My public VPS is now only accessible via SSH from my tailnet. One more possible attack vector less.

In Alpine Linux I switched to the linux-lts kernel, installed Tailscale from the edge-community repository via repository pinning, removed the rule to allow SSH from the Hetzner cloud firewall and finally set the Tailscale ACLs to not allow access to my other Tailscale devices from the VPS.

I am using Nitter, an alternative interface for Twitter, just in case I want to read a thread on Twitter. Previously I hosted the instance directly on my VPS. Now, however, I host the Nitter instance at home, but make it available on the Internet through Tailscale, a little program I wrote called “ProxyExposer”, and Caddy. 🤓 I also briefly tried publishing a WordPress instance from home to the web this way. But I don’t have a use case for WordPress at the moment.

Sometimes I am a perfectionist. Having previously made my private diary blog available via a Tailscale sidecar container in my Tailnet, I have now integrated Tailscale directly into GoBlog. Both Tailscale and Tailscale’s Let’s Encrypt certificates can be configured directly in GoBlog. No sidecar container is needed anymore. A much simpler solution! (And Tailscale rocks!)

Tailscale excites me again and again! Now it is also possible to get TLS certificates for nodes. I immediately got to work and integrated this into GoBlog, so that the browsers no longer complain when I log into my diary – a http:// page, which is already encrypted through Tailscale…