Sotoportego 0.2.0 — experimental Tailscale backend

Native VPN client for Haiku with a privilege-separated background daemon and a Haiku-native GUI / CLI driving it over BMessage. This release adds a third, fully native backend: Tailscale, spoken in-process — no tailscaled, no Go/Rust, only OpenSSL (already linked).

What's new since 0.1.2

Tailscale backend (from scratch, experimental)

A complete in-process Tailscale client behind the same VPNBackend seam as OpenVPN and WireGuard.

• ts2021 control plane — the Noise IK handshake over an OpenSSL TLS transport, an HTTP/2 + HPACK (incl. Huffman) stack, and node registration. Verified live against the production coordination server (controlplane.tailscale.com).
• Sign-in — browser SSO (the AuthURL is opened for you) or an optional pre-auth key for headless machines, stored in the Haiku keystore (BKeyStore), never in the profile.
• Network map — a streamed long-poll with incremental peer deltas (PeersChanged / PeersChangedPatch / PeersRemoved), so devices that join after you connect show up live.
• Data plane — brings up a tun/N with the tailnet 100.x address, installs the 100.64.0.0/10 route, and runs an in-process MagicDNS resolver. WireGuard is carried either directly (disco ping/pong hole-punching) or relayed through the peer's home DERP region.
• GUI — a Tailscale menu (add a network, create an account, open the admin console) and a live peers window listing each machine's tailnet IP, path (direct / relay) and online status. A Tailscale network behaves like any other profile once added.

Everything up to and including the DERP relay connection is proven live; end-to-end peer-to-peer packet delivery is wired but still being hardened against real peers on arbitrary networks — hence experimental. Feedback welcome.

GUI & UX

• Connect/Disconnect button moved into the header banner, right-aligned and state-aware.
• Server box now reflects the connected profile, not just the list selection, with a notice when the two differ.
• Custom About window matching the author's other native Haiku apps.
• Keyboard shortcuts for the common commands (Connect K, Disconnect D, Add Tailscale network T, Show peers P, Browse on map M).
• hey scripting — drive the app from the command line: hey Sotoportego do Connect / hey Sotoportego do Disconnect.
• URLs (login / admin / signup) now open via BUrl so they work on stock Haiku.

Reliability

• Disconnect is prompt and crash-free for Tailscale sessions — the teardown used to hang or crash the daemon and leave tun/N up; it now tears down cleanly in about a second (fixed a use-after-free freeing the DERP TLS session under an active read, a reader that never polled the stop flag, and a 30 s blocking control read).
• Control / DERP reads tolerate idle relays instead of dropping the session.

Requirements

• Haiku R1/beta5 or newer on x86_64
• For OpenVPN profiles: pkgman install openvpn
• For WireGuard and Tailscale profiles: lib:libcrypto (OpenSSL 3, ships with Haiku)
• The kernel tunnel add-on (ships with Haiku at /system/add-ons/kernel/network/devices/tunnel)

Install

Install the .hpkg with pkgman install sotoportego-0.2.0-1-x86_64.hpkg, or drop it into ~/config/packages/. Then launch Sotoportego — the GUI registers the daemon via be_roster on first launch; you don't need to start sotoportego_server by hand.

Known limitations

• Tailscale is experimental — the control plane, network map, routing, MagicDNS and the DERP relay connection are proven, but the live WireGuard-over-DERP handshake to a second node hasn't been validated on a client-isolated network (e.g. a phone hotspot). A normal home LAN, where the direct disco path can form, is the best place to try it.
• OpenVPN and WireGuard route IPv4 only (IPv6 routing is blocked upstream in Haiku's tun driver)
• No IPSec backend yet (on the roadmap)