Does anyone know of a Tailscale alternative that sticks to the basics?
Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?
I was trying to do some kind of insane workflow where you as the operator have a privileged hardware yubikey that admins the nodes when you plug it in, and the point is the nodes would self-propogate the changes outwards. I immidiately ran into classic issues with distributed security in distributed systems (even with only one central operator trying to admin everything). Tailscale is also a bit more secure in its oauth layer - with this architecture, you need to set proper time limits for expiring so one node compromise doesn't get access to the whole fleet. Couldn't really come up with better ideas than forcing the operator to reuse some kind of hardware key (the idea trying to be avoiding maintaining a cloud control plane as much as possible)
Fun foray but creating such a system requires a lot of expertise that I unfortunately lack
I really liked it. I like the idea of embedding firewall rules in a certificate.
But , like you observed, it does not scale as well as tailscale.
Bit more than the basics, but not as much as tailscale.
{tail,head}scale is the best there is for wireguard at more than 3 nodes.
[1]: https://web.archive.org/web/20221222120703/https://emily.id....
There are too much features added now, perhaps some related to enterprise features because that must drive the revenue
Sometimes I am thiking perhaps they provide a light tailscale version but that seems not viable given the complexity now, headscale is great, but the OSS client still have plenty features, though they are gradually added feature based switch in the client source which I think is great, perhaps we can build a light version over it
This is also I do not think the tailscale-rs(which aim to rewrite tailscale with rust) will not be ready in a short time because too much (feature + cross platform) need to be tested
I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable. If I do, there is still a window that this node can send me files until I tag it (I can't install tailscale to a tag).
Sending a file otherwise normally requires an app listening to a port, so taildrop permissions should be same as network permissions set by ACL.
BTW, last year or so tailscale advertised a position for someone to manage complexity of tailscale. Founder was talking about this issue. They seem to be aware of the problem.
FWIW you can rebuild tailscaled to omit all the optional stuff:
https://github.com/tailscale/tailscale/tree/main/feature#mod...
e.g.
% go run ./cmd/featuretags --min
ts_omit_ace,ts_omit_acme,ts_omit_advertiseexitnode,ts_omit_advertiseroutes,ts_omit_androidbin,ts_omit_androiddns,ts_omit_appconnectors,ts_omit_aws,ts_omit_bakedroots,ts_omit_bird,ts_omit_c2n,ts_omit_cachenetmap,ts_omit_captiveportal,ts_omit_capture,ts_omit_cliconndiag,ts_omit_clientmetrics,ts_omit_clientupdate,ts_omit_cloud,ts_omit_colorable,ts_omit_completion,ts_omit_completion_scripts,ts_omit_conn25,ts_omit_connreject,ts_omit_dbus,ts_omit_debug,ts_omit_debugeventbus,ts_omit_debugportmapper,ts_omit_desktop_sessions,ts_omit_dns,ts_omit_dnsresolvecache,ts_omit_doctor,ts_omit_drive,ts_omit_exitnodehealth,ts_omit_favorites,ts_omit_flashappliance,ts_omit_gro,ts_omit_health,ts_omit_hujsonconf,ts_omit_identityfederation,ts_omit_ipnbus,ts_omit_iptables,ts_omit_kube,ts_omit_linkspeed,ts_omit_linuxdnsfight,ts_omit_listenrawdisco,ts_omit_logtail,ts_omit_nattraversal,ts_omit_netlog,ts_omit_netstack,ts_omit_networkmanager,ts_omit_oauthkey,ts_omit_osrouter,ts_omit_outboundproxy,ts_omit_peerapiclient,ts_omit_peerapiserver,ts_omit_portlist,ts_omit_portmapper,ts_omit_posture,ts_omit_qrcodes,ts_omit_relayserver,ts_omit_remoteconfig,ts_omit_resolved,ts_omit_routecheck,ts_omit_runtimemetrics,ts_omit_sdnotify,ts_omit_serve,ts_omit_serviceclientprefs,ts_omit_ssh,ts_omit_synology,ts_omit_syslog,ts_omit_syspolicy,ts_omit_systray,ts_omit_taildrop,ts_omit_tailnetlock,ts_omit_tap,ts_omit_tpm,ts_omit_tundevstats,ts_omit_udptransport,ts_omit_unixsocketidentity,ts_omit_useexitnode,ts_omit_useproxy,ts_omit_usermetrics,ts_omit_useroutes,ts_omit_wakeonlan,ts_omit_webbrowser,ts_omit_webclient