Apps / Network

Tailscale

The easiest, most secure way to use WireGuard and 2FA.

Puts this box and your laptop and your phone on one private WireGuard network, wherever any of them happen to be. No port forwarding, no dynamic DNS, and it works from behind carrier-grade NAT where a normal VPN cannot. Advertise this box as a subnet router and the whole LAN comes with it.

Installing it

Open the dashboard, go to Apps, press Add on it and apply the change. Or from a terminal on the box:

sudo homebox install tailscale

Good to know

• Generate an auth key at login.tailscale.com under Settings then Keys, and paste it into Settings here. A reusable key survives a container rebuild; a one-off does not
• To reach the rest of the LAN, not just this box, set the extra arguments to --advertise-routes=192.168.1.0/24 and approve the route in the admin console
• This is the alternative to the VPN module, not a companion to it: WireGuard here means you run the coordination, Tailscale means they do
• It runs on the host network with NET_ADMIN and its own tun device, because that is what building a network interface takes

View this app's definition on GitHub