Hacker News Reader

Instead of installing tailscale in all VMs, the author should instead advertise the whole subnet using --advertise-subnet flag from a single VM

View on HN

I disagree. You lose out on granular permissions and magicdns.

I run a tailscale instance per service, even if the services are colocated in the same VM. This lets me take advantage of tailscale serve, and I can also move services between VMs without changing access or dns.

I use a mixture of --advertise-subnet on a dedicated tailscale VM to act as an exit node for when I'm away and ephemeral sidecars for everything I run in containers, this gives me magic dns but doesn't work with everything. I.e. I couldn't get a transmission-torrent container to download reliably with this setup and I have no idea why.

--advertise-subnet is a dream

Reply on news.ycombinator.com