🦊 FAQ

The HTML, CSS, and JavaScript for this site were generated with the help of AI tooling (Kiro). Jack, the developer behind this project, is an infrastructure engineer — not a web designer. The front-end exists purely to make it easy for anyone to generate ready-to-run Terraform files without touching code.

The Terraform configurations themselves are built from Jack's hands-on experience managing Infrastructure as Code across his career. The idea was simple: if generating a working Terraform deployment can be reduced to a few clicks, more people might try managing their own infrastructure.

Many people route all their internet traffic through commercial VPN companies without knowing how those services actually work — what gets logged, who has access, or how the infrastructure is managed.

This project exists to give people a way to run their own exit node — a server they provision, on an account they control, that they can destroy at any time. It's a step towards owning your own infrastructure rather than renting someone else's black box.

A secondary goal is to introduce people to Terraform. Once you've deployed your first piece of infrastructure with it, you start to see how repeatable and empowering it is.

Honest answer: it depends on your threat model. Here's what you're trusting and what you're not:

• Your traffic content is encrypted end-to-end by WireGuard (which Tailscale uses). Neither your cloud provider nor Tailscale can read the contents of your web traffic.
• Your cloud provider (Hetzner, DigitalOcean, Linode) can see network metadata — source/destination IPs and bandwidth volumes — at the hypervisor level. They can't see inside the encrypted tunnel, but they know your server is communicating with the internet. They will also respond to law enforcement requests.
• Tailscale's coordination server handles key exchange and device discovery. It knows which devices are in your tailnet, when they connect, and that you're advertising an exit node. It does not see your traffic content.
• Application-level logging on the VM is entirely under your control — the generated config doesn't install any monitoring or logging agents. But you don't own the physical hardware, so you're trusting the hosting provider at the infrastructure layer.

What you gain over a commercial VPN: You eliminate the single point of trust that is the VPN company. There is no company logging your browsing, no shared IP address tying your traffic to hundreds of other users, and no terms of service that can change under you. You own the server and can verify exactly what runs on it.

What you don't gain: Complete anonymity. If a government compels your cloud provider or Tailscale to hand over metadata, they could correlate your activity. If that's your concern, this tool is not the right solution — look at Tor or similar anonymity networks instead.

This project is about sovereignty and control, not invisibility.

This project doesn't ask for money or donations. It costs nothing to host because it runs as a static site on Cloudflare Pages — there's no server, no database, and no ongoing infrastructure cost for the project itself.

The only costs involved are yours: the cloud VM you provision (as low as ~$4/month depending on provider and region) and your Tailscale account (free for personal use).

Yes. This page runs entirely in your browser. Nothing is sent to any server — no API tokens, no Tailscale keys, no analytics, no tracking. The site doesn't even have a backend.

You can verify this by opening your browser's Developer Tools and watching the Network tab while using the generator. The only outbound requests are to public CDNs (map tiles, Leaflet library, JSZip) and template files hosted alongside this page.

If you still don't trust entering your keys, the generator offers a "I don't trust you" option that downloads the files with placeholder values — you paste your real tokens in manually using a text editor.

Terraform is a tool that lets you describe infrastructure (servers, networks, DNS records, etc.) in simple text files, then create it all with a single command. It's used by companies of all sizes to manage cloud resources in a repeatable, version-controlled way.

This project generates those text files for you, pre-configured to create a Tailscale exit node on your chosen cloud provider. You just run the included deploy script and Terraform handles the rest.

Tailscale is a mesh VPN that makes it easy to securely connect your devices over the internet. It runs on top of WireGuard and handles all the complicated networking for you.

An "exit node" is a Tailscale device that routes your internet traffic through itself — like a traditional VPN server, but one that you own and control. This project helps you deploy one of those.