As a service with end-to-end encryption and the ability to establish peer-to-peer connections, Tailscale now supports connecting up to 100 devices with its free account, which is more than enough for individual users. Almost all of my local network devices are connected using Tailscale. In a recent article titled "Managing Servers with VS Code, I Have a Unique Server Management Method" (https://zhuanlan.zhihu.com/p/659427990), I expressed my love for using Remote SSH and frequently use Tailscale to establish an internal network for remote development using Remote SSH.
However, Tailscale faces an issue in the network environment in mainland China, where there are often high latency or connection issues. Fortunately, the official solution allows users to self-host DERP servers to act as relays and solve this problem. No longer do you have to worry about your code being interrupted halfway through, and the excellent network experience also improves the Port Forward experience in VS Code, making remote preview development more convenient.
Since I already have a low-spec cloud server, I previously used Caddy as a reverse proxy server to run my Alist project. So this time, I also considered using Caddy as a reverse proxy on the same server to deploy the DERP project.
The main reason for choosing Caddy is that compared to Nginx, it has a simple configuration that can meet most requirements, and it also has a good experience with automatic SSL management, which saves a lot of trouble.
Without further ado, let's start the configuration directly.
Configure Docker#
// docker-compose.yml
version: '3'
services:
derper:
image: fredliang/derper
restart: always
ports:
- 3478:3478/udp
- 23333:443
environment:
- DERP_DOMAIN=derp.example.com
Then start it.
sudo docker compose up
Configure Caddy#
// Caddyfile
derp.example.com {
reverse_proxy localhost:23333
}
Reload Caddy's configuration
sudo docker compose exec -w /etc/caddy caddy caddy reload
Don't forget to point your domain name to your Caddy server.
Configure Tailscale#
Configure in Access Controls
Direct link: https://login.tailscale.com/admin/acls/file
{
// ... other ACL configurations
"derpMap": {
"OmitDefaultRegions": true, // Whether to only connect to self-hosted derper nodes
"Regions": {
"900": {
"RegionID": 900,
"RegionCode": "myderp",
"Nodes": [
{
"Name": "1",
"RegionID": 900,
"HostName": "derp.example.com", // Domain name
"STUNPort": 3478,
"DERPPort": 443,
}
]
}
}
}
}
That's it.