Algo VPN

Last reviewed Aug 26, 2026 · 837 words

Algo is not a VPN server you run. It is a script you run once from your laptop that leaves a hardened WireGuard and IPsec server behind on a cloud instance costing about $5 a month, and then gets out of the way. That makes it the wrong tool for reaching your homelab from the road and the right tool for replacing a commercial VPN subscription with something you actually control, and most people who are disappointed by it wanted the other thing.

Exit node versus mesh: pick the problem first

Two very different products share the word VPN. A mesh like Tailscale or Headscale connects your devices to each other so you can reach the NAS from a cafe; traffic to the internet still leaves from wherever you are. An exit-node VPN, which is what Algo builds, sends all of your traffic out through one server so the cafe Wi-Fi, your ISP, and the hotel network see only an encrypted tunnel to a cloud IP. If your question is "how do I get to Immich from my phone", read the Headscale versus Tailscale comparison instead. If your question is "how do I stop paying NordVPN", keep reading.

The deploy is 15 minutes, most of it waiting on Ansible

Algo is a Trail of Bits project (AGPL-3.0, roughly 30,000 stars, around since 2016) written as a set of Ansible playbooks with a Python wrapper. The workflow:

git clone https://github.com/trailofbits/algo
cd algo
python3 -m venv .env && source .env/bin/activate
pip install -r requirements.txt
# edit config.cfg: add one name per user under `users:`
./algo

The interactive prompts ask for a provider (DigitalOcean, AWS, Google Cloud, Azure, Hetzner, Vultr, Linode, Scaleway, and others, or "an existing Ubuntu server" you already have), a region, and a handful of yes/no options. Roughly 10 minutes later there is a configs/<server-ip>/ directory holding a WireGuard .conf and a QR code PNG for every user you listed, plus IPsec profiles for devices that cannot run WireGuard. Scan the QR code from the WireGuard app on a phone and you are connected. The whole thing is 256 MB of RAM on the server side and runs happily on the cheapest instance any of those providers sells.

Hardened by default means fewer knobs, on purpose

Algo's opinion is that a personal VPN should have almost no configuration surface. It installs only WireGuard and strongSwan for IKEv2, restricts IPsec to modern ciphers, turns on automatic security updates, runs a local DNS resolver that can optionally load ad-blocking lists, and does not ship a web UI or a user database. That is what "command-line only" in the cons column means in practice. If you want a dashboard, a client list, and a button to add people, wg-easy is the right tool for a homelab; Algo is for the person who wants the server to be boring and unattended.

User changes mean a redeploy, so plan users up front

Because there is no admin interface, adding or removing a person means editing config.cfg and running ./algo update-users against the existing server. It takes a couple of minutes and regenerates the configs directory, but it also means the person with the laptop that ran the deploy is the only administrator. The project leans into this with the "disposable" pattern: spin a server up for a trip or a month, tear it down afterwards, redeploy fresh when needed. On a per-hour cloud plan that is cheaper than a subscription and leaves no long-lived box to patch.

What it hides, and what it does not

Be honest with yourself about the threat model. An Algo server hides your traffic from the local network and your ISP, and it means no VPN company holds logs about you. It does not make you anonymous: the cloud provider knows the instance is yours, and every website you visit sees one IP address that only you use, which is a stronger identifier than your home connection shared with a household. Commercial VPNs' one real advantage is that you are lost in a crowd of other customers on the same exit IP. The threat modelling post walks through which of those things you actually care about; for most people the answer is "untrusted Wi-Fi and ISP snooping", and Algo covers both.

What I'd do

One Algo deployment on a cheap Hetzner or DigitalOcean instance, WireGuard only, two or three users written into config.cfg before the first run, ad-blocking DNS turned on. Keep Tailscale for reaching the homelab, because they solve different problems and coexist fine on the same phone. Redeploy from scratch every few months rather than nursing the old server; that is the workflow Algo was built for, and it is the one where its choices make the most sense in the remote-access category.