this post was submitted on 28 Oct 2026
224 points (100.0% liked)

Selfhosted

63543 readers
425 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
224
PSA: Update your Tailscale! (lemdro.id)
submitted 6 days ago by stratself@lemdro.id to c/selfhosted@lemmy.world
19 comments fedilink hide all child comments
 

Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.

For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.

Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don't need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.

Further links:

  • Tailscale's blogpost on findings and fixes, with security recommendations
  • Tailscale's security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
  • Their prior investigation notes here
you are viewing a single comment's thread
view the rest of the comments
[โ€“] Martineski@lemmy.dbzer0.com 2 points 6 days ago (1 children)

That's one of my TODOs on NixOS but I keep procrastinating on that. Today I finally set up adguard home locally on my PC and I want to make it available as a VPN(?) on my phone so I may finally get around to doing that soon-ish. I have zero clue how any of that works or how to set it up, however. Lol

[โ€“] xthexder@l.sw0.com 4 points 6 days ago

This seems like a decent guide on how to set it up:

https://www.cyberciti.biz/faq/how-to-set-up-wireguard-firewall-rules-in-linux/

It's very similar to the config I've got. The nat iptables stuff in step 1 is what enables wireguard to be used as a VPN exit node. (+ net.ipv4.ip_forward=1)