Hacker News Reader

Comment by tinalumfoil | Hacker News Reader

While this is cool I've had luck just purchasing a domain (not that expensive), and manually setting up DNS through that.

Some advantages that this doesn't look like this would replicate, (1) I can have multiple domains for the same device, say gitea.mytsnetwork.com and netxcloud.mytsnetwork.com can go to the same device (2) I can get real HTTPS certificates for those domains which I consider necessary nowadays if only just to prevent errors (3) it's "real" DNS so when my browser decides to ignore my system settings and use DNS-over-HTTPS instead everything still works.

EDIT: It looks like (2) is solved by the tailscale cert command. I'd replace that point by saying owning the domain is important to controlling the certificate for me. All that said, the more I read into this, this looks like a really well thought-out feature.

View on HN

One downside of using tailscale cert, or LE for "private" records is that it writes the domain name in a public Certificate Transparency Log [1]. So make sure that the name doesn't contain any sensitive information.

An alternative is to issue wildcard certificates with LE, so that the subdomains names are kept private.

[1] https://crt.sh/

Yes, that's why we came up with the random-hex.ts.net domains and the tails-scales.ts.net domains. This makes less publicly recognizable things like `shark-harmonic.ts.net` get put into the certificate transparency log instead of something like "mycorporationname".

On a side note, is there a story behind acquiring ts.net or how much it cost to do so?

> An alternative is to issue wildcard certificates with LE, so that the subdomains names are kept private.

They'll still show up on crt.sh, though, won't they? All my LE subdomains are visible (non-wildcard) but also my non-LE paid-for 1-year wildcard ones are also showing up with all the subdomains.

Edit: Actually, nevermind, those are Cloudflare. My paid-for wildcard doesn't show up. Well, that's a good reason to pay up I guess.

If a certificate has been issued for a domain, and that domain doesn't show up in the certificate transparency logs, that's not something I'd cheer for: that issuer could just as well hand out certificates for your domain to others without you ever knowing about it.

Conversely, if a domain shows up in the CT logs, then there have been certificates issued for those domains, even if there exists a wildcard certificate that is valid for that domain. If that happens, check your settings, because there's probably something requesting certificates you're not aware of.

Just wait'll you see what's possible with Caddy+Tailscale (currently, and coming soon)!

> (1) I can have multiple domains for the same device, say gitea.mytsnetwork.com and netxcloud.mytsnetwork.com can go to the same device

I tried setting up caddy on a machine and then using caddy to reverse-proxy requests to each service i.e. `grafana.my-machine.tail-hex.ts.net` and `controller.my-machine.tail-hex.ts`

Obviously, `caddy` has no problem with the reverse proxy bit, but I did fail at being able to point multiple routes or subnet routes at the same machine via tailscle / magic-dns.

I'm sharing because it feels like something I should be able to do, and feel dumb not being able to figure it out.

This is exactly what we've been working on. Stay tuned ^^

Stoked!!

I'm just running a dnsmasq and using that to alias machines / workloads. For my network I needed to make sure a route to the dnsmasq IP is advertised by a subnet router and then I told tailscale to "override local dns" and make all tailscale clients use that dnsmasq IP as their DNS server.

I have a mix of bare machines and load-balanced workloads behind an nginx-ingress, all with names specified in the dnsmasq config, and because everything on the tailnet resolves names through dnsmasq (and routes through tailscale), everything works beautifully.

I'm still looking forward to this caddy integration, though.

Do tease!

Tailscale has supported real certificates via LE for over a year now:

https://tailscale.com/blog/tls-certs/

Tailscale's certs are 1-per-machine so if you want to do any kind of SNI-based certificate handling, you're out of luck and need to drop back to real public certificates anyway.

Reply on news.ycombinator.com