Learn Tailscale - Ecosystem Integrations

#Introduction

Tailscale doesn't live alone. Its value emerges when it attaches to the devices you already have: NAS, hypervisors, routers, and cloud instances.

Episode 20 covers ecosystem integrations: installing Tailscale on Synology DSM, Proxmox, OpenWrt routers, and headless servers, use on VPS, AWS, and GCP, plus an introduction to Headscale as a self-hosted control plane for organizations that want full control.

After this episode, you'll be able to connect your entire infrastructure — from home servers to cloud instances — into a single managed tailnet.

#NAS and Infrastructure

#Synology DSM

Synology offers a Tailscale package directly in the Package Center. Once installed, Tailscale appears as a DSM app with a status page and login button:

sudo synopkg start Tailscale
sudo tailscale up --hostname=nas-home
tailscale status

The approach above uses SSH into DSM then activates the package. The sudo tailscale up --hostname=nas-home command names the node so it's easy to find via MagicDNS. DSM's web management can also be accessed directly through the .ts.net hostname.

#Proxmox

For Proxmox, the cleanest approach is installing Tailscale inside an LXC container or VM rather than on the host. That way the Tailscale node's resources are isolated from the hypervisor:

pct exec 101 -- sh -c "curl -fsSL https://tailscale.com/install.sh | sh"
pct exec 101 -- tailscale up --advertise-routes=10.10.0.0/24

pct exec 101 -- tailscale up --advertise-routes=10.10.0.0/24 makes the LXC a subnet router for the internal Proxmox network. From the tailnet, you can reach other VMs through that route without installing Tailscale on every VM.

#Routers and OpenWrt

OpenWrt routers support Tailscale via the tailscale package:

opkg update
opkg install tailscale
/etc/init.d/tailscaled start
tailscale up --hostname=main-router

tailscale up --hostname=main-router connects the router to the tailnet. Because routers are always online and sit in front of the LAN, this node often serves as a convenient subnet router or exit node.

#Headless Servers

For servers without a GUI, install via the official script:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh --hostname=server-1

The --ssh flag in sudo tailscale up --ssh enables Tailscale SSH at the same time — a convenient pattern for remotely managed headless servers.

#Cloud and Self-Hosted

#Tailscale on VPS, AWS, and GCP

Tailscale runs on nearly every distro available on VPS, AWS EC2, or GCP Compute Engine. Its roles vary: connecting instances to the tailnet, becoming a subnet router for a VPC, or becoming a regional exit node.

sudo tailscale up --advertise-routes=10.128.0.0/20 --snat-subnet-routes=false

With --advertise-routes and --snat-subnet-routes=false, a cloud instance can bridge a VPC subnet into the tailnet without source NAT — a common pattern for accessing cloud resources from a laptop.

#Headscale: Self-Hosted Control Plane

Headscale is an open source implementation of the Tailscale control plane. You keep using the same Tailscale client, but coordination, authentication, and key management run on your own server:

Tailscale client ---- HTTP/HTTPS ---- Headscale server (yours)
                        control plane
Tailscale client ---- WireGuard ---- Other peers (data plane)

Headscale's advantage is full control: logs, policies, and keys never touch a third-party service. But you must manage DNS, failover, and server security yourself — an operational burden that doesn't exist in the managed version.

#Common Integration Patterns

#Example Mixed Tailnet Topology

Home:  NAS (Synology) + Router (OpenWrt) + Proxmox LXC
Cloud:  AWS EC2 subnet router + GCP instance
Laptop: main workstation with --accept-routes

• NAS and routers are ideal as always-online nodes.
• Proxmox LXC is isolated, easy to delete and rebuild.
• Cloud instances serve as subnet routers or exit nodes.
• Headscale only for teams ready to manage their own control plane.

#Closing

Episode 20 expanded the tailnet's scope from laptops and servers to the whole ecosystem: NAS, hypervisors, routers, and cloud — including the self-hosted option via Headscale.

Key takeaways:

• Synology and OpenWrt have official packages that are easy to enable.
• On Proxmox, install Tailscale in an LXC, not on the host.
• Headless servers can use --ssh directly at up time.
• Cloud instances are a good fit as subnet routers or exit nodes.
• Headscale gives full control at extra operational cost.
• Always-online nodes are the foundation of a stable tailnet.

In the next episode, episode 21, we'll cover production-ready deployment — mass provisioning with auth keys and OAuth, MDM management for macOS and Windows, device monitoring, centralized update policies, plus a production checklist like strict ACLs, Tailnet Lock, audit logs, config backups, and runbooks.