I wish it would work on my kids! WireGuard is probably the right choice for most people. I'm experimenting with headscale but I'll see how it works out.
SQLite is actually quite fast even with heavy usage , the problem is that you usually want to run your DB and your App separately and that's a non-starter for sqlite. So if you are fine with running your app and db on the same system , sqlite is a good choice in my opinion.
Hi Jim, greetings from Brazil! I've been loving your content and rebuilding my homelab following your videos! I'm eagerly waiting for the video about Netbird, as I found the service very interesting. Keep up the good work!
Hi Jim. Thank you for your channel. It was one of the things why I decided to start my home server journey. It’s absolutely fantastic to have comprehensive information how to setup things. My setup is going great and growing every day. One thing I’m struggling now is how to structure my network regarding I’m being CGNAT. Your videos about NetBird and Headscale helped a lot. Could you consider to make a video for newbies with general overview how to structure setup for those pure things stucked without port forwarding. E.g. you have your docker containers, their networks, network of Proxmox VM, your Opnsense/Pfsense and VPS for self hosting NetBird/Headscale and maybe few more things in docker. How to configure flow of data, do you need to have reverse proxy at home and/or at VPS in this setup, do you need DMZ and so on. Just traffic flow and general structure, considering that all vms and basic networks already set up. It sounds like a lot but such video would be a lifesaver for those who just starting out and don’t understand why one needs certain things.
@@OM-rnd thanks, that's a good topic, I'll consider that (it's a little more difficult as I don't have that problem so I need to replicate). In my head I'd still be using a reverse proxy (DNS challenge) to make sure all services are SSL etc and play nicely within the browser.
Excellent demo Jim. I'm planning try all of the self hosted SDN options before I commit. Bit concerning that it's been 12 months since the last production release, i wonder if Netbird is more active.
Thank you for this compréhensive tutorial. I love your curated videos! Could you also make a video about nebula overlay network. This would be great! There are only very few tutorials to be found about it.
Perfect timing.....almost. I'm in the middle of doing what you're planning. I have a Synology NAS that I've been backing up to iDrive E2 block storage. I've maxed out the tier I'm on....and tired of paying $300US/yr. I bought a 16TB external USB drive and connected a Raspberry Pi4 to it and using is as an ssh remote target for Synology HyperBackups. I have a little vacation trailer on a lake and finally got a decent internet connection there so I'm going to use this as my offsite backups. Been looking for a solution better then a simple OpenVPN link. I like that this solution would give me access into the network there as well. I await your followup video on how you get that working...hope it's not too far in the future :)
@@AndrewHargreave it'll be the next video, but I'm also going to check out netbird as an alternative. I'd be careful with a USB, I'd certainly recommend a HDD over it (2 if budget permits).
Hi Jim. Love all your videos. Just wondering if you could please make a tutorial for installing OpenProject (as a Docker container) using Traefik as the load balancer? The official documentation only provides instructions for Nginx or Apache, and I'd rather use Traefik as I have no other need for those two and have plenty of other needs for Traefik, so would rather just use that if it's possible. Thanks for considering.
Are you comfortable using a deployment with alpha versions and spotty web UI? Provided you are going abroad and would want to have the most stability possible as in case it goes down your out of luck :/ Are you planning a redundant access like wire guard or the cloud Tailscale just in case? I really prefer selfhosted but I don’t know how polish this is.
Typically no, but it's very close to tailscale and semi supported. I do have fallback to WireGuard if needed. It's not me going on vacation, it's my mini server. That's why I'm setting this up so I can remote manage/use it.
@@Jims-Garage sorry I misunderstood what is going on vacation hahahah! Thanks for the response. I’m in a similar situation but it’s me who is going on vacation and got really paranoid about remote access to my homelab. And thought about the most robust solution considering I have a dynamic ip. A couple docker ddns containers updating a duckdns and a cloudflare dns to work with wireguard as it requieres an ip/domain to work. A wireguard docker+wireguard vm in another bare metal server just in case (I found the docker wireguard to have less performance, ok for ssh but lackluster for remote gaming) But what has never failed me was Tailscale, the home assistant raspberry with an addon, a docker Tailscale, a vm running Tailscale… no need to worry about dynamic IP or ports, and works every time, maybe not as performant as a direct connection to wireguard but good enough for ssh/webserver/troubleshooting
as always, high quality content and I was able to spin up headscale and register android and windows devices. I have one question though, what would be an advantage of running self-hosted headscale instead of using official one? I know free tier limits users and devices, but I wonder if there's any other good reason to run the headscale in my home server? again, thank you for the video!
@@kiloy1006 the real answer is not really, but it does help with privacy as tailscale won't know your node IPs. There is a case when traffic can be rooted through tailscale servers but even then it's end to end encrypted
On the exit nodes do you have to turn the feature on/off if you don't want to route all of the traffic between clients? For example if I watch youtube on client A does it go through client B? Basically can it do split tunneling to route only the home lab services and not the whole internet? Still waiting for that offsite NAS video btw ;)
@@Ogk10 thanks for the reminder, it's in the works! Whichever exit node you select, that is where traffic is routed through. You can split tunnel so that only local goes over the mesh VPN and internet is routed out locally.
If you delete a user, I think it deletes your devices. My plan is to have users tied to people and devices to their devices. I'm the admin, so the infrastructure is probably going to be tied to my user. Though maybe I'll make a user for myself and a user for admin separately? It's probably more important once you start adding ACLs.
Not recommended to newbie there head and tail will spin all day try it on simple but really easy to understand and you can tell the video is heavily edited most people like to see you do it on screen so they can follow your video.
@@HunterGeophysicsAustralia the IP is likely the first in the default range, the MAC is probably a similar thing (not sure why it's random though). Good spot!
thanks for the video, very detailed. There is a way to share some ip ranges of your internal network from headscale without installing tailscale or adding routes?
You simply need to change the proxy network to whatever network your proxy is on. If you don't have one check out the video I discussed (I use Traefik).
hello! thanks for your explanatory videos. i am unfortunately unable to access my internal services which are behind reverse proxy (traefik) through the headscale network, using the https address . (this address works locally, e.g without the tailscale network), if i use the ip address it works without any problems. any solution?
@@Jims-Garage thanks for your reply. unfortunately that is not working. i have changed the dns settings in the application to not using the tailscale dns, i also changed the dns settings of the config.yaml file, but without success. is that working for anybody?
Does headscale-admin work better if you uncheck "legacy api (headscale < 0.23)"? Because you're running the 0.23 alpha. I'd imagine the checkbox is for people who don't want to run the alpha.
@@Jims-Garage The api node access stuff _looks_ correct in the headscale-admin code at a cursory glance. Headscale docs say you need to be running headscale over TLS/https for remote access to work with 50443 open to allow in the rpc traffic. You're running behind traefik, but headscale itself is running through http, so that could possibly be a problem? If that was the problem, though, I don't know why headscale-ui would work but -admin wouldn't. I've just been looking into it for a very short period of time, though, so I don't know whether rpc is what they're using for the api. I don't run my headscale behind a reverse proxy, and it only works with https, and the api seems to be what headscale-admin is looking for, but I'm running v0.22.3, so unfortunately it's annoying for me to dig into it more without a big chunk of time.
How to do this on a NAS lets say Synology? Cant use ports like 80 there etc. And what if we dont use proxy as network? EDIT: Tried lots of things. But it wont work for me.
Change Hostname: sudo sqlite3 /var/lib/headscale/db.sqlite UPDATE nodes SET hostname = "new_hostname" WHERE given_name = "current_name_NOT_hostname"; ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Change ID: sudo headscale nodes rename -i ID # ID is the ID number of the device as shown in "headscale nodes list"
