I’ve been playing around with self hosting for file sharing, backups, and a handful of other ideas I might one day get round to. I like the idea of a mesh VPN and being able to, for example, connect a travelling laptop to a ‘host’ laptop nearby, though my only public ip is a VPS in another country.

Of all the options I found, I liked the look of Nebula most. Fiddly in some places, but it’s working nicely for me, and I appreciate some of the simplicity of design.

I’m wondering if people here have much experience of it, though? My biggest concern is over its future. With,

  1. The Defined Networking site focusing on making money off it, and
  2. The Android app doesn’t allow full configuration (including the firewall, so I can’t host a website from a phone) but - I heard - does if you use Defined Networking’s paid service for configuration,

makes me worry they might be essentially trying to deprecate viable FOSS Nebula in favour of a paid or controlled service.

Any thoughts? Insight?

  • Decronym@lemmy.decronym.xyzBEnglish
    4·
    2 months ago

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

    Fewer Letters More Letters
    DNS Domain Name Service/System
    IP Internet Protocol
    NAT Network Address Translation
    SSL Secure Sockets Layer, for transparent encryption
    SSO Single Sign-On
    TCP Transmission Control Protocol, most often over IP
    TLS Transport Layer Security, supersedes SSL
    UDP User Datagram Protocol, for real-time communications
    VPN Virtual Private Network
    VPS Virtual Private Server (opposed to shared hosting)

    10 acronyms in this thread; the most compressed thread commented on today has 18 acronyms.

    [Thread #951 for this sub, first seen 5th Sep 2024, 10:35] [FAQ] [Full list] [Contact] [Source code]

  • iso@lemy.lolEnglish
    4·
    2 months ago

    I’m using Headscale for work and Tailscale for personal use. I tried to use Nebula but it’s not easy as Tailscale.

    • bmcgonag@lemmy.worldEnglish
      4·
      2 months ago

      Headscale server, open source, self hosted, with the open source tailscale clients are the way to go.

    • milicent_bystandr@lemm.eeOPEnglish
      1·
      2 months ago

      Is Headscale easier than Nebula? I thought it looked like it might become much more work.

      Nebula was mostly easy, but had a few hurdles I needed to learn.

      • Setting up systemd. I think I had to look that up and write a startup thing for it. I might have copied one from Syncthing or something! I don’t remember right now.
      • firewalls confused me a couple of times
      • and I had to get the hang of the certificate system of course

      I have mixed feelings about trying Defined Networking’s managed config, but I imagine that would get round the learning curve of the config.

    • milicent_bystandr@lemm.eeOPEnglish
      1·
      2 months ago

      Does Tinc have advantages over Nebula? I was under the impression that both Nebula and Tailscale improved on Tinc, albeit in different ways.

  • uzay@infosec.pubEnglish
    2·
    2 months ago

    What made you choose Nebula over Tailscale? I’m running it through a self-hosted Headscale server and it’s working well so far. I haven’t looked into Nebula too much.

    • paperd@lemmy.zipEnglish
      3·
      2 months ago

      the core bits of nebula are all open source. With tailscale, there is headscale, but that is made by a tailscale employee and it feels ripe for a rug pull whenever tailscale feels like it. with nebula, the lighthouse and user clients are open, so there is far less chance of that.

      • uzay@infosec.pubEnglish
        2·
        2 months ago

        I see. That is a valid concern. Though it feels unfair to say that headscale is ‘made by a tailscale employee’. From what I understand, one of the main contributors of headscale was hired by tailscale, though he is not the only maintainer and does not own the repo from what I can tell. Still, Tailscale could decide to cede all support of headscale and that would likely hurt the project a lot. In the same way however nebula could decide to switch to proprietary licenses and discontinue their open source offerings.

        • paperd@lemmy.zipEnglish
          2·
          2 months ago

          In the same way however nebula could decide to switch to proprietary licenses and discontinue their open source offerings.

          Sure but you’d still have whatever the last commit was to nebula under the MIT license. It can be forked etc etc.

          I am sure headscale is great, but its a side project and if so inclined (not saying they are, tailscale seem quite generous), they could kill it a lot faster than Defined Networking could kill nebula. But its all a gamble.

    • milicent_bystandr@lemm.eeOPEnglish
      1·
      2 months ago
      1. Biggest thing was actually the sign up options. What if I don’t want my machines calling to Google or Microsoft to get access to Tailscale? I need to look up the other OIDC providers but don’t know much about that yet.
      2. Then the fact of Nebula being fully open source and fully on my machines. (Though that’s a little undercut by the Android problem being solved only by their managed service).
      3. Headscale gave me an impression of being more complicated to set up and maintain. Haven’t tried it yet, that was just my feel when I chose which one to try.
      4. More recently, I saw Nebula’s interesting post on performance benchmarks. At high throughout Tailscale can be better for CPU but heavier on memory. Hopefully at my sort of very low throughout it’s small on memory but if I’m squeezing a client into a cheap vps alongside nextcloud and other things, memory use is more concerning to me than CPU… I wonder how much memory Tailscale uses when not doing much.
  • paperd@lemmy.zipEnglish
    2·
    2 months ago

    I think nebula is really cool and am heavily considering it in production.

    Having a paid-for service that makes things easier is a good way to keep money going into the project, I think. And it feels a lot safer in terms of rug pull than tailscale/headscale. The android apps not being in fdroid and have some other limitations sucks… but I feel like those are easier to solve than some other issues that could be there.

    If you want tailscale, but not tailscale, check out netbird. You can self host the auth server and it isn’t some side project, the whole auth server is open.

    • milicent_bystandr@lemm.eeOPEnglish
      2·
      2 months ago

      I agree having a paid service, or some viable finance model, is a good sign for longevity …that said Nebula is what Slack use themselves so publicly or privately it’s going to be kept developed!

      Just the fact the Android client is only properly configurable if you use their managed config service, made me worry a bit. Even though Tailscale you’re signing up for more eggs in their basket (unless you use Headscale), it felt like at least you start out on that basis, you aren’t pushed into it unexpectedly.

      I do like that both projects talk politely about each other. That feels like a good sign for both!

      I’ll check out Netbird, thank you.

      • paperd@lemmy.zipEnglish
        2·
        2 months ago

        Honestly any of the three of nebula, tailscale, netbird, or even vanilla wireguard are all great choices and you can’t really go wrong.

        It wasn’t that long ago when it was openVPN or nothing ;_;

    • milicent_bystandr@lemm.eeOPEnglish
      1·
      2 months ago

      I don’t know a lot about Tinc, but it looked to me like both Nebula (directly inspired by Tinc) and Tailscale solve problems Tinc has, and improve on its excellent but older design.

    • GameGod@lemmy.caEnglish
      1·
      2 months ago

      Tinc has weird limitations and Wireguard completely obsoletes it. There’s zero reasons to ever consider using Tinc when Wireguard exists.

      • Possibly linux@lemmy.zipEnglish
        2·
        2 months ago

        Can Wireguard to NAT traversal? Let’s say I have a publicly facing server A and then two devices B and C behind two separate nats. Can B reach C directly via hole punching by A?

  • sugar_in_your_tea@sh.itjust.worksEnglish
    1·
    2 months ago

    I’m not sure what the point is? Here’s my setup:

    1. wireguard VPN on my edge VPS
    2. lots of services behind my router that connect to that VPN
    3. router DNS to resolve my domains to my internal services when on my LAN

    This gets me like 95% of the benefit of something like Nebula or Tailscale. When connecting to my internal services, I get LAN speeds if I’m on my LAN and WAN speeds if not. I initially started with Tailscale, but realized that I really didn’t care about most of what it provided.

    • ShortN0te@lemmy.mlEnglish
      1·
      2 months ago

      The benefits are obvious:

      • No port forwarding needed
      • Central Auth management
      • Easy integration of new devices

      Not saying you should do it or that it is better overall, but ignoring those is not fair.

      Personally i would never go for Tailscale since i give away the access control to my kingdom to a company. Exactly what i want to get away from through selfhosting.