3 ms·
You could just get a wildcard certificate with lets encrypt, via a dns challenge. E.g. lego supports many different dns providers https://go-acme.github.io/le
by SushiHippie 2y ago
You could just get a wildcard certificate with lets encrypt, via a dns challenge.
E.g. lego supports many different dns providers
https://go-acme.github.io/lego/ https://go-acme.github.io/lego/
And then internally inside of tailscale you could have your own dns server, which serves subdomains of your domain, and for all subdomains you can use the same wildcard certificate.
This also does not 'expose' your subdomains on Certificate Transparency logs
- domh 2y agoCool thanks! I'll have to spend some more time looking into this. Do you have any recommendations for a DNS server to run inside Tailscale?
- SushiHippie 2y agoDepends, if you only want dns and nothing more, then probably dnsmasq. That's basically one of the most used dns/dhcp servers. Otherwise you could use solutions like AdGuard Home or PiHole, which both have a Web Interface for configuration, and the ability to block ads and tracking domains. Note that I don't use Tailscale myself, so I don't know if Tailscale 'needs' something else. But I use pure wireguard, and all of the services mentioned above work with 'pure wireguard'.
- sanroot99 2y agoI can recommend pihole, it have a dns server, easy to use with web interface.
- sanroot99 2y agoI had once ran dns server from pihole inside tailscale. Worked pretty decent, but latency was the issue and had reliability issue.