Cousin Mose

I self-host web apps I write myself? ¯\(ツ)/¯

It’s mostly about performance. Caddy’s Go-based garbage collector starts to negatively impact performance at high load. It looks something like:

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    location / {
        proxy_pass http://localhost:3000/;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

I prefer nginx to Caddy myself for reverse proxies. As far as VPN technologies go, Tailscale and WireGuard are where it’s at.

Not sure why we’re comparing Caddy to Tailscale though.

I’m just using WireGuard on a VPS with multiple interfaces. I’m still doing heavy ad/tracking blocking via DNS too.

As for App Connectors I’m working on a script (compiled program hopefully down the road) that can query a specific hostname using a specific interface (say, a US-only website using DNS over a US-based VPN) then create a virtual IP address that directs to that same IP using the correct tunnel.

My reasoning for the virtual IP address is that I don’t want to redirect every website on the host to the other tunnel—lots of servers have an array of websites on them.

What I found disappointing about Tailscale is I had to do a lot of “hacks” to make things work—DNS on each exit node had to match perfectly (despite using different exit tunnels)—then the shit would only work like 20% of the time. One day traffic for the US tunnel worked, the next day it was going out of the exit node. I also never got it working correctly in Docker so I was running multiple VPS servers.

If I remember correctly with App Connectors your client would query the App Connector for the domain, then it would return an IP address. The IP address would be set up to always go through the defined exit node. So if your DNS was off or you were accessing another website on the same server you were screwed. On top of that, it just didn’t work.

I loved Tailscale for about a year but am moving away from it because having multiple exit nodes with each redirecting traffic via commercial VPNs with DNS-based ad blocking and App Connectors grew way too complex.

I’m not saying you’re doing all this but if you do get to a point where you’re directing traffic to multiple countries Tailscale turns into nightmare to manage.