May 2025 Summaries

Running AI locally is becoming practical and private thanks to new models like Llama 4, Gemma 3, and DeepSeek, allowing users to control their data without monthly fees. The process involves setting up a local AI lab using tools such as Proxmox for virtualization, NixOS for system repeatability, Docker for packaging, and Tailscale for secure remote access. A compatible hardware setup, including an NVIDIA A4000 GPU and appropriate CPU support, is necessary for PCIe passthrough. The setup creates an "AI Basecamp" with a NixOS VM equipped with Docker, NVIDIA drivers, and Tailscale, enabling the use of Ollama and Open WebUI for a local ChatGPT-like experience. This system, accessible securely from anywhere via Tailscale Serve, can be automated with Ansible for easy reuse and the safe integration of secrets. It allows for offline LLM use, facilitating projects like Home Assistant integrations and code generation while also enabling cost-sharing of GPU resources for private AI access among friends. Comprehensive guidance and resources are available, including a detailed walkthrough video and GitHub repository.

Tailscale has introduced grants as a new generation of access controls that simplify and enhance its original Access Control List (ACL) syntax by combining network and application capabilities, making them easier to write and read. Grants serve as a superset of ACLs, ensuring backward compatibility while offering new features like application capability extensions and routing awareness through the "via" field. This innovation allows for more powerful access control, as grants enable centralized management of both network access and user roles without requiring separate user databases. Users can gradually transition from ACLs to grants to leverage these advanced functionalities, as both can coexist within the same policy without a mandatory migration deadline.

Self-hosting offers individuals the ability to manage their own data and enhance privacy by keeping information on personally owned hardware, as opposed to using third-party cloud storage that can scan and store data. A guide to setting up a self-hosted environment involves selecting appropriate hardware, such as a small form factor PC instead of Raspberry Pi, and installing Proxmox as the operating system to manage virtual machines and containers. The process includes using tools like balenaEtcher to create a bootable USB drive, and configuring network connections with devices like Ubiquiti switches for enhanced networking capabilities. Additionally, the guide covers setting up virtual input devices with Jet KVM and customizing Proxmox settings for optimal performance. Once the system is operational, users can enjoy the benefits of direct data transfer via Tailscale, ensuring maximum security and privacy, while also engaging with the broader self-hosting and Tailscale communities for additional support and feedback.

Tailscale's latest updates focus on enhancing network reliability, manageability, and security with several key improvements across their platform. This month's developments include enhanced automation and integration capabilities, such as programmatic management of OAuth clients via the Keys management API and Terraform Provider, and the Tailscale GitHub Action now compatible with macOS and Windows runners. The latest v0.19.0 of the Tailscale Terraform Provider introduces more flexibility in managing log stream resources, while stability improvements in versions v1.82.4 and v1.82.5 address various platform-specific issues. Admin tools now feature code folding in the ACL editor for easier policy management, and device security sees faster syncing for posture attributes on new nodes. Connectivity is bolstered with new DERP relay locations in Helsinki, Ashburn, and Nuremberg, improving performance for users in those regions. Updates to the Tailscale Docker image, Kubernetes operator, and tsrecorder ensure continued stability and support without functional changes.

Tailscale's 4via6 subnet routing is designed to enhance connectivity for complex edge deployments where traditional VPNs struggle, such as in scenarios involving multiple layers of NAT, restrictive network policies, and overlapping IPs. This innovative solution facilitates seamless connections across numerous identical networks without the need for managing IPs, CIDR ranges, or ports, making it ideal for applications involving fleets of robots, edge devices, or numerous VPCs. By supporting network-in-a-network approaches, 4via6 enables easy management and connectivity of deployed infrastructure like cameras, sensors, robots, and local servers, while also granting secure remote access for support teams and telemetry servers. It provides a single solution that works on any internet connection, including LTE, 5G, or satellite, and allows for the inclusion of embedded networked devices in the same mesh, offering low-latency access without complex VPN or SD-WAN setups. Moreover, 4via6's functionality extends to cloud deployments, supporting the linking of VPCs across environments and regions, thereby enhancing the reproducibility of tests and connectivity between hosted control and data planes.

Tailscale's Just-in-Time (JIT) access feature addresses the dilemma faced by developers and infrastructure engineers who require secure yet temporary access to network resources. By allowing task-specific, time-limited permissions instead of permanent access, JIT mitigates security risks and prevents productivity blockages. This feature is particularly useful for contractors needing access to production databases, DevOps engineers during maintenance windows, and compliance-heavy teams requiring audit-friendly controls. JIT operates through dynamic, real-time policy evaluation and is available on Tailscale's Enterprise plan, offering a secure solution to configure and request time-bound access efficiently.

The RSA Conference 2025 in San Francisco was a major event for the security industry, attracting over 44,000 attendees and featuring discussions focused on modernizing security infrastructure, particularly moving away from legacy VPNs. Tailscale, a company offering secure access solutions, emphasized the urgency of adopting modern tools to address evolving threats and infrastructure challenges exacerbated by AI advancements. Their booth message, "Drop your VPN. Not your standards," resonated with many attendees, highlighting the inadequacy of traditional VPNs for remote and cloud-based work environments. Conversations at the event revealed a strong interest in solutions that provide better security outcomes without increasing complexity, with many participants already familiar with Tailscale's effectiveness in personal settings. The company plans to continue promoting its VPN alternatives and expand its presence at future events, aiming to support security teams in achieving simplicity and transparency in access management.