I rely on the bundled file sync service on my network attached storage (NAS) appliance to work across my devices. I recently added a MNT Pocket Reform to the set of devices I use regularly. The Pocket Reform is a lovingly hand built and supremely open mini laptop with a seven inch display and a clacky, ortholinear keyboard. The sync service on my NAS has clients for the rest of my devices. The mini laptop has a different CPU architecture from the rest of my Linux machines and hence no compatible client. Figuring out an alternative started a fun incidental project a few weekends ago that lead to some interesting learning.
To answer the original question simply, the alternative I found is syncthing. There are clients for everything, including my mini ARM laptop and my NAS. That worked fine with everything on my local network. I had the bundled service set up to work through port forwarding when away from home. Port forwarding is brittle and I wondered if I could use tailscale in some way to avoid it while getting syncthing working while out and about.
endeavorance introduced me to tailscale a while ago. I really starting using it to access my desktop machine from the mini-laptop when I brought it along to my regular visits to my favorite local taproom. With syncthing on my NAS, adding tailscale supports it working anywhere. To get syncthing to use tailscale, you can edit your remote devices after adding them. In the advanced settings, for addresses replace dynamic with tcp://<tailnet name or address>:22000. syncthing will use that address as well as the usual autodiscovered ones to find and connect with any remote devices.
tailscale is virtual networking simple enough for regular people. On your phone or computer it acts like a VPN and the private network it connects to contains all the other devices you've logged in. This virtual private network is also called a tailnet. Under the hood tailscale works similar to The Tor Project, encrypting traffic with device specific keypairs so that it is secure even from the operators of tailscale.com and any network your device might be on otherwise.
Creating a new tailnet only requires signing up. Add a device varies a little but is as simple as possible in all cases. The dashboard is web based and well documented. Everything so far I've tried has just worked.
Getting syncthing and tailscale working on my NAS I discovered my NAS has beta container support. I realized I could use my tailnet to access services running as containers anywhere. I was able to get pihole running almost as easily as syncthing. tailscale even lets me set that service as the preferred DNS for all devices on my tailnet automatically. I went from not really knowing how to best use tailscale to having a couple of essential use cases.
I've been interested in pihole for a while. Developed originally to run on a raspberry pi, it is a name server that basically black holes lookup requests for domains known to be part of ad networks. Ad blocking but at the network level.
Getting pihole working made up for another phone specific tradeoff with this set up. Android can only run one VPN client at a time. I had to give up DuckDuckGo's app tracking protection to run tailscale on my phone. Adding pihole to my tailnet as the default DNS server more than made up for that sacrifice.
My sole complaint was that my tailnet was tied to my Github account. I would strongly prefer to use my own forge instead. Forgejo has OpenID connect support and tailscale supports using it. To get it all working required a bit of work but was pretty straightforward.
tailscale uses your email to query a well known URL at your email's domain to figure out what OIDC provider to use. The tailscale docs explain what files you'll need and generally what they need to contain, a link to an issuer. This webfinger file is the same one you can use for other interesting purposes like having a Mastodon handle with your own domain regardless of the server you are on. You can get the value to use for this link from Forgejo by visiting https://yourforge.net/.well-known/openid-configuration. tailscale supports any compatible identity provider. The point of this URL is that even if you use another OIDC compatible service, like keycloak, you can simply substitute the domain of your provider, the path is standard, hence it being .well-known.
Once you add the needed file at your domain, tailscale should then prompt you for your client ID and secret. You generate these in Forgejo, either for you as a user in your own settings or I did it under site administration for everyone because I wanted to add Andrea as her own user to my tailnet, mostly because I can. If you use another identity provider, there should be a similar place to create a new client configuration. If you created the OAuth app correctly then tailscale should redirect to your forge where you may need to login then you authorize tailscale to use the app. After that, sign into tailscale with your email and it will trigger a federated login, if needed, with your Forgejo server.
I am sure I will be writing more about my home lab now that I can experiment with new services for free including taking them for full test drives while roaming. tailscale also allows me to decide if I want to self host something on the public net or keep it secure and private for me, my family, and with advanced tailscale configuration my friends.
Posted in #tech #resilience #hands-on