I self-host my mesh VPN with NetBird instead of Tailscale — here's the one reason, and where Tailscale still wins

说明与用途

作者将 Tailscale 换成自托管的 NetBird VPN，并与现有 OIDC 身份提供商集成，实现统一身份验证和访问控制。这样可以完全掌控控制平面，但需要额外维护。

问题

Choosing a self‑hosted WireGuard mesh VPN that integrates with an existing identity provider while avoiding a third‑party control plane.

结果

NetBird provides a self‑hosted, identity‑first VPN mesh that unifies access control with the existing IdP, eliminating a second control plane. It requires more setup and maintenance but offers full ownership of the coordination server.

工作流

• 1. Deploy NetBird control plane on a self‑hosted server.
• 2. Configure NetBird to use the existing OIDC identity provider for authentication.
• 3. Adjust NetBird dashboard settings to use the ID token (JWT) instead of opaque access tokens.
• 4. Resolve split‑horizon DNS issues by ensuring consistent name resolution across home LAN and mesh.
• 5. Test connectivity and name resolution from all devices.
• 6. Monitor and maintain the control plane (patching, backups).

证据

NetBird speaks OIDC to my existing self-hosted identity provider. So logging into the mesh is logging into everything else — same username, same 2FA, same place to revoke a person.

来源

The token format gotcha. Wiring NetBird to my identity provider, the dashboard authenticated fine but API calls failed. The cause: my IdP was handing out opaque access tokens, and NetBird's dashboard needed a JWT it could actually read claims from.

来源