Show HN: Ts-SSH – SSH over Tailscale without running the daemon

68•i8code•14h ago

ts-ssh solves a specific problem: accessing machines on your Tailnet from environments where you can't install the full Tailscale daemon (like CI/CD runners or restricted systems).

  It uses Tailscale's tsnet library to establish userspace connectivity, then provides
  a standard SSH experience. Works with existing workflows since it supports normal SSH
   features like ProxyCommand, key auth, and terminal handling.

  Some features that proved useful:
  • Parallel command execution across multiple hosts
  • Built-in tmux session management for multi-host work
  • SCP-style file transfers
  • Works on Linux/macOS/Windows (AMD64 and ARM64)

  The codebase is interesting from a development perspective - it was written almost
  entirely using AI tools (mainly Claude Code, with some OpenAI and Jules). Not as an
  experiment, but because it actually worked well for this kind of systems programming.
   Happy to discuss the workflow if anyone's curious about that aspect.

  Source and binaries are on GitHub. Would appreciate feedback from anyone dealing with
   similar connectivity challenges.

Comments

un1970ix•2h ago

This is why you don't let Claude handle versioning and the release process. From v0.1.0 to v1.0.0 to v2.0.0, and then suddenly 1.2.0? Semantic versioning isn't quantum mechanics. (Even then, I'll admit it's sometimes hard for me too to decide the right increment when tagging versions. :)

ape4•2h ago

In general, maybe security code (which is what this is) might not be the best place for AI.

KomoD•2h ago

> This is why you don't let Claude handle versioning and the release process.

Or anything else without reviewing it.

lol @ the issue in the repo: "module declares its path as: github.com/yourusername/ts-ssh"

ramon156•2h ago

- 0.0.1 -> improvements

- 0.1.0 -> breaking changes

- 1.0.0 -> overhaul/refactor needed

I know not every case is easy but this is my rule of thumb. I've honestly never needed a major version change

Timon3•2h ago

That kind of goes counter to semantic versioning, where:

- x.y.Z (patch) -> backward compatible bug fixes

- x.Y.z (minor) -> backward compatible new features

- X.y.z (major) -> breaking changes

But of course it's fine to use whatever versioning scheme you like, as long as you communicate it to your consumers.

https://semver.org/

Edit: updated the version strings for clarity.

zamadatix•2h ago

Minor note, but since the topic is accurate semvar: rule 4 specifies 0.x.y is a special case where anything may change at any time.

un1970ix•1h ago

Relevant section: https://semver.org/#:~:text=How%20should%20I,next%20major%20...

Timon3•1h ago

Good point, if we're already being pedantic we should be accurate. I've updated the version strings in my comment, thanks!

chrisweekly•1h ago

Using a 3-digit version like semver, while assigning different semantics, is a recipe for confusion if anyone except you ever refers to a package using this "rule of thumb".

0x457•50m ago

https://preview.redd.it/ou8h9owirmme1.png?width=1024&auto=we...

anotherpaulg•2h ago

Looks very interesting. I was hoping it would solve a problem I’ve had recently:

I want to ssh into a windows box that I only have a normal user account on. So I can’t (and don’t want to) change any admin settings or install anything as admin.

All the obvious approaches hit roadblocks.

Seems like this tool solves the opposite problem: sshing out from a minimally privledged environment.

huslage•2h ago

I am scared that this is vibe coded and not audited in any way. tsnet is good software, but wrapping it in this way is a recipe for disaster. Please reconsider.

KetoManx64•2h ago

Can you explain what the possible risks are?

mystifyingpoi•2h ago

> I am scared that this is vibe coded

Totally serious question: would you feel better about this piece of software, if you didn't know that it was vibe coded?

Do we need "build without AI" stickers on every piece of software created these days?

cchance•1h ago

Seems so lol, every new opensource project i see some guys gotta comment "its probably just vibecoded nonsense, screw this project"

Sorry welcome to 2025, almost every app you see is going to have claude or some other AI assisting with it either fully or in part, its just a fact, coding is faster with AI assistance its just a fact.

People gotta stop bitching about AI in opensource and start pointing out what exactly they dislike or found wrong with the project

Bender•1h ago

Somewhat off topic question but I ask this from time to time and maybe now is that time. Has AI started fixing everyone's software bugs and closing out all the CVE's yet?

eknkc•1h ago

I feel fine if AI was used to add features to an established software. Let it loose on the linux kernel for what I care. It still somehow feels icky to use it to build something from scratch.

un1970ix•1h ago

No one is against using AI or coding with agents unless you don't understand what it's doing and you're incapable of reviewing the output. The problem isn't the tool, it's "coders" who unthinkingly trust it without verification.

KomoD•1h ago

I don't really care if "AI assistance" was used as long a human is actually reviewing the output, which just doesn't seem to be the case here (and usually not the case when it comes to "vibe coding")

huslage•57m ago

I looked at the code and the documentation and it's definitely vibe coded. Also the presence of CLAUDE.md is pretty telling. I have no issue with vibe coding in general, but I am skeptical of the usefulness of LLMs with security code.

Yes, I think projects that are coded wholly or in part by LLMs should be noted as such.

isatty•2h ago

I agree and had the same thought. Tailscale ssh is good and I was interested in something like this but absolutely not if it’s AI generated garbage.

rsync•55m ago

Tangential ... I think I read somewhere that I cannot become a customer of tailscale without FAANG credentials ?

As in, I cannot simply sign up with my own personal identifiers (email, phone, etc.) but need to participate in a google auth or FB auth mechanism ?

I found it hard to believe - is this, indeed, the case ?

erinnh•49m ago

You need one of the following:

Google, Microsoft, Github, Apple or your own OIDC Provider.

They do not have their own account backend.

So you dont technically need a FAANG account if you have a Gitea, Gitlab, Authentik Account or something like that.

Deathmax•48m ago

Since April 2023 they support custom OIDC providers[1], and as of April 2024 that was extended to the free plan as well[2], so you can bring your own auth.

[1]: https://tailscale.com/kb/1240/sso-custom-oidc

[2]: https://tailscale.com/blog/sso-tax-cut

Phoenix.new – Remote AI Runtime for Phoenix

Visualizing environmental costs of war in Hayao Miyazaki's Nausicaä

Show HN: Nxtscape – an open-source agentic browser

Cracovians: The Twisted Twins of Matrices

Rolling the ladder up behind us

Oklo, the Earth's Two-billion-year-old only Known Natural Nuclear Reactor (2018)

A Python-first data lakehouse

How to Design Programs 2nd Ed (2024)

Klong: A Simple Array Language

Hurl: Run and test HTTP requests with plain text

A Brief, Incomplete, and Mostly Wrong History of Robotics

Minimal auto-differentiation engine in Rust (for educational purposes)

A deep-dive explainer on Ink and Switch's BeeKEM protocol

College baseball, venture capital, and the long maybe

Meta announces Oakley smart glasses

Show HN: I wrote a new BitTorrent tracker in Elixir

Asterinas: A new Linux-compatible kernel project

HCP Vault Secrets End of Life

Reworking Memory Management in CRuby [pdf]

Congestion pricing in Manhattan is a predictable success

ELIZA Reanimated: Restoring the Mother of All Chatbots

Show HN: Ts-SSH – SSH over Tailscale without running the daemon

Qfex (YC X25) – Back End Engineer for a 24/7 Stock Exchange

Mierle Laderman Ukeles, a '70s artist who became a hero to 'garbage men'

Compiling LLMs into a MegaKernel: A path to low-latency inference

Show HN: SnapQL – Desktop app to query Postgres with AI

NASA Scientists Find Ties Between Earth's Oxygen and Magnetic Field

The Right Chemistry: How Jean Harlow became a ‘platinum blond’ (2020)

Giant, all-seeing telescope is set to revolutionize astronomy

The Ecosystem Dynamics That Can Make or Break an Invasion

Phoenix.new – Remote AI Runtime for Phoenix

Visualizing environmental costs of war in Hayao Miyazaki's Nausicaä

Show HN: Nxtscape – an open-source agentic browser

Cracovians: The Twisted Twins of Matrices

Rolling the ladder up behind us

Oklo, the Earth's Two-billion-year-old only Known Natural Nuclear Reactor (2018)

A Python-first data lakehouse

How to Design Programs 2nd Ed (2024)

Klong: A Simple Array Language

Hurl: Run and test HTTP requests with plain text

A Brief, Incomplete, and Mostly Wrong History of Robotics

Minimal auto-differentiation engine in Rust (for educational purposes)

A deep-dive explainer on Ink and Switch's BeeKEM protocol

College baseball, venture capital, and the long maybe

Meta announces Oakley smart glasses

Show HN: I wrote a new BitTorrent tracker in Elixir

Asterinas: A new Linux-compatible kernel project

HCP Vault Secrets End of Life

Reworking Memory Management in CRuby [pdf]

Congestion pricing in Manhattan is a predictable success

ELIZA Reanimated: Restoring the Mother of All Chatbots

Show HN: Ts-SSH – SSH over Tailscale without running the daemon

Qfex (YC X25) – Back End Engineer for a 24/7 Stock Exchange

Mierle Laderman Ukeles, a '70s artist who became a hero to 'garbage men'

Compiling LLMs into a MegaKernel: A path to low-latency inference

Show HN: SnapQL – Desktop app to query Postgres with AI

NASA Scientists Find Ties Between Earth's Oxygen and Magnetic Field

The Right Chemistry: How Jean Harlow became a ‘platinum blond’ (2020)

Giant, all-seeing telescope is set to revolutionize astronomy

The Ecosystem Dynamics That Can Make or Break an Invasion

Show HN: Ts-SSH – SSH over Tailscale without running the daemon

Comments