Hacker News Reader

Comment by haswell | Hacker News Reader

What are the primary downsides of self-hosting this? The top issues that come to mind:

1. Maintaining high availability

2. Dealing with patches/upgrades

But I'm also really curious how likely a self-hosted instance is to be an attack vector potentially more dangerous than using something like Tailscale.

View on HN

> 1. Maintaining high availability

In my experience as a poor sysadmin (as in, bad), you don't /need/ HA for Headscale because the clients are pretty resilient. I've had my instance go down for a little bit and it's fine. Stale and new connections aren't, obviously, but it will work well enough that you won't realize Headscale itself has gone down until a while after it did.

My experience has been the opposite: I have to restart headscale at night because a significant %age of the time when I do, the tailnet goes down. I'd say maybe 30% of the time, maybe more. I'm talking about when I update ACLs and OS updates. I run a single instance, and I will say it's been reliable over ~2 years. For the record, I just rebooted that node for OS updates and the tailnet stayed up.

Probably fine for a home lab, I don't think its fine for a production organisation running critical services across the overlay.

You own your attack surface at that point. Tailscale/Headscale is a matchmaker and key broker for the most part, the clients almost always (barring NAT issues) connect directly to one another. The normal security considerations apply as with running any service.

Reply on news.ycombinator.com