Posted by nderjung 12 hours ago
It's really pretty cool.
Just a combo of never getting around to it and friends talking me out of it b/c of existing alternatives such as wormhole[2].
if that is goal then why not go 100% open source to eliminate the ts derp control as well and get full sovereignty?
like netbird, openziti, zerotier, etc.
The DERP server is already open source and tailcat can use any DERP server you run: https://github.com/tailscale/tailscale/tree/main/cmd/derper#...
We just provide some default ones (https://tailcat.dev/derpmap.json) to get started if you're not bandwidth-sensitive. But you don't have to use them.
Update: I added more explicit docs about this to https://github.com/tailscale/tailcat#bring-your-own-derp-rel...
WireGuard doesn't do NAT traversal. That's the main thing this adds. And this also adds a CLI tool + library to do streams over WireGuard w/o installing kernel routings, requiring root, etc.
NAT traversal is a different topic, WG won't help in that, and that can actually be a pain. I guess we should be using IPv6 already, and this tool would be largely redundant already. (not completely, encrypted access to isolated networks is a valid use case)
Public/private key pairs are hard? It's no more terrible than other projects that require configs.
Idk? I found it pretty easy to configure by blindly following the tutorials and copy-pasting keys. The only footgun is the keepalive setting, which will screw up the tunnel if one end is behind NAT, that tripped me hard, but besides this, no issues at all.
the control plane is closed source, but headscale is an open source alternative that we embrace and encourage people to use if it meets their needs/desires
Recently: https://github.com/golang/go/commit/128a36cf0367c46daff2528d...
https://github.com/golang/go/commit/3c0665e551be23e62167f625...
But Tailscale keeps sucking me in with new stuff to do. :(
But these are a separate fleet (https://tailcat.dev/derpmap.json) separate from our usual ones, and not using "tailscale.com" in DNS or SNI anywhere.
edit:
Which are probably tailscale's, as it's under tailscale/ github org?
I bet I could simplify out the WebSocket-to-UDP proxy by leaning into tailcat's dataplane and just speak straight UDP.
I've been making a mesh vpn like radmin vpn or hamachi that does not need a central authority server and most importantly, can run on all major OS thanks to wireguard-go.