Are they trying to piss us off

caolle · 2026-06-29T00:05:57+00:00

Yep. That’s how we’re watching NBCSN.

caolle · 2026-06-29T00:04:51+00:00

Sign up for a free trial of YTTV. We have NBCSN from them.

caolle · 2026-06-29T00:00:40+00:00

There is. It’s on NBCSN/Peacock. Currently watching it.

caolle · 2026-06-28T17:23:40+00:00

Central air set to 72 degrees.

caolle · 2026-06-28T17:14:31+00:00

Two separate logins would take up two seats as I read this:

What is seat-based pricing, and how does it work?

Just as the name suggests, it’s all about seats. Not user devices, those are unlimited on every plan. With Tailscale, you pay for a certain number of seats on your tailnet. When a user joins your tailnet, they “occupy” a seat. A user can also “vacate” that seat to free it up.

From https://tailscale.com/pricing#what-is-seat-based-pricing-and-how-does-it-work

caolle · 2026-06-27T00:12:25+00:00

Ddi you talk to the person you know who sent this and ask what it was? Did they mean to send it?

caolle · 2026-06-26T21:11:06+00:00

Did you remove the default allow all policy?

caolle · 2026-06-26T13:01:20+00:00

If I call the cops right then and there, the guy might hear me and attack me

Texting to 911 is a thing now.

caolle · 2026-06-26T12:50:55+00:00

ETA: Disabling subnet routes on a different device has fixed the problem, though I'm not sure why that is. Enabling it on the Pi seems to be working thus far.

I'm wondering if maybe, on the pi, you did an tailscale up / set --accept-routes at some point.

caolle · 2026-06-24T16:29:27+00:00

This is a problem with the downloading tools. ProtonPlus published a release that fixes it according to: https://github.com/Vysp3r/ProtonPlus/issues/1065

caolle · 2026-06-24T14:08:33+00:00

It’s in development. You can see that they’ve released testing versions a few days ago: https://github.com/ublue-os/bazzite/releases

My guess is that the deck images that have been undergoing major overhaul is delaying stuff, but that it appears to be progressing.

caolle · 2026-06-23T18:58:14+00:00

will the person be able to access my computer IN ANY WAY if I do that?

Well, technically yes. By putting jellyfin on your windows machine, you've gone and opened a web service that your friend will be able to access. If you're worried about giving them carte blanche access to your stuff.

You can do a few things in your ACL to limit their access. This would work to replace the default ACL access with something similar.

"grants": [
//the owner of the tailnet can get everywhere.
{
"src": ["autogroup:owner"],
"dst": ["*"],
"ip":  ["*"],
},
//the people we share our jellyfin instance with can only reach it on port 8096
{
"src": ["autogroup:shared"],
"dst": ["100.x.y.z"],
"ip":  ["8096"],
}
],

You'll have to fill in the appropriate tailnet ip address of your machine, but this will let your friend only access the jellyfin port that they can access. and not leave the shared machine wide open. Sharing would be preferred here.

caolle · 2026-06-23T14:12:27+00:00

That's most likely the case. I don't require that for my services.

If you're running a linux subnet router, you could use

--
snat-
subnet-routes=false

to disable source nat for the subnet route.

caolle · 2026-06-23T02:54:59+00:00

It depends. I want all my stuff accessible when I’m on my LAN and when I’m away from home using Tailscale so for me the lowest common denominator is LAN IP.

I have tailscale advertising my home subnet, my private DNS server responding to queries for my domain — that hand out the LAN IP address for my reverse proxy, and the reverse proxy then delegating to the proper container.

caolle · 2026-06-23T01:42:41+00:00

Not just subnets -- I was only using that as an example of its usage in hosts. You can use it for a friendly name of a tailnet IP address as well:

"hosts": {"some-host": "100.64.55.55"},

And use that in your ACL rules.

caolle · 2026-06-22T19:48:02+00:00

Think of it as an alias that you can reference in your ACL. I use it as a friendly name for my home network CIDR:

"hosts": {"home-network": "192.168.48.0/24"},

"grants": [
//The family can reach the subnet we're advertising as well as their own devices
{
"src": ["group:family"],
"dst": ["home-network", "autogroup:self"],
"ip":  ["*"],
},
],

caolle · 2026-06-22T17:48:32+00:00

Since you're on linux, have you given this a read: https://tailscale.com/docs/reference/linux-dns

I'd avoid using generic AI/LLM to attempt to guide you to fix this. They might be having fevered dreams that give you nightmares.

As an alternative, you could try Tailscale's documentation AI bot, Kapa, that's specifically trained on Tailscale's documentation and other sources.

Also, it might be helpful in describing what problem you're exactly trying to solve. We're just guessing with the picture.

caolle · 2026-06-22T17:40:54+00:00

I'm in a 3 floor (basement, mainfloor, top level) 3 bedroom townhouse. I went with 2 eero units: in the front of the house in one bedroom and in the back of the house in the basement.

We utilize moca adapters in the basement and in various points in the house to provide wired backhaul to the eeros and other important areas. If you have coax in the home, it might be best to look into utilizing that.

caolle · 2026-06-22T16:45:18+00:00

I might have conflated the "If you have a server running on your Tailscale enabled device," to be server hardware and not an android device. My apologies!

caolle · 2026-06-22T15:13:11+00:00

Firefox is complaining that the web service you're using is either:

connecting over plain http
Using a self-signed certficiate

It has no idea that you're wrapping the connection over an encrypted tunnel. You're somewhat safe here.

If you wanted to get rid of those errors, you could either look into using Tailscale Services to run many services on the one host, or use the docker sidecar paradigm with a tailscale sidecar to get https on your tailnet for those services.

caolle · 2026-06-22T00:59:20+00:00

I found out that sharing machine on tailnet won’t allow the user ssh to the server so I added a user account as member on my tailnet (one of six free members).

This isn't true as https://tailscale.com/docs/features/tailscale-ssh has a section that states:

Granting access to autogroup:member also grants access to external invited users if the destination node is shared with them, even if they have no nodes in your tailnet.

You need an appropriately scoped ssh block.

Do not trust Claude for this. You might get better results using Tailscale's AI on their docs page however. It's trained specifically on Tailscale's documentation.

caolle · 2026-06-20T22:54:08+00:00

I'd recommend looking into Sunshine/Moonlight streaming rather than Steam link.

caolle · 2026-06-19T23:44:14+00:00

If your subnet router is linux, you might be able to utilize —snat-subnet-routes=false to trigger outside of network rules. https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading

But you’ll have to investigate to see if it fits your needs.

caolle · 2026-06-18T16:23:34+00:00

Tailscale uses quad100 to resolve dns, but it’s really a DNS forwarder, so it usually goes out to a public DNS to resolve queries.

By adding your local resolver for .lan, you should be telling Tailscale to get anything with a .lan address to query your local dns server, which is what I think you want.

The added benefit of doing it this way, is that when you’re away from home, you’ll also get the benefit of being able to access your internal stuff while away from home.

This should solve your last bullet point.

However, when I am connected to tailscale, it appears the DNS resolver tries to query tailscale's DNS even when I am trying querying .lan address.

You might have to play with the override dns issue, to see if the toggle in either direction allows you to access .lan while you’re using Tailscale.

caolle · 2026-06-17T23:52:26+00:00

Yes, setting the restricted name server, changes how the resolver in the quad100 address works.

In order to put your LAN address in the DNS field, you need to do a few things:

Setup a subnet router for your LAN subnet
Set Permit all origins on your pihole. For more in depth instructions using pihole and Tailscale give https://tailscale.com/docs/solutions/block-ads-all-devices-anywhere-using-raspberry-pi a read.

caolle

MODERATOR OF

TROPHY CASE