Private Mesh VPN
Replaces: Cloudflare tunnels, public exposure
Create a WireGuard-based encrypted mesh network so all your devices can communicate securely from anywhere.
Sources
infrastructure-dependencybig-tech-surveillance
Phase
First Self-Hosting — needs server/hardware, 2-4h
General
Install Tailscale on all devices. Creates an encrypted mesh network — your devices can talk to each other securely from anywhere. Useful with file sync (Syncthing) even before full self-hosting. May improve DNS privacy when used with cloud DNS blocking (NextDNS queries encrypted via DoH through Tailscale) — but untested by us.
Deployment
Self-Hosted
Tailscale (zero-config mesh VPN, WireGuard-based)
Alternatives: Headscale (self-hosted Tailscale control server), Plain WireGuard (manual setup)
Related Cards
Research Findings
Tailscale uses DoH by default. Official NextDNS integration exists. Tailscale encrypts DNS queries before they reach NextDNS — ISP cannot see DNS queries. Known issue: MagicDNS + NextDNS conflict (NextDNS eats tailnet queries). Solution: NextDNS CLI client with split DNS forwarders. UNTESTED by us — noted but not recommended yet.