6 ms·
One of my primary use cases for tailscale/VPN is that I can happily run stuff (grafana, gitea, etc) and not have to be panicked about monitoring for CVEs - I se
by mnahkies 1mo ago
One of my primary use cases for tailscale/VPN is that I can happily run stuff (grafana, gitea, etc) and not have to be panicked about monitoring for CVEs - I serve it all over HTTPS but I don't want to put it on the public internet if I don't need to.
- preisschild 1mo agoI just have envoy proxy with the oauth + jwt filter in front of those services. Envoy does the oidc flow with pocket-id so I can use passkeys for authN. Envoy validates the resulting token and does authorization via ACL. Envoy then sends an authorization bearer jwt with the oidc id_token jwt to the backend (for example grafana). Grafana parses and validates the jwt and sets claims as userinfo (username, groups, email). I think such setups are at least as secure as having tailscale in front of it and they are web standards conform. I dont need a client app like tailscale, I can just use my normal browser and internet conn. I always make sure envoy/all other apps are on the latest security patcb anyways.
- mnahkies 1mo agoIt's funny you say that, as one of my weekend projects today is setting up https://www.authelia.com/ https://www.authelia.com/ to achieve the same. I probably won't allow everything through it (eg: postgres, clickhouse etc can stay on tailscale), but I've been stumbling into use cases where I want to share things with friends or colleagues, and I don't want to put them on my tailnet.
- preisschild 1mo agoYou can use the great oauth2-proxy as a forward auth proxy to archive that if you use nginx btw, i did that before envoy.