Most of this blog is a maintenance log with jokes: the thing that broke, the reason it broke, the smaller thing I built so it wouldn’t break that way again. This one’s different. This is the piece that has never broken, and that I’d have to rebuild first if I lost it, because everything else is sitting on top of it.

My stuff is scattered. Randy — the server that runs the house — is in a closet in Fort Lauderdale. Barb, who does the monitoring, is a droplet in a data center. Bubbles, the family AI, is a Mac Mini that thinks it’s people. There’s a Raspberry Pi at the lake place in Muskoka running heat, blinds, and the grandparents’ voice commands. Then my laptop, everyone’s phones, and the fact that I’m usually in a different time zone than most of it.

The conventional ways to connect that are all worse. Port forwarding is how you get to be a case study in someone’s security writeup. A traditional VPN gives you one gateway, one chokepoint, and a client your family refuses to open. Putting things on the public internet behind a login page means maintaining login pages, and I’ve already written about how that goes for single-family software.

Tailscale makes all of it one flat network that doesn’t care about geography. The Pi in Ontario and the server in Florida are neighbors. My phone on hotel WiFi is inside the house. Nothing is exposed to the public internet, because there’s no public side to the design — not one inbound firewall hole anywhere in the setup — and I can still reach everything I own from wherever I happen to be.

What it’s actually holding up

The reason I call it load-bearing rather than convenient: pull it out and a dozen other decisions collapse.

The family apps — task manager, lists, trip planner, workout tracker — have no login screens, because being on the network is the login. That’s not laziness, it’s the architecture; those apps were built assuming a perimeter exists. Barb watches Randy’s health from outside the house, since the smoke detector shouldn’t live inside the fireplace. Bubbles reaches the machines it needs without a credential dance. When something at the lake place misbehaves in February, I fix it from Florida without asking anyone up there to go look at a blinking light.

The travel thing

Here’s the one that sold my wife on it, and it has nothing to do with servers.

Tailscale can route a device’s whole internet connection through another machine on your network — an exit node. Flip it on while traveling and your laptop is browsing from your living room, on your own home connection, as far as the rest of the internet is concerned.

For me that mostly means the airport-WiFi problem disappears: I’m not trusting a coffee shop’s network with anything, because my traffic pops out at my own house. For everyone else in my family it means the services they already pay for stop acting strangely in a hotel in another country. Same subscriptions, same account, same house they’re normally streamed in — just a longer wire. Nothing about your setup changes except which front door your traffic uses, which is precisely why it works and precisely why I’m not framing it as a clever trick. It’s my own internet connection. I’m just standing farther away from it.

The runner-up benefit: hotel and airplane WiFi is hostile territory, and this is the cheapest way to stop caring.

The review

Every other layer in this stack asks me for something. Updates, restarts, opinions, the occasional exorcism. In something like seven servers’ worth of incident stories on this blog — dead tunnels, exhausted ports, corrupted databases, a router that thought it was 1980 — the mesh has never once been the thing that failed. It has never appeared in a single postmortem I’ve written.

That’s the evaluation. Not that I love it. That I’ve stopped thinking about it, and it’s holding up everything else while I do.