Tailscale: Difference between revisions

(6 intermediate revisions by 3 users not shown)

Line 1:

~~From [https~~:~~//tailscale.com Official Website]~~

== Basic setup ==

To enable Tailscale, add the following to your configuration:

~~<blockquote>~~

{{File|3={

~~Tailscale makes networking easy~~

services.tailscale = {

enable = true;

# Enable tailscale at startup

~~Tailscale lets~~ you ~~easily manage access~~ to ~~private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.~~

# If you would like to use a preauthorized key

</~~blockquote>~~

#authKeyFile = "/run/secrets/tailscale_key";

== ~~Basic setup ==~~

};

~~You need to~~

}|name=/etc/nixos/configuration.nix|lang=nix}}

# ~~make an account and~~ login ~~at https:~~/~~/login.tailscale.com (~~or ~~self-host a compatible [https://github.com/juanfont/headscale Headscale] service;~~ also ~~available NixOS)~~

After enabling, you can login to your Tailscale account with:<syntaxhighlight lang="console">

~~# enable the Tailscale client app on your NixOS machine by adding~~ <code><nowiki>services.tailscale.~~enable = true;~~</nowiki></code> ~~and access tokens~~ to your ~~NixOS configuration~~.

# tailscale login

</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

~~If you are using features like subnet routers or exit nodes you will also need~~ to ~~set~~ <code>~~<nowiki>~~services.tailscale.~~useRoutingFeatures</nowiki>~~</code> ~~to "server", "client" or "both" depending on the role of your machine~~.

For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .

== Split DNS~~: Access self-hosted services at your friends house as if you were there.~~ ==

== Split DNS ==

Tailscale ~~support~~ "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. ~~you~~ friend's house) as if you are in that local network.

Tailscale supports "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. your friend's house) as if you are in that local network.

See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE

Line 25:

Line 29:

== Configuring TLS ==

{{Expansion|

* Set up Systemd service to run this command at regular intervals to avoid cert expiration.

* Show how to run for multiple services on a single machine.

}}

Per [https://tailscale.com/kb/1153/enabling-https/?q=tls#provision-tls-certificates-for-your-devices Enabling HTTPS in the Tailscale documentation], run the following:

Line 41:

Line 50:

services.tailscale.permitCertUid = "caddy";

</syntaxhighlight>

~~{{Expansion|~~

* Set up Systemd service to run this command at regular intervals to avoid cert expiration.

* Show how to run for multiple services on a single machine.

}}

== Known issues ==

Line 55:

Line 58:

=== DNS ===

There is also a known issue with DNS when using the default NixOS configuration; see [https://github.com/tailscale/tailscale/issues/4254 GitHub issue 4254]. Enabling [[systemd-resolved]] seems to be some part of the solution to this problem, as well as ensuring that DHCP is not enabled on the "tailscale0" network interface. Please see the GitHub issue for more information.

=== No internet when using exit node ===

When you turn on exit nodes, NixOS's reverse path filter immediately starts dropping all incoming traffic related to wireguard tunnels, tailscale's control plane connection, etc. etc.

The quick fix for NixOS users is to set the following option in your NixOS config:

<code>networking.firewall.checkReversePath = "loose";</code>

[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]

== Running multiple Tailnet-accessible services on a single machine ==

@@ Line 1: / Line 1: @@
-From [https://tailscale.com Official Website]
+== Basic setup ==
+To enable Tailscale, add the following to your configuration:
-<blockquote>
+{{File|3={
-Tailscale makes networking easy
+  services.tailscale = {
+    enable = true;
+    # Enable tailscale at startup
-Tailscale lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.
+    # If you would like to use a preauthorized key
-</blockquote>
+   #authKeyFile = "/run/secrets/tailscale_key";
-== Basic setup ==
+  };
-You need to
+}|name=/etc/nixos/configuration.nix|lang=nix}}
-# make an account and login at https://login.tailscale.com (or self-host a compatible [https://github.com/juanfont/headscale Headscale] service; also available NixOS)
+After enabling, you can login to your Tailscale account with:<syntaxhighlight lang="console">
-# enable the Tailscale client app on your NixOS machine by adding <code><nowiki>services.tailscale.enable = true;</nowiki></code> and access tokens to your NixOS configuration.
+# tailscale login
+</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.
-If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.
+For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .
-== Split DNS: Access self-hosted services at your friends house as if you were there. ==
+== Split DNS ==
-Tailscale support "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. you friend's house) as if you are in that local network.
+Tailscale supports "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. your friend's house) as if you are in that local network.
 See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE
@@ Line 25: / Line 29: @@
 == Configuring TLS ==
+{{Expansion|
+* Set up Systemd service to run this command at regular intervals to avoid cert expiration.
+* Show how to run for multiple services on a single machine.
+}}
 Per [https://tailscale.com/kb/1153/enabling-https/?q=tls#provision-tls-certificates-for-your-devices Enabling HTTPS in the Tailscale documentation], run the following:
@@ Line 41: / Line 50: @@
 services.tailscale.permitCertUid = "caddy";
 </syntaxhighlight>
-{{Expansion|
-* Set up Systemd service to run this command at regular intervals to avoid cert expiration.
-* Show how to run for multiple services on a single machine.
-}}
 == Known issues ==
@@ Line 55: / Line 58: @@
 === DNS ===
 There is also a known issue with DNS when using the default NixOS configuration; see [https://github.com/tailscale/tailscale/issues/4254 GitHub issue 4254]. Enabling [[systemd-resolved]] seems to be some part of the solution to this problem, as well as ensuring that DHCP is not enabled on the "tailscale0" network interface. Please see the GitHub issue for more information.
+=== No internet when using exit node ===
+When you turn on exit nodes, NixOS's reverse path filter immediately starts dropping all incoming traffic related to wireguard tunnels, tailscale's control plane connection, etc. etc.
+The quick fix for NixOS users is to set the following option in your NixOS config:
+<code>networking.firewall.checkReversePath = "loose";</code>
+[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]
 == Running multiple Tailnet-accessible services on a single machine ==