Wrt the possibility of Tailscale being compromised, there's the in-beta tailnet lock feature:
> Tailnet lock lets you verify that no node is added to your tailnet without being signed by trusted nodes in your tailnet. When tailnet lock is enabled, even if Tailscale infrastructure is malicious or hacked, attackers can't send or receive traffic in your tailnet. [1]
> Tailnet lock is available for the Personal, Personal Plus, and Enterprise plans.
I've had the Device approval setting on, and wished there were more robust lock features, but not enough to want to run my own coordinator. So Tailnet lock seems like a good security upgrade.
https://github.com/tailscale/tailscale
I think there is some merit to setting up wireguard (e.g. you want more devices than what Tailscale offers for free, or their servers become unreliable for some reason)
But people who push the “scarey boogeyman will look at your data” with Tailscale are either technically illiterate or overly-paranoid.
This has further implications than just security. Also, whoever gets into self hosting already wants to not rely on others for the most part. If you didn't go into this for the tinkering aspect, I guess Tailscale is completely ok for most, perhaps even ideal.
Nevertheless, none of this has anything to do with the achievements or not of Tailscale. People saying that your own VPN is ok have a point.
Tailscale's complexity and features make sense when you have 200 nodes, or maybe 20 nodes at least. When you have 3-5 nodes, I think it's overkill, and a bunch of extra dependencies which may fail, and lock you out of your private nodes when you need it most.
> Headscale is a re-implemented version of the Tailscale coordination server, developed independently and completely separate from Tailscale. Headscale is a project that complements Tailscale — with its own independent community of users and developers. Tailscale does not set Headscale’s product direction or manage the community, and neither prohibits nor requires employees from contributing to Headscale.
I use a personal plan and have multiple nodes. Desktop, laptop, tablet, phones, docker containers just for me and a couple of raspberry Pis on my families home networks.
Only once have I been “locked out” of a node and that was due to an expired key.
Sure, for just connecting one node to another with a known IP and accessible port it’s overkill, but for anything more complex it an awful lot of awesome for very little effort.
It's far easier to set up, is much more reliable (e.g. when devices are behind firewalls), and uses direct (encrypted) connections when possible.
You can get it to do what you want with just a few clicks. Things like exposing a IoT VLAN on your Tailnet or setting up an exit node to tunnel all internet traffic through your home are super easy. You can even share specific devices with friends, which is super useful. If you have anything particularly sensitive (e.g. a notes app that you wouldn't want your children / partner to have access to), you can limit access to specific users / devices on the TS side, without bothering with implementing auth.
I think there's even a way to look up the user and device based on their IP, which is one way to add painless authentication to your apps. There are reverse proxies that do it and inject the info as HTTP headers.
If you aren't comfortable with trusting them with control over your network, you can always host your own Headscale server.