Tailscale: Difference between revisions

From NixOS Wiki
imported>Cablespaghetti
Notes about DNS issues
imported>Mekanoe
Adds userspace-networking method
Line 38: Line 38:
$ sudo tailscale --socket{{=}}${STATE_DIRECTORY}/tailscaled.sock up --auth-key{{=}}tskey-key-MYSERVICE_KEY_FROM_TAILSCALE_ADMIN_CONSOLE --hostname{{=}}MYSERVICE --reset
$ sudo tailscale --socket{{=}}${STATE_DIRECTORY}/tailscaled.sock up --auth-key{{=}}tskey-key-MYSERVICE_KEY_FROM_TAILSCALE_ADMIN_CONSOLE --hostname{{=}}MYSERVICE --reset
}}
}}
==Using Userspace Networking (experimental)==
Tailscale inside containers can use [https://tailscale.com/kb/1112/userspace-networking userspace networking mode] to avoid needing host tunnel device permissions.
This can be accomplished by setting <code><nowiki>services.tailscale.interfaceName = "userspace-networking";</nowiki></code> in your NixOS config.


{{Expansion|
{{Expansion|
* Set up Systemd services for the additional host names
* Set up Systemd services for the additional host names
}}
}}

Revision as of 22:51, 10 February 2024

From Official Website

Tailscale makes networking easy

Tailscale lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.

Basic setup

Enabling tailscale is as simple as adding services.tailscale.enable = true; to your Nix config.

If you are using features like subnet routers or exit nodes you will also need to set services.tailscale.useRoutingFeatures to "server", "client" or "both" depending on the role of your machine.

Configuring TLS

Per Enabling HTTPS in the Tailscale documentation, run the following:

$ sudo tailscale cert ${MACHINE_NAME}.${TAILNET_NAME}

Known issues

If you encounter issues with IPv6 not working through your NixOS-based exit node, this might be an issue with the tailscale client's detection of whether IPv6 NAT is supported. This is the "checkSupportsV6NAT" function in the tailscale codebase. Enabling networking.nftables.enable = true; and then rebooting may fix this issue if you are using iptables.

There is also a known issue with DNS when using the default NixOS configuration; see GitHub issue 4254. Enabling systemd-resolved seems to be some part of the solution to this problem, as well as ensuring that DHCP is not enabled on the "tailscale0" network interface. Please see the GitHub issue for more information.

Running multiple Tailnet-accessible services on a single machine

The essence is to run multiple tailscaled daemons on a machine, with the additional daemons using userspace networking rather than tun, which seems to intercept connections to all Tailscale IPs on a machine. Basically for an additional service MYSERVICE run the following commands:

$ STATE_DIRECTORY=/var/lib/tailscale/tailscaled-tt_rss
$ sudo mkdir -p ${STATE_DIRECTORY}
$ sudo env STATE_DIRECTORY=${STATE_DIRECTORY} tailscaled --statedir=${STATE_DIRECTORY} --socket=${STATE_DIRECTORY}/tailscaled.sock --port=0 --tun=user
$ sudo tailscale --socket=${STATE_DIRECTORY}/tailscaled.sock up --auth-key=tskey-key-MYSERVICE_KEY_FROM_TAILSCALE_ADMIN_CONSOLE --hostname=MYSERVICE --reset

Using Userspace Networking (experimental)

Tailscale inside containers can use userspace networking mode to avoid needing host tunnel device permissions.

This can be accomplished by setting services.tailscale.interfaceName = "userspace-networking"; in your NixOS config.