🛸 flyvpn

Ephemeral Tailscale VPN with Fly.io.

Spin up a VPN in a few seconds across 17 regions.

Why

flyvpn is for occasional VPN use if you want to stay away from free VPNs and do not trust mass-market providers.

Go use Mullvad past $5/€5 a month.

flyvpn.mp4

What it does

bun run up:

• lists the available Fly.io regions
• creates or reuses a Tailscale exit node
• selects the exit node on your Mac
• removes old flyvpn-* apps when you change regions

bun run up --new creates a new exit node and keeps existing flyvpn-* apps, even in the same region.

bun run down clears the local exit node and destroys one flyvpn-* app. When multiple apps exist, it asks which one to delete.

Prerequisites

Install and configure these tools:

• Bun
• flyctl, signed in to Fly.io
• Tailscale, connected to your tailnet

You also need a Tailscale auth key.

Configure your tailnet

Add tag:vpn to your tailnet policy file:

{
  "tagOwners": {
    "tag:vpn": ["autogroup:admin"]
  },
  "autoApprovers": {
    "exitNode": ["tag:vpn"]
  }
}

Merge these entries with any existing tagOwners and autoApprovers entries.

Create a Tailscale auth key with these options:

• Reusable
• Ephemeral
• Pre-approved, if your tailnet requires device approval
• tag:vpn

See Set up a server on your Tailscale network for auth key details.

Start the VPN

Clone the repository:

git clone https://github.com/m7b-io/flyvpn.git
cd flyvpn

Set the auth key:

export TS_AUTHKEY=tskey-auth-...

Start the VPN:

bun run up

Select a region. flyvpn creates the exit node and selects it in Tailscale.

To create another exit node while keeping existing ones:

bun run up --new

This requires TS_AUTHKEY and selects the new exit node locally. Running bun run up without --new still removes the other apps.

If the exit node does not appear within 60 seconds, approve it in the Tailscale admin console. Then run the command shown by flyvpn.

Stop the VPN

bun run down

If multiple flyvpn-* apps exist, select the one to delete. If only one exists, the command deletes it directly. Do not use the flyvpn- prefix for other apps.

License

flyvpn uses the MIT License.