I self-host my mesh VPN with NetBird instead of Tailscale — here's the one reason, and where Tailscale still wins

说明与用途

作者将 Tailscale 换成 NetBird，以实现完全自托管的 VPN 网格，并与现有身份提供商集成，所有访问控制保持在同一系统中，避免第三方控制平面。

问题

Need a VPN that integrates with existing identity provider and keeps control plane self-hosted, avoiding a third‑party brain.

结果

NetBird provides a self‑hosted, OIDC‑integrated mesh VPN that keeps all access control within the user’s own identity system, eliminating the need for a separate VPN account system.

工作流

• 1. Install NetBird server and client on devices
• 2. Configure NetBird to use OIDC with existing IdP
• 3. Set dashboard to use ID token for authentication
• 4. Verify peer connectivity and DNS resolution across sites
• 5. Manage user/device offboarding through IdP

证据

NetBird speaks OIDC to my existing self-hosted identity provider. So logging into the mesh is logging into everything else — same username, same 2FA, same place to revoke a person.

来源

The token format gotcha. Wiring NetBird to my identity provider, the dashboard authenticated fine but API calls failed. The cause: my IdP was handing out opaque access tokens, and NetBird's dashboard needed a JWT.

来源