In my last post, my SSH keys moved off disk and into 1Password. This one is about the network those keys travel over, and the foundation: Tailscale.
Here's the before, and it wasn't pretty. A homelab box behind my router. A VPS somewhere I'm still paying for. My laptop on some coffee shop WiFi, my phone on cellular, and a couple of machines stuck behind a CGNAT with no real public IP at all. Getting any of them to talk to each other meant port forwarding, firewall rules, a dynamic DNS record I'd always forget to update, and a spiral-bound notebook consisting of every IP address in my house. Reaching my homelab from outside the house was a small side quest every single time.
Tailscale deleted all of it. Every device I own now sits on one flat private network, addressable by name and reachable from anywhere, from my closet to the far side of the planet.
What it actually is
Tailscale is a mesh VPN built on WireGuard. You install the client on each device, sign in with an identity provider (Google, GitHub, whatever you already use), and the device joins your private network, your tailnet. It picks up a stable 100.x address and a name through MagicDNS, so instead of memorizing IP addresses I type the hostname like a civilized person.
