#headscale

[rackmount-official-my-ass]

if anyone has set up a self-hosted virtual folded clos network (wireguard, vxlan, etc.) i'd be fascinated to hear how you did it. i'm trying to set one up for high availability and low maintenance but i keep running into things like wireguard not supporting multipath routing or vxlan needing port forwarding if one end is behind NAT.

i'm trying to achieve these goals:

redundant routing plane (so a VPS going down doesn't take down the whole network)

vanilla clients for mobile devices (i'm not a software dev)

clients include laptops, physical servers, phones, and containers/VMs behind a variety of NAT and firewall configurations out of my control

routers are VPSes, globally distributed

self-hosted

minimal configuration effort for new clients

wireguard doesn't enjoy anycast/multicast/redundancy very much. vxlan needs port forwarding apparently, although i haven't exhausted my search there yet. tailscale isn't self-hosted, and headscale has only experimental support for HA (and there's a bug in the tailscale iOS app that prevents working with headscale). ipsec and openvpn don't exactly have glowing reputations, but they're probably my next lines of investigation unless i can get something else working without manual firewall configuration.

[andmaybegayer]

tail:scaled

I can now hit my home network from anywhere on my phone, which is nice, makes my home nextcloud reachable which was the main thing I wanted, that way I can a) do syncs and b) have my full photo library everywhere. Using a headscale node running on my server rather than dealing with tailscale's free limitations.

I did consider just doing a manual wireguard setup and I might still depending on how this goes but the meshing features might be worth it all on their own.

Running Tailscale in a container on the server which is a little finicky, I'm actually subnet-routing out to the whole house which has upsides (I could WoL and SSH into my desktop from anywhere too) but is also kind of strange because it means that if I'm connected to the tailnet then 10.0.0.0/24 is routable even if I'm on mobile data.

[river-official]

Got distracted with setting up headscale instead. But now that works, so lets get back to Artix.

[cyberpriestess]

got headscale working, now time to figure out how to use it. internal services is easy - connect the system providing X service and assign it an internal subdomain. external-facing is a bit harder but I think there's an inbuilt feature for that ?