Open source server

[toonsevrin]

I think Tailscale is a beautiful project, it would be even more perfect if the server was open-source.

Are there ever going to be any plans for this?

If this is not planned, I'd like to propose a zero-trust extension, to mitigate the risk of the tailscale platform being compromised.

The simplest version would be tailscale up <private signing key>. All servers publish their status (interface, public keys...) periodically, signed by this key. This way a compromised tailscale admin cannot forge anything.

[bradfitz]

Thanks for filing.

When we did our initial open source release earlier, the server was in no way releasable (full of hard-coded strings, URLs, customer policies, etc). It's getting better, but we're still planning a major protocol change before we'd want to release anything ourselves. We'd also have to decide which parts to release & how to refactor the code to make it more modular. It's a lot of work (and ongoing support) and we have tons of other priorities at the moment.

But on Twitter the other day, an open source server ("Headscale") was announced: https://twitter.com/juanfont/status/1274652518128201728 ... maybe that'd work for you?

As for a key that proves the server hasn't been compromised, yeah... we'd been discussing such a thing. Can you file a separate bug about that? (It's hard to have a single bug tracking separate things)

[toonsevrin]

@bradfitz that's amazing to hear. I understand the separation of priorities.

But you do make a fair point with regards to headscale: Having a community edition would be wholesome.

This way you only have to worry about tidying up your client-server interface and the OS free labor market will take care of the rest.

#499 for the security related topic.

[fti7]

One Year later. Any update on this? :-) would be awesome if you opensource it

[boehs]

Would subscribe to personal pro if it was open source, FWIW

[ItalyPaleAle]

Personally, I'd pay for this to be self-hostable, even if not OSS.

[boehs]

Personally, I'd pay for this to be self-hostable, even if not OSS.

Not a fan of this, what about selling binaries? Would be the best of both worlds, open to contribute but still a commercial product

[julianfairfax]

From https://tailscale.com/opensource

Why does tailscale promote and support an open source alternative to their closed source coordination server, rather than releasing the code to their own server? It seems like an helpful but hypocritical position. Essentially, tailscale is encouraging the community to duplicate their work, rather than just giving out the "official" version, which is very similar. Could someone help me understand the point or reasoning of this approach?

It's also worth noting, although I'm sure I'm in the minority here: not all tailscale users are capable of self-hosting headscale. I can't as I can't use port-forwarding, and the coordination server would need to be publicly accessible to work. That's why I use tailscale in the first place. It means though, that even if I wanted to, I wouldn't be able to take advantage of headscale's open source implementation of the tailscale coordination server.

[tianon]

When we did our initial open source release earlier, the server was in no way releasable (full of hard-coded strings, URLs, customer policies, etc). It's getting better, but we're still planning a major protocol change before we'd want to release anything ourselves. We'd also have to decide which parts to release & how to refactor the code to make it more modular. It's a lot of work (and ongoing support) and we have tons of other priorities at the moment.

(Just a few comments up)

[DentonGentry]

Why does tailscale promote and support an open source alternative

1. An open source community already exists around Headscale. It is better to support a community which exists. As described above, the coordination server used in the public service wasn't ready to open source at the point that Headscale appeared.
2. The coordination server for the Tailscale service is multitenant, handling a large number of tailnets. It has a number of ancillary services it relies on. Setting it up to run self-hosted would be a number of steps, and likely result in referrals to Tailscale support to help people set up and maintain their instances.

I can't as I can't use port-forwarding, and the coordination server would need to be publicly accessible to work.

That is not something an open source server can help with. One cannot use Tailscale to operate Tailscale. The coordination server needs to be publicly reachable.

---

At this point, I'm going to close this issue as completed. We expect to continue to support the Headscale community, as described in https://tailscale.com/blog/opensource/