| 26 Jul 2025 |
 ElvishJerricco | Zhaofeng Li: does that sound like what you're thinking? | 07:37:49 |
 Zhaofeng Li | yeah exactly, and you can add some ad-blocking hosts files while you are at it too | 07:39:00 |
| ElvishJerricco | that is still frustratingly manual, but at least the dns is private | 07:39:38 |
| Zhaofeng Li | yeah it does take some setup but should be manageable | 07:41:39 |
 K900 | In reply to @elvishjerricco:matrix.org
oh I see. You can add a nameserver in the control plane ui, and I could just point that at one of my tailscale machines and have that distribute custom records for a domain I own, then get certs manually for that domain with LetsEncrypt I just do normal ACME with DNS challenge | 07:41:42 |
| Zhaofeng Li | (well I feel like a hypocrite saying this because I don't do it myself :p) | 07:41:53 |
| Zhaofeng Li | I personally don't care about the private DNS part, like my miniflux is at news.naive.network which is publicly resolvable but it points at a tailscale address | 07:43:09 |
| ElvishJerricco | yea sure I said "manual" but I just meant "tailscale's not going to provision it for me" | 07:44:54 |
| K900 | Wait Tailscale can do that? | 07:46:53 |
| ElvishJerricco | tailscale serve? | 07:47:04 |
| ElvishJerricco | it basically just does an https proxy and handles getting the cert for $machine.$net.ts.net automatically | 07:47:58 |
| Zhaofeng Li | yeah, it's pretty convenient but one cert per device and you can't really control the $net part | 07:48:22 |
| ElvishJerricco | that's what makes sidecars attractive; you just hit the button and it does all the stuff | 07:48:23 |
 magic_rb | my bpi is officially running openwrt 🥲 | 13:58:12 |
| 27 Jul 2025 |
 antifuchs | In reply to @elvishjerricco:matrix.org
the point being that one machine can have a variety of services each with its own e.g. https://jellyfin.my-net.ts.net I wrote tsnsrv for that purpose: https://github.com/boinkor-net/tsnsrv | 00:57:52 |
| antifuchs | Best thing about it is that you can define acls for specific services that way too | 00:58:27 |
| antifuchs | * Best thing about it is that you can define acls for specific services that way too (as opposed to ports alone) | 00:58:50 |
| ElvishJerricco | ooh this is interesting | 00:59:37 |
