What it is
Tailscale is a mesh VPN built on WireGuard. Each device you add gets a private address, and they reach each other directly and encrypted wherever they are, at home, in the office or on a phone hotspot, without opening ports on your router. A coordination server keeps track of which devices belong to your network; Tailscale’s own service can do that, or a self-hosted server such as headscale.
Why it’s here
- Reach your machines from anywhere. SSH, file shares and web apps on your other devices work as if they were on the same LAN.
- Self-hosted. On CoreDesktop it joins your Core’s headscale server, not a third-party account.
- Nothing to forward. Connections work through NAT and firewalls.
On CoreDesktop
Tailscale is installed from pacman, and its daemon, tailscaled, is enabled and started at install. Run configure tailscale (after configure core) to join your Core’s network: it signs you in through https://headscale.<your Core's domain> with a link it shows you, accepts the routes your Core advertises, and makes you Tailscale’s operator so you can control it without sudo. If the machine was on another tailnet, it moves it to your Core’s.
The firewall lets in everything arriving over Tailscale, while other incoming connections stay blocked. CoreDesktop also installs the Tailscale GNOME extension (tailscale-gnome@diskmth.fr), which adds Tailscale to the Quick Settings menu, and the Trayscale app. update keeps Tailscale current with the pacman packages.