I guess it doesn't really matter, but it would have been nice to give some transparency to the reader that it was not due to actual technical limitations.
It should be the same exact copy, or situation turns into "try demo version, buy the full product". At least from my point of view.
I think it makes no sense for them to put much focus on developing a separate small open source version of their server. So it is good that they actually support its development.
“ The DERP protocol does a protocol switch inside TLS from HTTP to a custom bidirectional binary protocol. It is thus incompatible with many HTTP proxies. Do not put derper behind another HTTP proxy.”
https://github.com/Janhouse/tailscaled-derper/blob/main/dock...
Since we use TLS passthrough and Traefik just proxies TCP, you have to pass certificates to derper, so you either use the Traefik certificate extractor or some other tool to get them.
And initially I though that I would have to integrate libproxyproto into derper in order to handle client IP addresses correctly behind Traefik but it looks like it doesn't really need it.
I thought the Headscale dev had been hired by Tailscale, didn’t he?
Can’t find references right now but I have a distinct memory of reading about it.
So, looks like Tailscale is paying one of the developers to develop for headscale, as par of his job.
This is one of the best ways a company can support an open source project though.
It would be like complaining Vaultwarden is bad because the Bitwarden project is not fully open source even though Vaultwarden is fully open source and has most of the features implemented.
And Headscale kind of ticks all the other boxes mentioned, except "not headscale", because:
* p2p mesh network - it is a mesh network. And even when mesh is blocked, you can use multiple relay servers (derp) which will relay to the mesh from closest location. And you can host your own derp servers.
* Open source and selfhosted - check
* Not Wireguard (Signature-based blocking) - in cases where wireguard is blocked, the derp relay servers run over https and are usually not blocked based on signatures. For example, I use it with Traefik proxy in TCP mode so I could run derp and other http services on the same 443 port and it works great. So - check?
Packaged in nixpkgs - check
On top of that, if you add Headplane admin UI you get nice graphical management, very similar to the one of Tailscale.