Hacker News Reader

You could just get a wildcard certificate with lets encrypt, via a dns challenge.

E.g. lego supports many different dns providers

https://go-acme.github.io/lego/

And then internally inside of tailscale you could have your own dns server, which serves subdomains of your domain, and for all subdomains you can use the same wildcard certificate.

This also does not 'expose' your subdomains on Certificate Transparency logs

View on HN

I had once ran dns server from pihole inside tailscale. Worked pretty decent, but latency was the issue and had reliability issue.

Cool thanks! I'll have to spend some more time looking into this. Do you have any recommendations for a DNS server to run inside Tailscale?

Depends, if you only want dns and nothing more, then probably dnsmasq. That's basically one of the most used dns/dhcp servers.

Otherwise you could use solutions like AdGuard Home or PiHole, which both have a Web Interface for configuration, and the ability to block ads and tracking domains.

Note that I don't use Tailscale myself, so I don't know if Tailscale 'needs' something else. But I use pure wireguard, and all of the services mentioned above work with 'pure wireguard'.

I can recommend pihole, it have a dns server, easy to use with web interface.

Reply on news.ycombinator.com