i like that it removes tailscale proprietary.
if that is goal then why not go 100% open source to eliminate the ts derp control as well and get full sovereignty?
like netbird, openziti, zerotier, etc.
i like that it removes tailscale proprietary.
if that is goal then why not go 100% open source to eliminate the ts derp control as well and get full sovereignty?
like netbird, openziti, zerotier, etc.
(Author here)
The DERP server is already open source and tailcat can use any DERP server you run: https://github.com/tailscale/tailscale/tree/main/cmd/derper#...
We just provide some default ones (https://tailcat.dev/derpmap.json) to get started if you're not bandwidth-sensitive. But you don't have to use them.
Update: I added more explicit docs about this to https://github.com/tailscale/tailcat#bring-your-own-derp-rel...
Or just use wireguard directly. I get it that it's a pain in the ass to configure it, but there are plenty of open source config generators
(Author here)
WireGuard doesn't do NAT traversal. That's the main thing this adds. And this also adds a CLI tool + library to do streams over WireGuard w/o installing kernel routings, requiring root, etc.
IPSec may be a pain... but WireGuard is as simple as it gets in my opinion. Yeah, you may need to know basic IP concepts, like MTU...
NAT traversal is a different topic, WG won't help in that, and that can actually be a pain. I guess we should be using IPv6 already, and this tool would be largely redundant already. (not completely, encrypted access to isolated networks is a valid use case)
Even without NAT, the same hole punching techniques must be used for IPv6 since there is usually a firewall blocking inbound traffic. Only in CGNAT type scenarios where the network behind NAT is still "WAN" will be helped by IPv6.
> it's a pain in the ass to configure it
Public/private key pairs are hard? It's no more terrible than other projects that require configs.
For me the complicated part was understanding the IP assignment for peers and how to set that up correctly
> pain in the ass to configure it
Idk? I found it pretty easy to configure by blindly following the tutorials and copy-pasting keys. The only footgun is the keepalive setting, which will screw up the tunnel if one end is behind NAT, that tripped me hard, but besides this, no issues at all.
Umm, we have a full opensource Tailscale stack now?
always have! our darwin and windows clients are closed source, but they wrap the oss implementation in github.com/tailscale/tailscale and you can see and even use all the same hooks yourself.
the control plane is closed source, but headscale is an open source alternative that we embrace and encourage people to use if it meets their needs/desires