsmasq IP is advertised by a subnet router and then I told tailscale to "override local dns" and make all tailscale clients use that dnsmasq IP as their DNS server. I have a mix of bare machines and load-balanced workloads behind an nginx-ingress, all with names specified in the dnsmasq config, and because everything on the tailnet resolves names through dnsmasq (and routes through tailscale), everything works beautifully. I'm still looking forward to this caddy integration, though.
- moontear 4y ago
  Do tease!
maxmouchet 4y ago
One downside of using tailscale cert, or LE for "private" records is that it writes the domain name in a public Certificate Transparency Log [1]. So make sure that the name doesn't contain any sensitive information. An alternative is to issue wildcard certificates with LE, so that the subdomains names are kept private. [1] https://crt.sh/ https://crt.sh/
- xena 4y ago
  Yes, that's why we came up with the random-hex.ts.net domains and the tails-scales.ts.net domains. This makes less publicly recognizable things like `shark-harmonic.ts.net` get put into the certificate transparency log instead of something like "mycorporationname".
  - ehPReth 4y ago
    On a side note, is there a story behind acquiring ts.net or how much it cost to do so?
- therein 4y ago
  > An alternative is to issue wildcard certificates with LE, so that the subdomains names are kept private. They'll still show up on crt.sh, though, won't they? All my LE subdomains are visible (non-wildcard) but also my non-LE paid-for 1-year wildcard ones are also showing up with all the subdomains. Edit: Actually, nevermind, those are Cloudflare. My paid-for wildcard doesn't show up. Well, that's a good reason to pay up I guess.
  - psYchotic 4y ago
    If a certificate has been issued for a domain, and that domain doesn't show up in the certificate transparency logs, that's not something I'd cheer for: that issuer could just as well hand out certificates for your domain to others without you ever knowing about it. Conversely, if a domain shows up in the CT logs, then there have been certificates issued for those domains, even if there exists a wildcard certificate that is valid for that domain. If that happens, check your settings, because there's probably something requesting certificates you're not aware of.
zacwest 4y ago
Tailscale's certs are 1-per-machine so if you want to do any kind of SNI-based certificate handling, you're out of luck and need to drop back to real public certificates anyway.

mynameisvlad 4y ago

Tailscale has supported real certificates via LE for over a year now: https://tailscale.com/blog/tls-certs/ https://tailscale.com/blog/tls-certs/

mholt 4y ago

Just wait'll you see what's possible with Caddy+Tailscale (currently, and coming soon)!

michael_j_ward 4y ago
> (1) I can have multiple domains for the same device, say gitea.mytsnetwork.com and netxcloud.mytsnetwork.com can go to the same device I tried setting up caddy on a machine and then using caddy to reverse-proxy requests to each service i.e. `grafana.my-machine.tail-hex.ts.net` and `controller.my-machine.tail-hex.ts` Obviously, `caddy` has no problem with the reverse proxy bit, but I did fail at being able to point multiple routes or subnet routes at the same machine via tailscle / magic-dns. I'm sharing because it feels like something I should be able to do, and feel dumb not being able to figure it out.
- xena 4y ago
  This is exactly what we've been working on. Stay tuned ^^
  - danrochman 4y ago
    Stoked!!
- philsnow 4y ago
  I'm just running a dnsmasq and using that to alias machines / workloads. For my network I needed to make sure a route to the dnsmasq IP is advertised by a subnet router and then I told tailscale to "override local dns" and make all tailscale clients use that dnsmasq IP as their DNS server. I have a mix of bare machines and load-balanced workloads behind an nginx-ingress, all with names specified in the dnsmasq config, and because everything on the tailnet resolves names through dnsmasq (and routes through tailscale), everything works beautifully. I'm still looking forward to this caddy integration, though.
moontear 4y ago
Do tease!

maxmouchet 4y ago

One downside of using tailscale cert, or LE for "private" records is that it writes the domain name in a public Certificate Transparency Log [1]. So make sure that the name doesn't contain any sensitive information. An alternative is to issue wildcard certificates with LE, so that the subdomains names are kept private. [1] https://crt.sh/ https://crt.sh/

xena 4y ago
Yes, that's why we came up with the random-hex.ts.net domains and the tails-scales.ts.net domains. This makes less publicly recognizable things like `shark-harmonic.ts.net` get put into the certificate transparency log instead of something like "mycorporationname".
- ehPReth 4y ago
  On a side note, is there a story behind acquiring ts.net or how much it cost to do so?
therein 4y ago
> An alternative is to issue wildcard certificates with LE, so that the subdomains names are kept private. They'll still show up on crt.sh, though, won't they? All my LE subdomains are visible (non-wildcard) but also my non-LE paid-for 1-year wildcard ones are also showing up with all the subdomains. Edit: Actually, nevermind, those are Cloudflare. My paid-for wildcard doesn't show up. Well, that's a good reason to pay up I guess.
- psYchotic 4y ago
  If a certificate has been issued for a domain, and that domain doesn't show up in the certificate transparency logs, that's not something I'd cheer for: that issuer could just as well hand out certificates for your domain to others without you ever knowing about it. Conversely, if a domain shows up in the CT logs, then there have been certificates issued for those domains, even if there exists a wildcard certificate that is valid for that domain. If that happens, check your settings, because there's probably something requesting certificates you're not aware of.

zacwest 4y ago

Tailscale's certs are 1-per-machine so if you want to do any kind of SNI-based certificate handling, you're out of luck and need to drop back to real public certificates anyway.