Tailscale or Netbird literally take 15 minutes tops to set up and get working. Then you just pick whatever services like SSH you want to use, have them accept connections only from Tailscale/Netbird IPs, and you’re gold.

I use Tailscale on my entire home lab, and with my friends and family for everything from Minecraft, to accessing my Jellyfin home media server, to accessing my parent’s home PC across the country to check updates and backups.

Fast, easy, free, and secure.

If I’m going to have to host my own infrastructure, I don’t want it tied to Bitwarden, given the new direction of the company.

I fully support Vaultwarden though, and I wish them well.

I’ll be going with KeyPassXC and Syncthing.

Well, we all know how this ends…

It’s a really sad day for me, I love Bitwarden, it’s easily the best password manager I’ve used, and I’m in IT, I’ve used a bunch.

Fuck private equity, fuck it to death. But until then, I’ll be moving my test setup for KeyPassXC into production over the coming weeks and months.

I was happily subscribed to Bitwarden for years for my personal account, I moved several people and a whole company onto it’s platform. We had a good run, time to move on.

There are different reasons to run different things. Some apps are not able to be run as containers, or don’t make sense to run containerized.

VMs offer better isolation between systems, which is important for high-security applications.

Traditional Hypervisors also allow you to easily run fleets of completely different OSes on the same hardware, which you can’t do with containers.

On the other hand, if you want/need high scalability, extremely efficient resource usage, and you don’t need to run radically different OS environments simultaneously, containers, especially Docker containers or Podman containers are a great choice.

Incus containers are a great middle ground that I’m a fan of more than Docker/podman containers or traditional VMs. They are system containers, vs application containers like Docker/Podman.

That means they are actually full-fledged Linux distros by default, but are still much smaller than a traditional VM.

Also, for any of these solutions, if you’re constantly doing admin tasks manually, you’re doing it wrong. All modern platforms have APIs or other ways to interact with them via code.

For my own setup, I have everything. My main server runs XCP-ng for the hypervisor, and I have several traditional VMs on it, including my primary NAS. I also run a virtual Incus host that I have my Minecraft server running in, and some random other system containers. I have a Docker host VM, but I don’t really use it.

I also have my home media server which is a standalone system running TrueNAS on bare metal with Tailscale and Jellyfin running as Docker containers within TrueNAS.

My setup is messy because it has been built slowly over several years, and I don’t have enough time or energy to rip it all down and put it back together in a more optimal way.

Check out Linode, it’s easy to use, reasonably priced, and as far as I know, hasn’t done anything disgusting.

Only downside is that they were acquired a little while ago by a publicly traded company, so the likwlyhood of enshitification is higher.

Totally agree, I threw a quick filter on some public domain, actual human artwork, and cropped it square. Took me as long as it would have taken to generate that slop logo.

Here’s the original source: Citation

For the love of anything even mildly good or wholesome…enough of the fucking AI slop images!

Finamp has been my goto for my music collection for several years. I know there are better solutions, but I’m not hardcore, I just want a simple app that streams my music from the server reliably.

The only thing that is a pain is getting all the tags and metadata correct, but there are lots of good apps to help with that also.

Ryzen 7 5800 X3D Radeon RX 9070XT 32GB of DDR4 system memory.

What local models have you been using? And what hardware are you running them on? I’ve been playing with local LLMs a bit for exactly your use case.

I have zero interest in vibe coding or full agentic workflows. But having a local LLM generate a Bash script to help me automate parts of my home lab infrastructure would be nice.

That’s a big one too, should catch lots of malware in that!

The Mullvad integration allows you to use Mullvad as your VPN for internet browsing while still being on your tailnet.

So normally, running two different VPN services can cause a bunch of problems, if it even works at all. Tailscale’s Mullvad integration fixes that.

Tailscale by itself is an overlay network. It’s literally a second network that your computer is connected to, but instead of it being a physical network with wires, switches, and routers, it’s a virtual network, a network that runs as software.

So imagine your computer right now at home. You plug into your router, and you have a local IP address, something like 192.168.1.20 right? If you run ipconfig on Windows or ip a on Linux, you’ll see your network adaptors listed with what their current IP address is. So if you’re running Windows, you’ll see your physical network adaptor listed with the IP address of 192.168.1.20

When you install Tailscale on that computer and log into your account, then run that command again, you’ll see a new network device listed, and it will have a totally different IP address, like 100.89.113.14

That is your Tailnet IP address, it works just like your “normal” IP address, but instead of it being a physical Ethernet adaptor on your motherboard and plugged into your home router, it is a virtual adaptor (software) running on your computer, connected to the Tailscale network, which has servers all around the world.

When you install Tailscale on a new device, say an old computer that you are using as a Minecraft server. That computer will get a new IP address on your tailnet, say 100.94.65.132

Because both of those machines were added by you to your own Tailnet, they can see and talk to each other by default. Meaning you could run a ping command from your home computer to your Minecraft server’s Tailscale IP, and it will respond.

Because this runs on the internet through Tailscale’s servers, you can do this from anywhere. That’s the “VPN” type functionality you are talking about. No matter where your home computer is, you can still access your Minecraft server because it is on your Tailnet, just as if it were still plugged into your router right next to you.

This is how I access my entire home lab from anywhere in the world. For example, I have a Jellyfin media server (like Plex) that I have a bunch of movies, TV shows, anime on. It’s running Tailscale and is on my Tailnet. I have Tailscale installed on my Android smartphone too.

So if I am staying at a hotel in another state, or visiting my family on the other side of the country, and I want to watch a movie or show that I have on my server all the way back home. I just run the Tailscale app on my phone, then open the Jellyfin app and I see all my home media right there on my phone and can watch it flawlessly. Even though I am at my parent’s house, on a totally different internet connection, 500 miles away from my home.

No, Tailscale is an overlay network. In it’s simplest form, it can act as a VPN. But it does much more than that.

Tailscale installs a virtual network device and allocates IP addresses to any device you install it on and sign in with your tailnet. Think of it as a virtual meshed LAN that runs on top of your physical network.

Tailscale becomes your control plane and provides advanced access control options for all your users and devices.

I use Tailscale and share out that server machine’s tailscale IP with just my gaming buddies.

But if you wanna live dangerously, you can port forward from your router to your internal mumble server.

I’ve got a Mumble server running on a little Linux container in my home lab.

Easy to set up and configure, very stable. Nothing special, it does what it is supposed to do, be a low latency, stable voip system, and it does great.

Netbird and Pangolin too.

Tailscale, Netbird, or Pangolin. Foss overlay networks have completely eliminated traditional VPN setups for my self-hosting needs.

Pay for your FOSS! I’ve paid far more for my FOSS than for any proprietary software.

If you believe in subscriptions, then subscribe only to FOSS software like Bitwarden, Tailscale/Netbird, etc.

Find your favorite FOSS projects on Open Collective and support them there.

And above all else, treat FOSS devs and maintainers with the utmost respect! They are the unsung heros who are building the only alternatives to the corpo-dystopian hellscape of proprietary, enshitified, slop software.

Send a message to a dev today, just saying thank you to them for everything, and asking if you can send them a tip if possible.

Folks, let’s treat each other lovingly please, FOSS has freed us, give back what you can, and never take it for granted.

To all the devs, maintainers, tinkerers, supporters, FOSS educators, and helpful community members across the FOSS world, thank you so much, and much love. ♥️

Buying my copy soon!

Aegis for time codes, Nitrokey for physical 2FA tokens.

Favorite heavyweight Type 1 hypervisor: XCP-ng. It’s open source, runs on a ton of enterprise and consumer-grade hardware, has always been rock stable for me, even when forgetting to update it for like 6 months, still ran everything like a champ.

I need to try ProxMox, has some cool features. XCP-ng is pretty intuitive though, UI makes sense and is cleaner than Proxmox. The integration in Proxmox with the Incus project is pretty cool though, especially being able to run VMs and containers and manage them together. I’ve been thinking of trying that and seeing how it goes.

For containers, I just install Debian and run Docker on there. Stable, simple, nothing fancy. If I need something more up to date, I typically use Ubuntu Server.