Ditching Cloudflared for Tailscale

A while back I wrote about SSHing into my home server from anywhere using a Cloudflare Tunnel. It worked. But the more I lived with it, the more it felt like the wrong tool. Cloudflared needs a domain. It routes my SSH through Cloudflare's edge. It's a daemon babysitting a config.yml, and every service I want to reach needs its own ingress rule. That's a lot of moving parts, and another company sitting in the middle of me talking to my own machine. So I ripped it out and moved to Tailscale. Why it's better for me Tailscale is a WireGuard mesh. My machines talk to each other directly, peer to peer, over an encrypted tunnel. No domain, no public IP, no open ports, no ingress config. Every box gets a 100.x address and a name, and I can reach any port on it, not just the one I remembered to forward. And because everything I own is Nix, I don't click around an app. I add a line, rebuild, done. The Linux box (dom) dom is my NixOS home server. Enabling Tailscale is one line, plus telling the…