7 ms·

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadm

• philips 10mo ago
  I agree! Before Tailscale I was completely skeptical of self hosting. Now I have tailscale on an old Kindle downloading epubs from a server running Copyparty. Its great!
  • ryandrake 10mo ago
    Maybe I'm dumb, but I still don't quite understand the value-add of Tailscale over what Wireguard or some other VPN already provides. HN has tried to explain it to me but it just seems like sugar on top of a plain old VPN. Kind of like how "pi-hole" is just sugar on top of dnsmasq, and Plex is just sugar on top of file sharing.
    • Skunkleton 10mo ago
      Yes, that is really all it is.
    • mfcl 10mo ago
      It's plug and play.
      • Forgeties79 10mo ago
        And some people may not value that but a lot of people do. It’s part of why Plex has become so popular and fewer people know about Jellyfin. One is turnkey, the other isn’t. I could send a one page bullet point list of instructions to people with very modest computer literacy and they would be up and running in under an hour on all of their devices with Plex in and outside of their network. From that point forward it’s basically like having your own Netflix.
    • Jtsummers 10mo ago
      I think you answered the question. Sugar. It's easier than managing your own Wireguard connections. Adding a device just means logging into the Tailscale client, no need to distribute information to or from other devices. Get a new phone while traveling because yours was stolen? You can set up Tailscale and be back on your private network in a couple minutes. Why did people use Dropbox instead of setting up their own FTP servers? Because it was easier.
      • johnisgood 10mo ago
        Yeah, but "people" here are alleged software engieners. It is quite disheartening.
        • wiether 10mo ago
          First and foremost they are humans, with a limited time on Earth. Being a software engineer doesn't mean you want to spend you free time tinkering about your self-hosting setup and doing support for your users. With Tailscale, not only you don't have to care about most things since _it just works_, but also on-boarding of casual users is straightforward. Same goes for Plex. I want to watch movies/shows, I don't want to spend time tinkering with my setup. And Plex provides exactly that. Ditto for my family/friends that can access my library with the same simple experience as Netflix or whatever. Meanwhile, I have a coworker who want to own/manage everything. So they don't want to use Tailscale and they dropped Plex when they forced to use the third-party login system. Now they watch less than a third than they used to be, and they share their setup with nobody since it's too complicated to do. To each their own, but my goal is to enjoy my setup and share it with others. Tailscale and Plex give me that.
          • johnisgood 10mo ago
            There is a difference between "I choose not to" and "I cannot". The thread is full of people saying Tailscale "unlocked" self-hosting, implying capability, not time savings or time preference. Choosing convenience is fine. But if basic port forwarding or WireGuard is beyond someone's skill set, "software engineer" is doing a lot of heavy lifting. I am not saying they are, but if it really is the case, then yeah. As for file sharing... I remember when non-SWEs knew how to torrent movies, used DC++ and so on. These days even SWEs have no idea how to do it. It is mind-boggling.
    • atmosx 10mo ago
      You don’t have to run the control plane and you don’t have to manage DNS & SSL keys for the DNS entries. Additionally the RBAC is pretty easy. All these are manageable through other tools, but it’s more complicated stack to keep up.
    • Frotag 10mo ago
      I always assumed it was because a lot of ISPs use CGNAT and using tailscale servers for hole punching is (slightly) easier than renting and configuring a VPS.
    • Cyph0n 10mo ago
      It’s a bit more than sugar. 1. 1-command (or step) to have a new device join your network. Wireguard configs and interfaces managed on your behalf. 2. ACLs that allow you to have fine grained control over connectivity. For example, server A should never be able to talk to server B. 3. NAT is handled completely transparently. 4. SSO and other niceties. For me, (1) and (2) in particular make it a huge value add over managing Wireguard setup, configs, and firewall rules manually.
    • drnick1 10mo ago
      > Kind of like how "pi-hole" is just sugar on top of dnsmasq, and Plex is just sugar on top of file sharing. Speaking of that, I have always preferred a plain Unbound instance and a Samba server over fancier alternatives. I guess I like my setups extremely barebone.
      • ryandrake 10mo ago
        Yea, my philosophy for self-hosting is "use the smallest amount of software you can in order to do what you really need." So for me, sugar X on top of fundamental functionality Y is always rejected in favor of just configuring Y."
    • simonw 10mo ago
      If you're confident that you know how to securely configure and use Wireguard across multiple devices then great, you probably don't need Tailscale for a home lab. Tailscale gives me an app I can install on my iPhone and my Mac and a service I can install on pretty much any Linux device imaginable. I sign into each of those apps once and I'm done. The first time I set it up that took less than five minutes from idea to now-my-devices-are-securely-networked.
    • zeroxfe 10mo ago
      > Plex is just sugar on top of file sharing. right, like browsers are just sugar on top of curl
      • edoceo 10mo ago
        curl is just sugar on sockets ;)
        • epistasis 10mo ago
          SSH is just sugar on top of telnet and running your own encryption algorithms by hand on paper and typing in the results.
      • InfinityByTen 10mo ago
        At least postman is :P
    • SchemaLoad 10mo ago
      Tailscale is Wireguard but it automatically sets everything up for you, handles DDNS, can punch through NAT and CGNAT, etc. It's also running a Wireguard server on every device so rather than having a hub server in the LAN, it directly connects to every device. Particularly helpful if it's not just one LAN you are trying to connect to, but you have lots of devices in different areas.
    • lelandbatey 10mo ago
      If Plex is "just file sharing" then I guarantee you'd find Tailscale "just WireGuard". I enjoy that relative "normies" can depend on it/integrate it without me having to go through annoying bits. I like that it "just works" without requiring loads of annoying networking. For example, my aging mother just got a replacement computer and I am able to make it easy to access and remotely administer by just putting Tailscale on it, and have that work seamlessly with my other devices and connections. If one day I want to fully self-host, then I can run Headscale.
    • navigate8310 10mo ago
      Tailscale is able to punch holes in CGNAT which a vanilla wireguard cannot
    • BatteryMountain 10mo ago
      Setting up wireguard manually can be a pain in the butt sometimes. Tailscale makes it super easy but then your info flows through their nodes.
    • tech_ken 10mo ago
      Managing the wg.conf is a colossal PITA, especially if I'm trying to like provision a new client and don't have access to my main laptop. It's crying out for a CRUD app on top of it, and I think tailscale is basically that plus a little. The value add seems obvious. Also plex is way more than sugar on top of file sharing; it's like filesharing, media management, and a CDN rolled into one product. Soulseek isn't going to handle transcoding for you.
      • epistasis 10mo ago
        I use Tailscale for exactly those reasons, plus the easy SSL certificates and clients for Android and iOS. From this thread, I've learned about Pangolin: https://github.com/fosrl/pangolin https://github.com/fosrl/pangolin Which seems very compelling to me too. If it has apps that allow various devices connect to the VPN it might be worth it to me to trial using it instead of Tailscale...
• dangoodmanUT 10mo ago
  definitely, but to be fair, beyond that it's just linux. Most people would need claude code to get what ever they want to use linux for running reliably (systemd service, etc.)
  • dangoodmanUT 10mo ago
    i'm still waiting for ECC minipcs, then i'll go all in on local DBs too
    • aaronax 10mo ago
      Supermicro has some low power options such as https://www.supermicro.com/en/products/system/Mini-ITX/SYS-E300-9A-4CN8.php https://www.supermicro.com/en/products/system/Mini-ITX/SYS-E...
• drnick1 10mo ago
  I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Internet is meant to work.
  • CSSer 10mo ago
    The answer is people who don't truly understand the way it works being in charge of others who also don't in different ways. In the best case, there's an under resourced and over leveraged security team issuing overzealous edicts with the desperate hope of avoiding some disaster. When the sample size is one, it's easy to look at it and come to your conclusion. In every case where a third party is involved, someone is either providing a service, plugging a knowledge gap, or both.
  • sauercrowd 10mo ago
    People are not full time maintainers of their infra though, that's very different to companies. In many cases they want something that works, not something that requires a complex setup that needs to be well researched and understood.
    • buildfocus 10mo ago
      Wireguard is _really_ simple in that sense though. If you're not doing anything complicated it's very easy to set up & maintain, and basically just works. You can also buy quite a few routers now that have it built in, so you literally just tick a checkbox, then scan a QR code/copy a file to each client device, done.
      • vladvasiliu 10mo ago
        This may come with its own limitations, though. My ISP-provided router (Free, in France) has WG built-in. But other than performance being abysmal, its main pain point is not supporting subnet routing. So if all you want is to connect your phone / laptop while away to the local home network, it's fine. If you want to run a tunnel between two locations with multiple IPs on the remote side, you're SoL.
• comrade1234 10mo ago
  I just have a vpn server on my fiber modem/router (edgerouter-4) and use vpn clients on my devices. I actually have two vpn networks - one that can see the rest of my home network (and server) and the other that is completely isolated and can't see anything else and only does routing. No need to use a third-party and I have more flexibility
• PaulKeeble 10mo ago
  Its especially important in the CGNAT world that has been created and the enormous slog that IPv6 rollout has ultimately become.
• shadowgovt 10mo ago
  Besides the company that operates it, what is the big difference between Tailscale and Cloudflare tunnels? I've seen Tailscale mentioned frequently but I'm not quite sure what it gets for me. If it's more like a VPN, is it possible to use on an arbitrary device like a library kiosk?
  • ssl-3 10mo ago
    I don't use Cloudflare tunnels for anything. But Tailscale is just a VPN (and by VPN, I mean: Something more like "Connect to the office networ" than I do "NordVPN"). It provides a private network on top of the public network, so that member devices of that VPN can interact together privately. Which is pretty great: It's a simple and free/cheap way for me to use my pocket supercomputer to access my stuff at home from anywhere, with reasonable security. But because it happens at the network level, you (generally) need to own the machines that it is configured on. That tends to exclude using it in meaningful ways with things like library kiosks.
  • vachina 10mo ago
    You can self host a tailscale network entirely on your own, without making a single call to Tailscale Inc. Your cloudflare tunnel availability depends on Cloudflare’s mood of the day.
• SchemaLoad 10mo ago
  Yeah same story for me. I did not trust my sensitive data on random self hosting apps with no real security team. But now I can put the entire server on the local network only and split tunnel VPN from my devices and it just works. LLMs are also a huge upgrade here since they are actually quite competent at helping you set up servers.
• Melatonic 10mo ago
  Why not cloudflare tunnels ?
  • mobilio 10mo ago
    CF tunnels are game changers for me!
  • driton 10mo ago
    Even behind a tunnel, if you happen to be running an older version of a service (like Immich) with a known exploit, you are still vulnerable to attacks. Tailscale sidesteps this by keeping the service completely "invisible" to the outside world, so the two don't quite compare in my view.
• JamesSwift 10mo ago
  Just use subpath routing and fail2ban and Im very comfortable with exposing my home setup to the world. The only thing served on / is a hello world nginx page. Everything else you need to know the randomly generated subpath route.
• MattSayar 10mo ago
  Just be sure to run it with --accept-dns=false otherwise you won't have any outbound Internet on your server if you ever get logged out. That was annoying to find out (but easy to debug with Claude!)
• BatteryMountain 10mo ago
  Tailscale is a good first step, but its best to configure wireguard directly on your router. You can try headscale but it seems to be more of a hobby project - so native wireguard is the only viable path. Most router OS's supports wireguard these days too. You can ask claude to sanity check your configuration.
• johnisgood 10mo ago
  Tailscale does not solve the "falling behind on updates" problem, it just moves the perimeter. Your services are still vulnerable if unpatched: the attacker now needs tailnet access first (compromised device, account, or Tailscale itself). You have also added attack surface: Tailscale client, coordination plane, DERP relays. If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE" belongs there too. WireGuard gives you the same "no exposed ports except VPN" model without the third-party dependency. The tradeoff is convenience, not security. BTW, why are people acting like accessing a server from a phone is a 2025 innovation? SSH clients on Android/iOS have existed for 15 years. Termux, Prompt, Blink, JuiceSSH, pick one. Port N, key auth, done. You can run Mosh if you want session persistence across network changes. The "unlock" here is NAT traversal with a nice UI, not a new capability.
  • Galanwe 10mo ago
    > BTW, why are people acting like accessing a server from a phone is a 2025 innovation? > SSH clients on Android/iOS have existed for 15 years That is not the point, Tailscale is not just about having a network connection, it's everything that goes with. I used to have OpenVPN, and there's a world of difference. - The tailscale client is much nicer and convenient to use on Android than anything I have seen. - The auth plane is simpler, especially for non tech users (parents, wife) whom I wish to access my photo album. They are basically independent with tailscale. - The simplicity also allows me to recommend it to friends and we can link between our tailnet, e.g. to cross backup our NAS. - Tailscale can terminate SSH publicly, so I can selectively expose services on the internet (e.g. VaultWarden) without exposing my server and hosting a reverse proxy. - ACLs are simple and user friendly.
    • johnisgood 10mo ago
      You are listing conveniences, which is fair. I said the tradeoff is convenience, not security. > "Tailscale can terminate SSH publicly" You are now exposing services via Tailscale's infrastructure instead of your own reverse proxy. The attack surface moved, it did not shrink.
  • twelvedogs 10mo ago
• PeterStuer 10mo ago
  These are two very separate issues. Tailscale or other reverse proxies will give you access from the WAN. Claude Code or other assistants will give you conversational management. I already do the former (using Pangolin). I'm building towards the latter but first need to be 100% sure I can have perfect rollback and containement across the full stack CC could influence.
  • lee_ars 10mo ago
    I've started experimenting with Claude Code, and I've decided that it never touches anything that isn't under version control. The way I've put this into practice is that instead of letting claude loose on production files and services, i keep a local repo containing copies of all my service config files with a CLAUDE.md file explaining what each is for, the actual host each file/service lives on, and other important details. If I want to experiment with something ("Let's finally get around to planning out and setting up kea-dhcp6!"), Claude makes its suggestions and changes in my local repo, and then I manually copy the config files to the right places, restart services, and watch to see if anything explodes. Not sure I'd ever be at the point of trusting agentic AI to directly modify in-place config files on prod systems (even for homelab values of "prod").
• mtoner23 10mo ago
  People are way too worried about security imo. Statistically, no one is targeting you to be hacked. By the time you are important and valuable enough for your home equipment to be a target you would have hired someone else to manage this for you
  • fetzu 10mo ago
    I think this is very dangerous perspective. A lot of attacks on infra are automated, just try to expose a Windows XP machine to the internet for a day and see with how much malware you end up with. If you leave your security unchecked, you will end up attacked; not by someone targeting you specifically, but having all your data encrypted for ransom might still create a problem for you (even if the attacker doesn’t care about YOUR data specifically).
  • subscribed 10mo ago
    Oh, sure, no one is targeting me specifically. Its only swarms of bots and scripts going through the entire internet, including me. iptables and fail2ban should be installed pretty early, and then - just watch the logs.
  • johnfn 10mo ago
    Once, when I was young and inexperienced, I left a server exposed to the Internet by accident (I accidentally exposed a user with username postgres, password postgres). In hours the machine had been hacked to run a botnet. Was I stupid? Yes. But I absolutely wasn't a high-profile enough person to "be a target" - clearly someone was just scanning IP addresses.
  • cirelli94 10mo ago
    Crying inside myself after a crypto miner took my VM this past week.
    • ErikBjare 10mo ago
      And mine last year
• hexfish 10mo ago
  Is Tailscale still recording metadata about all your connections? https://github.com/tailscale/tailscale/issues/16165 https://github.com/tailscale/tailscale/issues/16165
• znpy 10mo ago
  > The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. In my experience this is much less of an issue depending on your configuration and what you actually expose to the public internet. Os-side, as long as you pick a good server os (for me that’s rocky linux) you can safely update once every six months. Applications-wise, i try and expose as little as possible to the public internet and everything exposed is running in an unprivileged podman container. Random test stuff is only exposed within the vpn. Also tailscale is not even a hard requirement: i rub openvpn and that works as well, on my iphone too. The truly differentiating factor is methodological, not technological.
• miki123211 10mo ago
  Now I wish there was some kind of global, single-network version of Tailscale... TS is cool if you have a well-defined security boundary. This is you / your company / your family, they should have access. That is the rest of the world, they should not. My use case is different. I do occasionally want to share access to otherwise personal machines around. Tailscale machine sharing sort of does what I want, but it's really inconvenient to use. I wish there was something like a Google Docs flow, where any Tailscale user could attempt to dial into my machine, but they were only allowed to do so after my approval.
  • fartfeatures 10mo ago
    Take a look at Zrok it might be what you want: https://zrok.io https://zrok.io
  • PLG88 10mo ago
    You have more or less described OpenZiti. Just mint a new identity/JWT for the user, create a service, and viola, only that user has access to your machine. Fully open source and self-hostable.
  • josecodea 10mo ago
    Tailscale Funnel, no? For the permissions, just add basic auth in the reverse proxy and choose whom to share the passwd with. Now if you want OAuth or something like that... well tough luck, you need to set up OIDC or whatever and that's going to be taking you some time, but it still works how you want.
• throwup238 10mo ago
  There’s also Cloudflare tunnels for stuff that you want to be available to the internet but dont want to open ports and deal with that. You can add an auth policy that only works with your email and Github/whatever SSO.
• josecodea 10mo ago
  Great! I have looked into this and I have a few questions though... Basically, I feel that tailscale does not make it very easy to set up services this way, and the only method I have figured out has a bit too many steps for my liking, basically: - to expose some port to the tailnet, there needs to be a `tailscale serve` command to expose its ports - in order for this command to run on startup and such, it needs to be made into a script that is run as a SystemD service - if you want to do this with N services, then you need to repeat these steps N times Is this how you do it? is there a better way?