Skip to content

Tailscale

Tailscale is a zero-config mesh VPN built on the open-source WireGuard protocol. It puts your devices and servers on one private encrypted network (a tailnet) with peer-to-peer connections, identity-based access, and no exposed ports. Founded 2019 (Toronto); co-founder Brad Fitzpatrick (of memcached/Go fame).

Why it matters for this box

Tailscale is the private-access + emergency path complement to caddy's public HTTPS. Services that shouldn't be on the public internet are reachable only over the tailnet, and if Caddy or DNS ever breaks, the Tailscale IP (100.x.x.x) is still a way back in.

Key facts

  • Encrypted point-to-point connections via WireGuard; direct device-to-device (low latency), unlike a hub-and-spoke legacy VPN.
  • Identity-based: devices join via SSO auth; access controlled by ACLs.
  • Exit nodes let you route all traffic through one node (traditional-VPN behavior when wanted).
  • Free tier is generous for personal/small use; paid tiers for teams/business.
  • Marketed as Zero Trust connectivity replacing legacy VPN / SASE / PAM.

On this box (live)

This VPS is a tailnet node named claw-droplet (100.65.10.124), alongside dereks-mac-mini and forge. (Note: the box's own /srv/_docs/inventory.md was stale on this point and is being corrected.) See stack-sovereignty-box.

What it replaces

Legacy corporate VPN appliances and fiddly manual WireGuard configs. Free for personal scale.