Hi all! I'm trying to venture into utilizing Tailscale, but am running into an immediate barrier. Tailscale requires using a third-party identity provider to set up an account, all of the easy free options being Google/Microsoft/Apple.

Now, the problem is that I'm specifically working on creating my own self-hosted app ecosystem (which Tailscale would be an entry-point to) specifically to pull out of the FAANG ecosystems, so it makes me really uncomfortable to have to lock myself to one of them in order to use Tailscale. I do see that Tailscale allows other OIDC options, but most of those cost a pretty penny or are ultimately owned by major tech corps again.

I was looking into self-hosted setups, as I've set up an Authelia container in my Unraid server, but apparently it requires a "Webfinger" server that I can't seem to find a good option for in the App store. There are applications like Go-Finger and Carpal which can be containerized and run in Docker, but that would require me to clone their GitHub repositories and compile them in order to run on unraid, and I'm uneasy about trusting myself to remember to regularly check for updates and go through that process over and over again to keep things secure.

Anyone have a good recommendation of how to create a Tailscale account but not have to go through Google/Microsoft/Apple or another corporate provider? Is there a relatively straightforwards way to self-host a compatible OIDC service with WebFinger compatibility? Thanks!

Ok, I was able to figure out how to do it on my own! It wasn't great, but it is definitely doable. I very much used https://blog.janissary.xyz/posts/tailscale-oidc-authelia-carpal as a framework for my approach. But in case anyone else wants to venture down this path I'll leave some notes here.

1. I purchased a domain name (I used cloudflare as the DNS provider, right now free.) and then used ddclient to effectively make it target my dynamic IP.

2. I already had a SWAG instance, but I did have to go through and update the various configs (nginex and subdomain configs) to updated templates in order to get Authelia to work. Oh, and use auth.domain.xyz, not the old authelia.* subdomain.

3. Authelia was the most PITA thing to set up. All the youtube guides and most of the documentation on authelia (especially the IBRACORP guide) are horribly out of date, and almost nothing works that way anymore. For anyone struggling with it, you can use the IBRACORP template, but then you need to turn on debug logging and then slowly but surely walkthrough the errors that it throws, correcting each one (and particularly looking at the authelia documentation to figure out what has changed and what is new). There was also a problem with the redis container they suggest not being able to properly write out some files because of permissions, which you would only know by looking at the youtube comments for that video.

4. Make Authelia an OIDC issuer per the janissary.xyz guide. It won't work right out of the box because authelia has broken that config in a later update, much of it is just re-writing the yml file to match authelia's new config framing. You will need to create some secrets, which authelia's guide will walk you through pretty well, though I was not able to get authelia to properly read a secrets file, so they needed to be in-line.

5. I pulled the Carpal docker image from https://hub.docker.com/r/peeley/carpal. Use the config options in the janissary.xyz and peeley/carpal github to help set it up, but it was pretty easy. One pitfall I ran into is that for some reason Tailscale WON'T query properly if you have capital letters in your email and the matching acct file! This was driving me crazy and throwing a 404 error, but you need to have the emails be lower case.

6. add the carpal webfinger server in the location section of the default.conf file in SWAG (as per the janissary.xyz guide) to allow your base domain to respond to a query at .well-known/webfinger with the proper JSON response. You should check on the webfinger website that it's properly responding when you put in the email you want Tailscale to register you at. Make sure that in the email account file, that you have the href pointing to your authelia subdomain (which should be set properly downstream of your SWAG proxy server).

7. Hopefully at that point the tailscale account setup will get a proper response from your carpal server that points it to your authelia instance. It will continue to do this whenever you need to login to Tailscale.

Ugh, honestly authelia was the biggest bear here, it took over a week of fiddling to get it to work right. Unfortunately there don't seem to be many "easier" OIDC setups, I considered Authentik but it seemed even MORE fiddly than authelia to get set up reliably. Good luck!

Thanks l...And yet still it seems for those self hosting and are possibly wanting to unfaang themselves, tailscale requires full nerd certification.
I have unraid and so may apps in dockers working so well locally for years and it shouldn't be this hard to have access outside of my network.
I have tried to set up OICD auth with four different providers, watching tutorials and searching help and i just end up with too many acronyms and a high level of expected knowledge. There has to be a simpler way or instructions that are in simple language somewhere?

Yeah, the process of implementing a OIDC server is much more complicated than it should be. When you break it down the whole process is only 4 steps (arrange stable domain, set up authelia, set up webfinger server, integrate into SWAG) but the authelia step is just such a huge hurdle. Actually, let me see if I can upload censored versions of my various yaml and conf files for the setup. Half the challenge was just figuring out if I was putting things down in the right places, and in the right format, so that might make it a lot more straightforwards.

Edit: OK attached. The default.conf file is for SWAG, the configuration.yml and user database file is for authelia, the config.yml and account email file are for carpal (the account email should literally be named acct:youremail@domain, but windows doesn't accept that file name so you'll need to rename when the file is in unraid).

default.confacct emailconfig.ymlusers_database.ymlconfiguration.yml

Edited February 20Feb 20 by Vitreous Humour
Adding additional information.

Also thank you for calling me a "full nerd", I feel like this is unfortunately the very VERY edge of nerddom. It only involved delving in to the CLI a bit, and no direct programming was required at all! I didn't even personally compile the docker image (that was just a process that I knew I wasn't going to do regularly enough to ensure things stayed safe). But clearly the people who created authelia expect someone to be comfortable with an IDE so that was probably the biggest challenge there, no GUI, and quite frankly the errors that it throws are sometimes confusing or difficult to interpret unless you understand how those yml files are supposed to be structured. I wish SpaceInvaderOne had created a walkthrough for this, but it was a learning experience. Honestly, my biggest concern is security. I tried to make sure I didn't open any more holes in security than absolutely necessary during this process, but its something that I worry about constantly (particularly the passthrough for the webfinger server through SWAG). If anyone can see something I did wrong, please let me know so I can fix it ASAP!