Syncthing Anywhere with Tailscale | Hacker News Reader

Syncthing Anywhere with Tailscale

init8.lol

86 pointstosh42 comments

> I somewhat don’t trust “cloud” providers and would avoid them as much as I can since my paranoid level is kinda high.

Syncthing has a new untrusted feature, which sends encrypted blobs to the nodes you set as being "untrusted" (i.e. nodes in the cloud)

Here's the specs on how it works: https://docs.syncthing.net/specs/untrusted.html

This works really well if you want to use a cheap VPS to ensure you always have a machine available to sync with/through.

I just recently tried using Tailscale IPs for all Syncthing nodes to add some privacy. It worked fine except for the Android phone, where Syncthing tried to start on the Tailscale static IP but hung because it wasn't available. That and having Tailscale use a significant amount of battery has convinced me to leave the Android connections dynamic.

Ah that's too bad. Running Syncthing over Tailscale would have been the main reason for me to install the latter.

I faced the same issue, especially with timeout error after providing the tailscale ip as "tcp://<ip4-address>:22000". I'm not sure how to resolve this and any help on this will be appreciated.

I wish I could help you, but I couldn't get Syncthing to start up so I ended up clearing the app storage and set up the devices and folder shares again. It wasn't too bad. If you have a backup you could try restoring from that in settings. I tried changing the IP back in config.xml but I couldn't browse to the file location using my file browsing app and gave up.

Isn't syncthing P2P all by itself? Why run it over something else? Is it encrypted or is its encryption suspect?

I'm also not a huge fan of the "put thing A on top of general purpose thing that can host all things of the same class as A" trope. Tailscale gives you a virtual network so you can run absolutely anything that speaks IP over it. It's like "how to run (insert random Linux service) in Docker" and similar blogspam.

Yes, it's P2P by default. It's all TLS-encrypted and I've not come across anything suggesting syncthing's implementation is suspect, since most of it is just using Go's libraries. You can also run your own (private or public) discovery and/or relay servers. I agree that this is adding in two additional levels of complexity, including managing an online account which could be compromised, just to avoid exposing a single service to the Internet. At first glance this seems to be undermining the idea of keeping the network secure.

One could even have the reverse proxy on port 80 forward requests to Syncthing on the inside.

To prevent any use of the relay servers and have them always connect. I disabled the relay on my syncthing services between laptop and work VMs. This means they only sync when the laptop is connected to VPN.

From the blog post:

> Tailscale here is optional as Syncthing does the NAT traversal for you and also uses a secure protocol. Syncthing will do its best to establish a peer to peer connection and that’s great!

> However, with Tailscale I can access my “shared directory” via SAMBA on my other devices, anywhere. And also don’t need any “Relay Server” only if my device can’t talk peer-to-peer as Tailscale will do it for me :))

"don't need any... only if.. can't"

this is so hard to parse, could you rephrase for clarity?

If only it was possible ot use Tailscale along normal Wireguard VPN. Because currently I stopped using Tailscale because I want to use ProtonVPN. Yes I know I can use an exit node, and connect the exit it self to Proton, but that adds amazing latency.

I switched to https://netbird.io/ for this exact reason.

Can you elaborate? Netbird looks like an exact copy of Tailscale. What makes Netbird a good fit for working next to ProtonVPN?

It allowed me to use a separate Wireguard tunnel with a VPN. I found that Tailscale wouldn't let me do that.

Any Details about how you did you do it ?, I used netbird before, but didn't know you can do that.

Also did they support mobile recently? I thought they still don't have Android/iOS support ?

Netbird is interesting! I only found out about them because their predecessor company made a cool SATA board for the Raspberry Pi 4.

Their community seems to be very small; so could you give a short review of what's better/worse about it vs. Tailscale?

If there was a company providing Syncthing-as-a-service I would very much sign up. I want the power of Syncthing (or similar) without the hassle of running a server myself.

Not sure about syncthing, but you can get hosted nextcloud as a service which provdies many (all?) of the syncing beefits in my experience.

Syncthing does not require a server. Syncthing is itself the server. The application (on either platform you want) connects directly to another device (i.e. peer to peer or P2P) and sends/receives the folders and files as you setup.

A syncthing server is used for discovery only, which is a free service.

All of the above is true, but I want to note that the GP might want to run a "server" (in reality, a third node) so he doesn't have to keep other devices online all the time.

I use my NAS for this, that way I don't need to keep my desktop turned on for my laptop to sync to it.

Ok but each “peer” needs to have syncthing installed, correct ?

That is, you can’t just point syncthing to any old sftp endpoint…

I think your parent means “the commercial endpoint” when he says “server” …

What is "the commercial endpoint"? There's no commercial offering of Syncthing.

Every peer needs to have syncthing installed, yes. This is how syncthing works. It's P2P (though there is the public relay servers for NATed peers).

Even if you ran your own relay network, every peer would need Syncthing installed.

What some users might want is an always-on node, so that device A could push to that always-on node and then device B could later download it without requiring device A and device B to be online at the same time, but what that node is, is really just a device C that's always on.

I think you're picturing Syncthing as being like a centralised file host that offers a client to sync to/from it, or maybe like something like Borg or restic. It's not that, there's no master node or central repo or anything.

Your grandparent was asking about a commercial syncthing as a service - see upthread …

Good grief. It's blatantly obvious that what's being discussed is "always online 3rd syncthing peer as a service".

This may become possible using the new Untrusted Device feature, allowing you to have a SyncThing client somewhere that hosts but cannot access your files. (https://docs.syncthing.net/users/untrusted.html)

I use this feature with a friend of mine. We both have NAS', and we both have each other's NAS as an untrusted SyncThing device. (It's also pretty trivial to run a Linode/DigitalOcean low end VPS as an untrusted client. In fact if neither has a one-click install I'd be surprised.)

Yo that would be perfect. All the advantage of the cloud without the privacy concerns.

Syncthing is P2P, you're not meant to run it on a server in the cloud. You run it on each device like your laptops, your NAS, your desktop computers, etc. and it will connect each of them together P2P to share files. You can of course run a server in the cloud that is always on and sharing your files but it's not the primary or required way to use syncthing.

Doesn't MEGA do something similar? Don't know what OS support it has though.

Sidenote: I find it interesting that Syncthing kind of implements a purpose-specific software defined network by itself with its discovery and relay protocols. I'm guessing that's because Syncthing has been around for longer than accessible SDN solutions have existed?

Also makes me wonder how much Syncthing could be simplified if it could assume all devices have a fixed IP address and direct connectivity.

pretty much every p2p project ends up with a layer that does this to circumvent routing issues. what are the accessible SDN solutions you have in mind? for mina, i chose to use libp2p, although we haven’t enabled relay because the security and cost model is a bit scary. it will happen for the browser implementation i think.

What I meant with "accessible SDN solutions" are things like Tailscale, ZeroTier, Nebula or one of those WireGuard key/route distribution servers which a few people have implemented in slightly different ways. (There used to be a good comparison of some of those but I can't find it anymore.)

P2P programs where connections between devices with no common ownership/coordination don't matter (i.e. Syncthing if you're not sharing with other people) could ditch that layer and rely on an external SDN now that they've become easier to use. Of course, that makes those programs potentially less flexible and it requires users to set up another thing™ so I understand why developers of P2P programs might not wanna do that. But in theory it would be nice because we could have all SDN concerns in one system and not duplicated in every program that needs global discovery/connections.

https://web.archive.org/web/20220807141055/https://init8.lol...

> assuming I’m not interested yet in a commercial “Zero Trust Network” solution that maybe tunnels any TCP/UDP packets through a commercial reverse proxy because the packets are not end-to-end encrypted.

This isn’t (always) true. Some solutions are E2E encrypted.

or stand up Headscale yourself.

https://github.com/juanfont/headscale

Set up*

"Stand up" is jargon for creating an instance of a service and bringing it online.

Among "stand"'s many meanings, it can be a transitive verb meaning to put something in a standing or upright position. For example, my electric toothbrush has a flat bottom, so I can lay it down on its side or stand it up on its end. So, basically "stand up" is a lot like "erect" as in "erect a fence along the property line".

Been using it for at least 6-8 months. Works well everywhere, last I checked didn't work on iOS devices due to the Tailscale client not caring about the custom preferences loaded.

Not a problem for me, the only Apple devices I have are not iOS but I'd imagine a dealbreaker for some.

> Some solutions are E2E encrypted.

Which ones do you mean?

With Tailscale, the data channel runs over WireGuard, so it's encrypted between clients but the keys are exchanged over the control plane without end-to-end authentication, as far as I know.

ZeroTier I don't know much about. Does it have some kind of end-to-end key?

Nebula (from Slack) uses certificates, so it does make devices on the live network effectively trustless.

Isn’t Tailscale similar to the Zerotier which can build a virtual LAN across any networks?

I guess for a single user this doesn't do much (other than redundancy)? As being offline for a while with Syncthing will just resync when back at home?

No sync you

Reply on news.ycombinator.com