Goofed Home

Playing around with a new self-host NAS OS, finally thought about Tailscale. But, I see it wants a login to an account. Checking online, seems I have to use Google, Apple, MS, Github or OIDC (which iassume costs money based on the site).

So how tf y’all setting to your tail scale stuff? I’m not using a big brother us tech account for auth on this thing. Think I’d rather go back to regular wireguard if that’s the case.

I avoided tailscale for so long because I was already using wireguard and I didn’t know you could self-host with headscale. But once I started using it with headscale the mesh design really is a big improvement to usability. I don’t miss having to carefully manage my config files and ip route rules.

I need to get setup with app connectors and then I think it’ll finally be a high enough wife-usability factor for me to remove some things I still have exposed over the internet.

Thanks for explaining. I really didn’t mean it as a Headscale v Tailscale. kind of thing as far as data security goes. I’ve heard a lot of great things about Headscale. OP was just worried about his data being compromised, and I was just pointing out that it’s pretty tight.

yep… I write all my papers in Google because I can access the files anywhere, and nothing beats PaperPile for referencing yet.

I recall spreadsheets being particularly painful on mobile when I’d try to select multiple rows and it would select way more at a time but would need to fouble-check that or find a screen recording if I made one at the time.

The main issues is there was a bug where if there is an open session for a document in Collabora (including dead sessions say from mobile) and that Collabora server is shut down in the wrong order, then all changes including if you click “Save” will be lost. A bug was opened for this and closed by making sure the servers shut down in the correct order, but I don’t know if that fixes cases where the servers a hard shutdown.

Maybe you already figured this out but I think it’s a common gotcha:

Wireguard AllowedIPs means just that: IPs that are allowed to be routed over the tunnel.

There is nothing that says that you need to have 1-to-1 mapping between that and actual routes. Most of the time it’s what you want but there are situations where you want it different.

wg-quick additionally adds corresponding ip routes as a convenience. systemd-networkd did at some point but don’t anymore. I’m not sure what NetworkManager does there these days.

Anyway, it’s an understandable source of confusion and the tools don’t always help.

You found the right workaround.

The Arch Wiki calls this “Loop routing,” where NetworkManager attempts to route traffic to the WireGuard peer’s endpoint through the tunnel itself, creating a routing loop. This occurs because the endpoint IP gets matched by the AllowedIPs ranges, causing the kernel to send handshakes over the tunnel interface instead of the physical interface. Excluding the peer endpoint from AllowedIPs is the standard fix.

Here’s the ArchWiki link (for future readers mostly, you already got it :P): https://wiki.archlinux.org/title/WireGuard#Loop_routing