Add Tailscale formula

[ben-grande]

Current problem (if any)

Remote management on restricted network is difficult:

• Tunneling SSH is difficult and requires a public managed node;
• Opening ports on the router and allowing traffic to flow to the self-hosted VPN; and
• Creating a hidden service with Tor or I2P is slow and can have credentials authentication (Onion Authentication) but easier than all the other self-hosted methods;

Proposed solution

Add tailscale.

Adding tailscale to a qube can be a security concern. Your OpenID provider can authenticate to your machine, but your can also use your own OpenID instance. Using Tailscale does not open ports to the internet, only your configured nodes can access it, so less dangerous than opening ports on your router in this metric.

The installation will of course be optional and restricted to the qubes you want to have it.

The value to a user, and who that user might be

Users can remotely manage remote qubes and non-qubes more easily without having to setup their tunnel, be it self-hosted VPN, VPS with SSH Tunnel or Hidden service with Onion Authentication.

.

[kennethrrosen]

Might be more appropriate here. #34 (comment)

[ben-grande]

Just an update on this. I have produced what I would say is an almost finished formula. I have not released it cause I didn't test as I didn't create a Tailscale account.

[kennethrrosen]

@ben-grande Happy to test with my account if that would be helpful.

[ben-grande]

Please test the formula. I created an account to test and it was useful... else I would deliver something broken as I had to fix some things.

[ben-grande]

@ben-grande Happy to test with my account if that would be helpful.

Can you please test?

[kennethrrosen]

Works as expected @ben-grande many thanks!

As a thought experiment, is there any concievable way of splitting this: say, having users connect a disposable to sys-tailscale mesh network without the disposable having tailscale itself?

[ben-grande]

Possible if following the Tailscale subnet guide, untested. Converting sys-tailscale to provide network also needs to be done.

The problem is some things needs to be done on the Admin interface rather than on the qube side...