IdeaWell

Project ideas from Hacker News discussions.

Netbird – Open Source Zero Trust Networking

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. Security & “Expose‑or‑Protect” Debate
Users are split on whether to use Tailscale’s funnel (public‑URL) feature or keep services behind the VPN.
- “Please be aware that when you use tailscale funnel you announce to the whole world that your service exists… If you don’t believe me just put up a simple http server and watch the scanning request come in within seconds of running tailscale funnel.” – gnyman
- “Do not expose anything without authentication.” – gnyman

2. Self‑hosted vs. Cloud‑based Control Plane
The community is actively evaluating alternatives to Tailscale’s SaaS, weighing sovereignty, cost, and control.
- “I see Pangolin has a Self‑Host Community Edition… I am considering both for a migration from Tailscale.” – edentrey
- “NetBird is Germany‑based and explicitly positions itself as a European alternative… Headscale is a toy.” – moonlightbandit

3. Feature‑set & Usability
Ease of setup, DNS integration, ACLs, and mobile support are key differentiators.
- “NetBird is a complete package, unlike tailscale where you need to modify registry keys to change the cloud URL and headscale is a simplified, non‑multi‑tenant signaler.” – braginini
- “The DNS functionality is excellent… only real and very minor gripe is the Android app.” – usagisushi

4. Reliability, Performance & Support
Many users report flaky clients, DNS glitches, and limited enterprise‑grade support.
- “I had to get it working reliably for 10‑15% of users… the client failed intermittently with no clear pattern.” – binnacle
- “Netbird works quite well, but it would keep messing with my dns‑resolving… I had to remove netbird from all my systems.” – sigio

These four themes capture the core concerns and priorities that dominate the discussion.

🚀 Project Ideas

AutoAuth VPN Manager

Summary

  • Automates creation, rotation, and revocation of long‑lived auth keys for self‑hosted VPNs (Tailscale, Headscale, Netbird).
  • Integrates with OAuth clients to generate single‑use keys on demand, eliminating 90‑day expiry pain.
  • Provides a dashboard, CLI, and webhook hooks for CI/CD pipelines.

Details

Key Value
Target Audience Homelabers, DevOps teams, small enterprises using self‑hosted VPNs
Core Feature OAuth‑driven auth‑key lifecycle management with automated rotation and notifications
Tech Stack Go (backend), React + Vite (frontend), PostgreSQL/SQLite, Docker, Terraform provider
Difficulty Medium
Monetization Revenue‑ready: $5/month per node or free tier with community support

Notes

  • Users like m_santos and k_bx complained about 90‑day key expiry; this tool removes that friction.
  • “I want a set‑and‑forget solution for my embedded hardware” – AutoAuth gives exactly that.
  • The OAuth flow is already documented by Tailscale; this tool wraps it in a single UI.

Secure Funnel Proxy

Summary

  • Self‑hosted reverse proxy that automatically secures exposed services with TLS, authentication, and rate limiting.
  • Detects and warns about certificate‑transparency scans and insecure endpoints.
  • Works with any VPN (Tailscale, Headscale, Netbird) or as a standalone tunnel.

Details

Key Value
Target Audience Home‑assistant users, developers exposing local services, security‑conscious admins
Core Feature One‑click TLS termination, auth‑based access control, CT‑scan alerts, auto‑renewing Let’s Encrypt certs
Tech Stack Rust (proxy core), Actix‑Web, ACME client, SQLite, Docker Compose
Difficulty Medium
Monetization Hobby (open source)

Notes

  • gnyman warned about CT scans exposing .git folders; the proxy can block such paths automatically.
  • Galanwe uses funnels for Vaultwarden; this proxy adds auth and TLS without manual config.
  • “Do not expose anything without authentication” – the proxy enforces that by default.

Multi‑Network VPN Switcher

Summary

  • Cross‑platform client that can manage multiple VPN networks (Tailscale, Headscale, Netbird, OpenZiti) simultaneously or switch between them.
  • Provides per‑network policies, split‑tunnelling, and a unified status dashboard.
  • Supports desktop (Windows, macOS, Linux) and mobile (Android, iOS) with a single installation.

Details

Key Value
Target Audience Users needing to access multiple corporate or homelab networks from one device
Core Feature Unified VPN client with network profiles, auto‑switch, and policy enforcement
Tech Stack Electron (desktop), Kotlin/Swift (mobile), Rust backend for VPN handling, SQLite
Difficulty High
Monetization Revenue‑ready: freemium with premium policy‑engine add‑on

Notes

  • floatartifact wants a VPN that stays connected even when the UI is set to “off”; this switcher keeps tunnels alive in the background.
  • floatartifact and m_santos expressed frustration with switching between networks; the switcher solves that.
  • “I want to quickly change or have access to multiple at once” – this is the core use case.

Router‑Ready VPN Overlay

Summary

  • Lightweight VPN overlay that runs natively on consumer routers (OpenWRT, DD‑WRT, AsusWRT).
  • Zero‑configuration peer discovery, built‑in DNS, and optional TLS termination.
  • Web UI for easy management, device onboarding, and ACLs.

Details

Key Value
Target Audience Home‑router owners, small office networks, IoT deployments
Core Feature Router‑level VPN mesh with auto‑join, DNS integration, and per‑device ACLs
Tech Stack C (core), Lua (router config), OpenWRT packages, Docker for optional services
Difficulty Medium
Monetization Hobby (open source)

Notes

  • redshift1 and binnacle noted the need for VPN on routers; this project fills that gap.
  • “I want a VPN that runs on a router” – the overlay can be installed via opkg and requires no extra hardware.
  • “No need to open 80/443” – the overlay uses a single UDP port and optional STUN/relay if needed.

Read Later