VPN Solution #17

New issue

Open

opened 2023-08-15 15:39:25 +00:00 by scott · 1 comment

scott commented

2023-08-15 15:39:25 +00:00

Owner

We should place internal tooling which doesn't need to be exposed publicly behind a VPN, as well as be prepared to do the same for infrastructure we host for clients. Our options are

Nebula
Tailscale (hosted)
Headscale (self-hosted tailscale)
Wireguard configured through nix configs

If we land on using Nix in #13, I would lean heavily towards Nebula or straight Wireguard. Otherwise, I've heard headscale is a good option.

What do we have experience with? I've used Nebula before but never stuck with it.

We should place internal tooling which doesn't need to be exposed publicly behind a VPN, as well as be prepared to do the same for infrastructure we host for clients. Our options are - Nebula - Tailscale (hosted) - Headscale (self-hosted tailscale) - Wireguard configured through nix configs If we land on using Nix in #13, I would lean heavily towards Nebula or straight Wireguard. Otherwise, I've heard headscale is a good option. What do we have experience with? I've used Nebula before but never stuck with it.

scott added this to the Internal infrastructure project 2023-08-15 15:39:25 +00:00

scott commented

2023-08-15 15:51:38 +00:00

Author

Owner

Headscale contains some jank WRT using the official apps:

After opening the app, the kebab menu icon (three dots) on the top bar on the right must be repeatedly opened and closed until the Change server option appears in the menu.

-- (from android)

The Windows app also requires editing the registry ❗so that's a non-starter for anything client-facing, especially since those apps are proprietary.

Lets take a closer look at Wireguard and see where we can go from there without trying to replicate the Tailscale service.

Headscale contains some jank WRT using the official apps: > After opening the app, the kebab menu icon (three dots) on the top bar on the right must be repeatedly opened and closed until the Change server option appears in the menu. -- (from android) The Windows app also requires editing the registry ❗so that's a non-starter for anything client-facing, especially since those apps are proprietary. Lets take a closer look at Wireguard and see where we can go from there without trying to replicate the Tailscale service.