tsbridge is a production-grade reverse proxy that exposes multiple backend services on a Tailscale tailnet using isolated tsnet nodes per service. It supports static TOML configuration and dynamic Docker label discovery, with hot-reload, graceful shutdown, Prometheus metrics, and a composable middleware chain (access log, whois identity lookup, request ID, body size limits, header sanitization). The architecture is a single Go binary that manages per-service tsnet.Server instances, each with its own state directory and listener. External dependencies are Tailscale (tsnet), Docker (optional), and Prometheus. The codebase demonstrates strong engineering practices: interface-based abstractions (TSNetServer, config.Provider), typed error hierarchy, secret resolution with redaction, debounced event handling with exponential backoff, and comprehensive unit and integration tests. It is actively maintained with CI/CD, dependabot, and regular dependency updates.
golink is a private shortlink service (http://go/) for Tailscale tailnets. It allows users to create short aliases for URLs, supports Go text/template expansion for dynamic links, and integrates deeply with Tailscale identity and networking via the tsnet library. The architecture is a single Go binary that uses an embedded SQLite database for persistent storage and serves both a web UI (TailwindCSS + Go templates) and a JSON API. It handles user authentication through Tailscale's WhoIs mechanism, supports admin grants via ACL capabilities, and provides backup/restore via JSON Lines export. The codebase is well-structured, with clear separation between database operations (db.go), HTTP handlers and link resolution logic (golink.go), and the CLI main entry point. The repo includes comprehensive tests, Docker/Nix/Helm deployment options, and Prometheus metrics. It demonstrates high craftsmanship in areas such as idempotent snapshot restoration, template-based link expansion with path/query forwarding, and robust XSRF protection.