Tailscale
TAS Score: S2/3 – D3/5 – A2 / T1 S2 (not S3): Exit and Recoverability are partial — network topology depends on Tailscale’s coordination server; new connections fail if server is unreachable (Q2, Q3). D3 (not D5): coordination server is proprietary (Q7); vendor dependency creates hidden cost if terms change (Q6, Q8). Critical criteria for this category: Exit.
Brief Description
Mesh VPN built on WireGuard. Zero‑config networking between devices. Uses a central coordination server for key exchange, NAT traversal, and access control — hosted by Tailscale.
Architectural Role
Network layer: provides encrypted mesh connectivity between devices. Simplifies VPN setup dramatically compared to raw WireGuard.
Technical Autonomy
- ⚠️ Works without internet — existing connections persist, but new device connections and key rotation require the coordination server
- ✅ Stores data locally — traffic flows directly between devices (peer‑to‑peer)
- ❌ Does not require external accounts — requires Tailscale account (via SSO providers)
- ⚠️ Allows data export — network configuration is partially exportable; ACL policies are stored on Tailscale’s servers
- ✅ Provides offline updates — client can be updated manually
Philosophical Assessment (whose.world criteria)
| Criterion | Status | Comments |
|---|---|---|
| Pause | Yes | VPN can be stopped on any device. |
| Exit | Partial | Traffic is yours (P2P), but network topology and ACL policies depend on Tailscale’s coordination server. Migration to raw WireGuard requires reconfiguring every device. |
| Recoverability | Partial | Device connections can be recreated. But if Tailscale changes terms or the coordination server is unreachable, new connections can’t be established. |
| Visibility | Partial | Client is open source. Coordination server is proprietary. You can audit what runs on your device, but not the control plane. |
| External Dependencies | No | Depends on Tailscale’s coordination server for key exchange and NAT traversal. Headscale exists as an open‑source alternative coordination server. |
Why it’s in the catalog
Tailscale is the best example of A2: it works mostly offline, data flows peer‑to‑peer, the client is open source — but the control plane is proprietary. You don’t own your network topology. This is a deliberate trade‑off: massive convenience in exchange for a dependency on a single vendor’s coordination server.
What you gain: Zero‑config VPN. NAT traversal that just works. MagicDNS. ACL policies. SSO integration. Minutes to set up vs. hours for raw WireGuard.
What you give up: Independence from Tailscale’s coordination server. Full control over your network topology. The ability to operate if Tailscale is unreachable.
The Headscale option: Headscale is an open‑source implementation of the Tailscale coordination server. Running it yourself moves Tailscale from A2/T1 to approximately A3/T2 — but you lose Tailscale’s managed infrastructure and some features.
Autonomous alternatives
- WireGuard (A3/T2) — raw VPN, no coordination server, full control
- WireGuard + Headscale — Tailscale‑compatible mesh with self‑hosted control plane
Trajectory
Direction: mixed.
Tailscale’s client remains open source (BSD-3-Clause). The company is growing toward enterprise features (SSO, audit logs, policy controls). The coordination server remains proprietary — but Headscale exists as a community alternative and Tailscale has not moved against it. Watch for changes to the client licence or Headscale compatibility.
Signal assessment:
| Signal | Status | Evidence |
|---|---|---|
| License | ➖ | Client: BSD-3-Clause (open). Coordination server: proprietary. No changes to client licence. |
| Feature gating | ⚠️ | Enterprise features (SSO, audit logs, device posture) are paid-only and growing. |
| Self-hosting | ➖ | Headscale provides an open-source coordination server alternative; Tailscale has not blocked it. |
| Governance | ➖ | VC-backed company; client is open but control plane is proprietary and corporate-governed. |
Signal key: ✅ opening · ➖ neutral · ⚠️ closing