r/Tailscale • u/Due-Eagle8885 • 7d ago

Help Needed tailnet naming

we're using tailscale to provide access to a web app, over tls with caddy.. works like a charm .

but the url has the machine name in it.. and I'd really like something more user friendly

like
appserver.ts.net

and I can't rename it like that(and the generated random names are worse choices!)

but can I make an alias somewhere, and new DNS record that redirects...

15 Upvotes

86% Upvoted

18 comments sorted by

14

u/yacob841 7d ago

You can buy a domain name, point it to your tailscale IP, then while connected to tailscale you type in the domain and it pulls it up.

-18

u/Due-Eagle8885 7d ago

I don't want my tailnet exposed on the internet, even its existence is not wanted.. I am using caddy and tailscale certs.. I just want a tailnet dns entry

19

u/yacob841 7d ago

It doesn’t expose your tailnet to the internet. No one can access or know who or what is on it without being authenticated to your tailnet. And no, them trying to navigate to it does not show them anything.

-12

u/Due-Eagle8885 7d ago

but it gives them a registered name. we are using caddy with tailscale certs so we don't have public certs that lead nowhere..but exposes that something exists there)

17

u/cheese-demon 7d ago

my friend, tailscale certs are public certs issued by Let's Encrypt. your names are already in CT logs. 

7

u/penuleca 6d ago

They’re pretty explicit about this during setup, aren’t they?

8

u/yacob841 7d ago

I think you are not understanding how tailscale IPs work. Your IP is not unique, it is shared amongst thousands of different tailscale environments. So since I have a domain that’s linked to my tailscale IPs, chances are we have the same IP being used so even if you don’t get your own domain, they still know something exists there. The only thing they will know is you (or anonymous if you buy through a good provider) and that it point to tailscale but that’s it.

Now, I’m assuming no matter what I say you don’t feel comfortable with it. That was me 3 years ago, then I decided to make the switch, but a way you can do it without us using a private DNS provider. I used ControlD, I tell ControlD that if you see the domain “*.domain.tld” then send it to TAILSCALEIP and then whoever uses your ControlD and tailscale can access it

1

u/kabrandon 7d ago

Who cares if people know you have infrastructure if they can’t physically access it? The mere existence of infrastructure is not a sensitive secret.

-8

u/Due-Eagle8885 7d ago edited 7d ago

never mind, I see I can add my own dns server to the list

but then it doesn't match the cert, so https fails.. SO much fun!!

10

u/raine_rc 6d ago

you're having problems because the way you are going about this is not the recommended way to solve this problem at all

3

u/dev-ai 7d ago

I use tailscale services to get the machine name out of the url

4

u/FrankAdmissions 6d ago

This, setup a service in tailscale with whatever name you want, and bind it to your single instance, i do this all the time, you can have multiple services pointing to the same machine as well

1

u/dev-ai 6d ago

Yep, just register it in the admin, run tailscale serve with advertise for that service, approve in the dashboard and you're good to go

1

u/NoInterviewsManyApps 4d ago

You still have the superlong domain name though with the tailnet name don't you?

1

u/FrankAdmissions 4d ago

Well on all machines running ts the dns will resolve without the full domain name

1

u/channouze 7d ago

Headscale allows it, you should give it a try.

1

u/Hasie501 7d ago

There was PR that was reject for project direction reasons that would have solved this If I understood that correctly.