Tool
Tailscale
A managed WireGuard mesh so your laptop, phone, and homelab can reach each other without opening random ports to the whole internet.
What it is
Tailscale builds a private network across your devices using WireGuard, with a coordination/control plane that handles key exchange and membership. Official open-source page: the core client (tailscaled / CLI) is largely open source; GUI wrappers on some proprietary OSes are not; the company’s coordination server is proprietary. Headscale is the independent open-source control-server alternative.
What it replaces
It replaces port-forwarding, “just expose the dashboard,” and a lot of DIY VPN pain for small teams and homelabs. For self-hosted AI UIs, it replaces putting Open WebUI on the public internet “for convenience.”
It does not replace application auth, backups, or patching. A private network full of unpatched services is still a bad network. And if you need a fully self-hosted control plane, that is Headscale (or another stack) — not pretending Tailscale’s SaaS is open source.
License
The main tailscale/tailscale repository is under the BSD 3-Clause License. Tailscale documents which pieces are open (client core, DERP code, etc.) and which are not (coordination server; some platform GUIs). Paid plans govern SaaS features and scale; read current pricing separately from the client license.
Where it falls over
- You still trust a coordination plane (Tailscale’s or yours).
- ACL mistakes and “everyone is admin” habits recreate the exposure you were avoiding.
- Exit nodes / subnet routers add power and blast radius together.
- Free/personal tiers and org features change; verify limits before you design around them.
Who it's for
People who want private access to home or lab services without public ingress. Operators who will still lock down the apps behind the mesh.
Verdict
Use Tailscale when a managed WireGuard mesh beats DIY. Use Headscale when you need the control plane on your metal. Neither forgives weak app security.
← Tools · Home · tailscale.com