spb/tools-spboucher-ai

1{2  "slug": "tailscale",3  "name": "Tailscale",4  "aliases": ["tailscaled"],5  "vendor": { "name": "Tailscale Inc.", "slug": "tailscale-inc", "website": "https://tailscale.com" },6  "homepage_url": "https://tailscale.com/",7  "docs_url": "https://tailscale.com/docs",8  "repo_url": "https://github.com/tailscale/tailscale",9  "pricing_url": "https://tailscale.com/pricing",10  "license_url": "https://github.com/tailscale/tailscale/blob/main/LICENSE",11  "product_type": "service",12  "product_status": "active",13  "summary": "WireGuard-based mesh overlay network with a hosted coordination service, identity-provider login, access policies, MagicDNS and features such as Tailscale SSH, Serve and Funnel",14  "description": "Tailscale is a connectivity service from Tailscale Inc. that builds a private mesh network, a tailnet, on top of WireGuard. Each device runs an open-source client (BSD-3-Clause) that authenticates through an existing identity provider such as Google, Microsoft, GitHub or any OIDC server; a proprietary coordination server operated by Tailscale then distributes public keys, assigns stable addresses and pushes access policies, while the encrypted traffic itself flows directly between peers, using DERP relay servers only when NAT traversal fails.\n\nThe result is a network that mostly configures itself. MagicDNS gives every machine a name, ACLs written in HuJSON restrict who can reach which ports, exit nodes route internet traffic through a chosen device, and subnet routers expose networks that cannot run the client. Tailscale SSH authenticates shell sessions with tailnet identity instead of keys, Serve publishes a local port to the tailnet with automatic HTTPS, and Funnel extends that to the public internet. Clients exist for Linux, macOS, Windows, iOS, Android, Synology and container images.\n\nIt is popular with homelabs, small teams and distributed fleets of machines, including Mac clusters, because joining a device is a single login. The Personal plan is free for non-commercial use; business plans add users, SSO and support features. The main caveats are reliance on Tailscale's hosted control plane (the open-source Headscale project reimplements it for self-hosting), the fact that device-to-device SSH over the tailnet may be restricted by ACLs, and limits on advanced routing compared with a hand-built WireGuard topology.",15  "capabilities": ["Zero-configuration WireGuard mesh with NAT traversal and DERP relays", "Single sign-on through Google, Microsoft, GitHub, Okta and generic OIDC providers", "Access control lists and device tags with a policy file", "MagicDNS, exit nodes and subnet routers", "Tailscale SSH with identity-based authentication", "Serve and Funnel for publishing local services privately or publicly", "Clients for Linux, macOS, Windows, iOS, Android, Synology and Docker"],16  "workflows": ["Join laptops, servers and phones to one private network with a login", "Reach a home or lab machine from anywhere without port forwarding", "Publish a development server to the internet with Funnel", "Route a cloud VPC into the tailnet through a subnet router"],17  "advantages": ["Minutes to set up compared with manual WireGuard", "Identity-based policies instead of shared keys", "Direct peer-to-peer connections in most cases", "Free personal plan and open-source client"],18  "limitations": ["Coordination server is hosted and proprietary", "Relay (DERP) paths are slower when direct connections fail", "Policy semantics can block expected traffic until ACLs are tuned", "Advanced routing options are fewer than raw WireGuard"],19  "prerequisites": ["An identity-provider account to sign in", "Client installed on each device"],20  "audiences": ["Homelab and self-hosting users", "Small teams and distributed infrastructure operators", "Developers needing secure access to remote machines"],21  "alternatives": ["wireguard", "cloudflare-tunnel", "ngrok", "openssh"],22  "comparison_notes": "Plain WireGuard gives full control and no third-party dependency but requires manual key distribution and routing. Cloudflare Tunnel and ngrok publish individual services through a provider's edge rather than building a private network between devices; Tailscale Funnel overlaps with them for occasional public exposure. OpenSSH remains the lowest-common-denominator remote shell and works over a tailnet or without it.",23  "categories": [{ "slug": "tunneling-remote-access", "primary": true }],24  "tags": ["vpn", "wireguard", "mesh-network", "zero-trust", "sso", "macos", "linux", "self-hosted"],25  "use_cases": ["expose-local-services", "connect-private-networks", "access-remote-machines"],26  "operating_systems": ["linux", "macos", "windows", "ios", "android"],27  "execution_modes": ["cloud", "local"],28  "interfaces": ["cli", "desktop", "mobile", "web", "api"],29  "deployment_models": ["saas", "hybrid"],30  "integrations": ["WireGuard", "Google Workspace", "Microsoft Entra ID", "GitHub", "Okta", "Synology", "Docker", "Caddy"],31  "data_formats": ["HuJSON policy file"],32  "languages": ["Go"],33  "source_model": "mixed",34  "license_spdx": "BSD-3-Clause",35  "pricing_model": ["freemium", "paid", "enterprise"],36  "pricing_checked_at": "2026-11-02",37  "self_hostable": false,38  "sources": [39    { "url": "https://tailscale.com/", "type": "official_site", "title": "Tailscale", "supports": ["name", "summary", "operating_systems"], "checked_at": "2026-11-02" },40    { "url": "https://tailscale.com/docs", "type": "official_docs", "title": "Tailscale Docs", "supports": ["capabilities", "workflows", "limitations"], "checked_at": "2026-11-02" },41    { "url": "https://github.com/tailscale/tailscale/blob/main/LICENSE", "type": "license_page", "title": "tailscale/tailscale LICENSE (BSD 3-Clause)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" },42    { "url": "https://tailscale.com/pricing", "type": "pricing_page", "title": "Tailscale Pricing", "supports": ["pricing_model"], "checked_at": "2026-11-02", "note": "Plans named Personal (free, non-commercial), Standard, Premium and Enterprise." }43  ],44  "confidence": "high",45  "uncertainty_note": "The client is BSD-3-Clause; the coordination server is proprietary, hence source_model mixed and self_hostable false (Headscale is a third-party reimplementation).",46  "discovery_method": "editorial-research",47  "depth": "deep",48  "editorial_status": "reviewed",49  "visibility": "public",50  "featured": true,51  "author": "batch-B2"52}53