Headscale is an open-source, self-hosted implementation of the Tailscale control plane. It provides a complete VPN solution including user management, node registration, policy enforcement (ACLs, SSH rules, route approvals), API services (v1 and v2), DERP relay capabilities, MagicDNS, and OAuth/OIDC integration. The architecture follows a modular monolith pattern with clear separation between CLI, API, core application logic, state management, policy engine, database layer, and network mapping components. Key entry points include the main CLI command (cmd/headscale/headscale.go) and various subcommands for administration, along with HTTP API handlers for client and management interactions. The system manages the complete lifecycle of a tailnet: authenticating devices, assigning WireGuard keys and IP addresses, enforcing access policies, and distributing network map updates to connected clients.
Tailscale is a production-grade mesh VPN application that creates secure WireGuard-based networks between devices. The repository implements a complete VPN solution: a daemon (`tailscaled`) that manages networking, a CLI (`tailscale`) for user interaction, a DERP relay server for NAT traversal, a Kubernetes operator, a WebDAV-based file sharing system (Taildrive), an SSH server, a DNS resolver, and a web-based management UI. The architecture is modular with feature flags via build tags, extensive platform support (Linux, Windows, macOS, iOS, Android, FreeBSD, etc.), and a plugin-style hook system for optional components (port mapping, app connectors, TPM attestation, etc.). Key data flows include control plane communication via Noise protocol, peer-to-peer connections with NAT traversal (STUN, PCP, UPnP), DNS configuration through OS-specific managers, and file transfers via Taildrop. External dependencies include WireGuard, gVisor netstack, Kubernetes client-go, and AWS SDK. The codebase demonstrates strong engineering practices: extensive tests (unit, integration, VM-based), immutable view types, code generation for cloning and serialization, and careful concurrency with custom utilities like sharded maps and event buses.
tsbridge is a production-grade reverse proxy that exposes multiple backend services on a Tailscale tailnet using isolated tsnet nodes per service. It supports static TOML configuration and dynamic Docker label discovery, with hot-reload, graceful shutdown, Prometheus metrics, and a composable middleware chain (access log, whois identity lookup, request ID, body size limits, header sanitization). The architecture is a single Go binary that manages per-service tsnet.Server instances, each with its own state directory and listener. External dependencies are Tailscale (tsnet), Docker (optional), and Prometheus. The codebase demonstrates strong engineering practices: interface-based abstractions (TSNetServer, config.Provider), typed error hierarchy, secret resolution with redaction, debounced event handling with exponential backoff, and comprehensive unit and integration tests. It is actively maintained with CI/CD, dependabot, and regular dependency updates.
This is a Home Assistant addon that runs Tailscale inside a supervised container, providing a zero-config VPN for building secure networks. The addon orchestrates multiple processes via s6-overlay: tailscaled, a web UI, nginx for ingress, and dnsmasq for MagicDNS proxying. It handles complex networking including iptables DNAT for forwarding tailnet connections to the host, MSS clamping, subnet route protection to avoid collisions with tailnet routes, and Tailscale Serve/Funnel for exposing Home Assistant with TLS. It also supports Taildrop file sharing and Taildrive directory sharing. The architecture is a single container with tightly integrated services, all configured through Home Assistant's addon options. The codebase is well-structured with robust error handling and health checks, but is tightly coupled to the Home Assistant Supervisor environment via bashio and the hassio-addons base image.
VibeTunnel is a production-grade, cross-platform remote terminal access platform. It allows users to connect to terminal sessions from a browser, macOS native app, or iOS app. The Node.js/TypeScript server manages PTY sessions via a custom forked node-pty, supports session recording in asciinema format, and integrates with multiple tunneling services (Tailscale, ngrok, Cloudflare, Pinggy, Pangolin) for remote access. A Rust forwarder handles terminal title sanitisation, and the CLI wrapper (`vt`) enables transparent session creation. Authentication supports PAM, SSH keys, JWT, Tailscale identity, and local bypass. The macOS app (SwiftUI) provides menu bar control, system permission management, Git worktree follow-mode, and Sparkle-based updates. The web frontend (Lit + Tailwind CSS) offers a full terminal UI with quick keys, file browser, and push notifications. The project demonstrates strong engineering with extensive test coverage (unit, integration, Playwright e2e) across all platforms, though multi-platform duplication and vendored native dependencies introduce some maintenance overhead.
Trayscale is an unofficial GTK4/Libadwaita desktop GUI for the Tailscale VPN daemon, targeting Linux (no official Linux GUI exists). It provides a system tray status icon, a full Libadwaita window for managing peers, exit nodes, Mullvad exit nodes, Taildrop file transfers, profiles, and connection state. The architecture is a single Go binary using gotk4 bindings to GTK4 and Libadwaita. It communicates with the local tailscaled via Tailscale's local API and IPN bus watcher for real-time status updates. The codebase demonstrates solid Go engineering: clean separation of concerns (tsutil client layer, UI layer, tray, datatypes), use of modern Go features (generics, iterators, slices, maps), and comprehensive tests for the core polling and search logic. While not a reusable library, several internal packages (peersearch, autosave, listmodels) are well-isolated and could be extracted.
This repository provides a self-hosted platform for deploying and managing web applications on a single server. It integrates Cloudflare for public access via tunnels, Tailscale for secure private access, Docker and Kamal for containerized deployment, and GitHub for webhook-triggered updates. The system consists of a daemon that handles incoming webhooks and manages deployments, and a CLI for initial setup and ongoing administration. Applications are deployed with zero-downtime using Kamal, and the platform automates the configuration of DNS, TLS, and service discovery. The architecture centers around a single Go binary that operates in two modes: as a background service (singleserverd) to process GitHub webhooks and orchestrate deployments, and as a command-line interface (singleserver) for users to configure the platform, add applications, and manage resources. State is stored in files under /etc/singleserver (configuration, credentials) and /srv (source code, storage, backups). The platform emphasizes simplicity and automation, aiming to reduce the operational overhead of running multiple applications on a single VPS. Key features include an interactive setup wizard for connecting provider accounts, automatic DNS and TLS configuration via Cloudflare, secure access through Tailscale Funnel, and a built-in diagnostics tool (doctor) to verify system health. The design prioritizes reliability through atomic file updates, context-aware command execution, and comprehensive error handling. The project includes extensive unit tests and end-to-end validation scenarios that exercise real integrations with the supported services.
golink is a private shortlink service (http://go/) for Tailscale tailnets. It allows users to create short aliases for URLs, supports Go text/template expansion for dynamic links, and integrates deeply with Tailscale identity and networking via the tsnet library. The architecture is a single Go binary that uses an embedded SQLite database for persistent storage and serves both a web UI (TailwindCSS + Go templates) and a JSON API. It handles user authentication through Tailscale's WhoIs mechanism, supports admin grants via ACL capabilities, and provides backup/restore via JSON Lines export. The codebase is well-structured, with clear separation between database operations (db.go), HTTP handlers and link resolution logic (golink.go), and the CLI main entry point. The repo includes comprehensive tests, Docker/Nix/Helm deployment options, and Prometheus metrics. It demonstrates high craftsmanship in areas such as idempotent snapshot restoration, template-based link expansion with path/query forwarding, and robust XSRF protection.
MicroLink v2 is a production-ready Tailscale VPN client for ESP32-S3 devices that establishes secure WireGuard tunnels through Tailscale's control plane. It implements the full Tailscale protocol stack including Noise protocol for control plane encryption, HTTP/2 framing, DISCO peer discovery, STUN for NAT traversal, DERP relay fallback, and WireGuard encryption via wireguard-lwip integration. The architecture uses a multi-task FreeRTOS design with separate tasks for coordination, WireGuard management, DERP transmission, network I/O, and application logic, communicating via message queues and event groups. Key features include WiFi/cellular network failover with health monitoring, zero-copy WireGuard receive option for high-throughput scenarios, NVS-based peer caching with LRU eviction, and an HTTP configuration server for runtime management. The code demonstrates strong protocol fidelity through direct reference to Tailscale's Go source files while adapting to embedded constraints.
ScaleTail is a curated collection of Docker Compose configurations for self-hosting 80+ services with a consistent Tailscale sidecar pattern. Each service directory contains a `compose.yaml` that defines a `tailscale` container (using `tailscale/tailscale:latest`) and an application container using `network_mode: service:tailscale`, enabling secure HTTPS access via Tailscale Serve or MagicDNS. The repository provides environment-driven configuration (`.env` files), health checks, and per-service READMEs. It is not a standalone application or library but a deployment template repository. The dominant character is 'application' as it facilitates deploying applications, though it is purely configuration and documentation. The pattern is highly reusable for any Docker-based self-hosted service wanting Tailscale integration.
This repository provides Docker Compose and Kubernetes configuration files for deploying a variety of self-hosted applications and system services. It serves as a template repository for deploying services like AdGuard Home, Bitwarden, MinIO, Traefik, and others, as well as system tools like Fail2ban and acme.sh for certificate management. The architecture is modular, with each application having its own directory containing deployment configurations (docker-compose.yml, Helm charts, Kubernetes manifests). There is no single unified application; instead, it offers reusable deployment patterns for individual services. Key entry points are the docker-compose.yml or Helm chart files within each application's directory. The repository relies on external dependencies like Docker, Kubernetes, and Helm for deployment, and the applications themselves depend on their respective upstream container images.
This repository provides a bash script (`mnf`) and an nftables rules file (`mullvad.rules`) that enable running Mullvad VPN alongside Tailscale or Zerotier on Linux. The script orchestrates the Mullvad CLI, nftables, and the mesh networking service to ensure traffic from the Tailscale/Zerotier network bypasses the VPN (or is correctly routed) while all other traffic goes through Mullvad. It supports country selection, RAM-only servers, custom DNS, and selective teardown. The code is a single, well-structured bash script with clear functions and argument parsing. It is not a library or framework but a purpose-built tool for a specific network configuration problem. The repository has a small footprint, no tests, and no CI/CD, but it is actively maintained (last commit dated 2026-05-07, though this appears anomalous). The nftables rules file is a simple configuration that marks packets from excluded IP ranges. There are no reusable software components beyond the script itself, which is tightly coupled to the Mullvad/Tailscale/Zerotier ecosystem.