4 ms·

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev/tailscale.com/tsnet https://pkg.go.dev/tailscale.com/tsnet [2] https://github.com/tailscale/golink https://github.com/tailscale/golink

xlii 2y ago
How difficult it is to use? Right now I’m working on orchestrating dev-local service clusters here I bind plenty of hosts to mimick real world. I’m using proxy tunneling to punch in but I’d love to have Tailscale endpoint which I could use to connect external devices (like mobile clients or non-technical stakeholders for show and tell).
- tsujamin 2y ago
  It’s pretty simple, I’ve not updated my package version in a while but iirc you give it a state directory, an auth key, and you get a Dial-like interface you can use with the stdlib http libraries
aranw 2y ago
I've been using Tailscale for awhile now and even developed a few internal apps using tsnet as well but I had no idea about golink and it's awesome. Thanks for sharing that!
b_fiive 2y ago
If you're a rust fan we make a similar library, that's all-in on "p2p-QUIC", with pre-baked protocols to import on top: https://github.com/n0-computer/iroh https://github.com/n0-computer/iroh
- tsujamin 2y ago
  That’s super cool, I was going to say “nat punching and public relays are a requirement for me” but you already do that! Definitely filing this away for future projects.
apitman 2y ago
See also OpenZiti: https://openziti.io/ https://openziti.io/
- PLG88 2y ago
  For replacing port forwarding, OpenZiti definitely works. zrok, which is built on top of OpenZiti, could also be a great option for sharing resources - https://zrok.io/ https://zrok.io/
gabeio 2y ago
You don't actually need tsnet for that. tailscale cli itself running the subcommand serve will allow you to share a specific port on your machine either with your tailnet or use funnel and share it out to the internet. I pulled tsnet out of my go application and switched entirely to `tailscale serve` and just use the header that adds to auth my family into apps I write. I love it.
- tsujamin 2y ago
  funnel and serve are also awesome, but in this case the use case necessitated a single binary that worked without the full package installed/didn’t touch the routing table or tun device
  - gabeio 2y ago
    Ah if you truly need a single binary, yes it is nice. I had some issues with builds every once in a while, which is another reason I switched to using tailscale serve instead.
ksajadi 2y ago
Absolutely. You can run a go process that becomes a Tailscale client without any other dependencies. This is what I use it for issuing JWT for service authentication: https://github.com/AltaCoda/tailbone https://github.com/AltaCoda/tailbone
mafro 2y ago
I've been using tailscale/tailscale-caddy[1] successfully to serve applications only on my tailnet. It says highly experimental, but it's worked just fine for me. [1] https://github.com/tailscale/caddy-tailscale https://github.com/tailscale/caddy-tailscale
- LiquidFlux 2y ago
  Another option to consider would be TSDProxy. https://github.com/almeidapaulopt/tsdproxy https://github.com/almeidapaulopt/tsdproxy
PLG88 2y ago
Check out OpenZiti - https://openziti.io/ https://openziti.io/. It looks like Tailscale but is open source, takes zero trust principles to its logical conclusion, and includes a whole suite of SDKs (alongside host based tunnelers and VMs) making it super easy to embed private, obsfucated, secure connectivity directly into your apps. Heck, you don't even need listening ports on the host OS network, therefore you app cannot be found or attacked from network/IP. Here is a good blog using Go SDK as an example - https://blog.openziti.io/go-is-amazing-for-zero-trust https://blog.openziti.io/go-is-amazing-for-zero-trust

xlii 2y ago

How difficult it is to use? Right now I’m working on orchestrating dev-local service clusters here I bind plenty of hosts to mimick real world. I’m using proxy tunneling to punch in but I’d love to have Tailscale endpoint which I could use to connect external devices (like mobile clients or non-technical stakeholders for show and tell).

tsujamin 2y ago
It’s pretty simple, I’ve not updated my package version in a while but iirc you give it a state directory, an auth key, and you get a Dial-like interface you can use with the stdlib http libraries

aranw 2y ago

I've been using Tailscale for awhile now and even developed a few internal apps using tsnet as well but I had no idea about golink and it's awesome. Thanks for sharing that!

b_fiive 2y ago

If you're a rust fan we make a similar library, that's all-in on "p2p-QUIC", with pre-baked protocols to import on top: https://github.com/n0-computer/iroh https://github.com/n0-computer/iroh

tsujamin 2y ago
That’s super cool, I was going to say “nat punching and public relays are a requirement for me” but you already do that! Definitely filing this away for future projects.

apitman 2y ago

See also OpenZiti: https://openziti.io/ https://openziti.io/

PLG88 2y ago
For replacing port forwarding, OpenZiti definitely works. zrok, which is built on top of OpenZiti, could also be a great option for sharing resources - https://zrok.io/ https://zrok.io/

gabeio 2y ago

You don't actually need tsnet for that. tailscale cli itself running the subcommand serve will allow you to share a specific port on your machine either with your tailnet or use funnel and share it out to the internet. I pulled tsnet out of my go application and switched entirely to `tailscale serve` and just use the header that adds to auth my family into apps I write. I love it.

tsujamin 2y ago
funnel and serve are also awesome, but in this case the use case necessitated a single binary that worked without the full package installed/didn’t touch the routing table or tun device
- gabeio 2y ago
  Ah if you truly need a single binary, yes it is nice. I had some issues with builds every once in a while, which is another reason I switched to using tailscale serve instead.

ksajadi 2y ago

Absolutely. You can run a go process that becomes a Tailscale client without any other dependencies. This is what I use it for issuing JWT for service authentication: https://github.com/AltaCoda/tailbone https://github.com/AltaCoda/tailbone

mafro 2y ago

I've been using tailscale/tailscale-caddy[1] successfully to serve applications only on my tailnet. It says highly experimental, but it's worked just fine for me. [1] https://github.com/tailscale/caddy-tailscale https://github.com/tailscale/caddy-tailscale

LiquidFlux 2y ago
Another option to consider would be TSDProxy. https://github.com/almeidapaulopt/tsdproxy https://github.com/almeidapaulopt/tsdproxy

PLG88 2y ago

Check out OpenZiti - https://openziti.io/ https://openziti.io/. It looks like Tailscale but is open source, takes zero trust principles to its logical conclusion, and includes a whole suite of SDKs (alongside host based tunnelers and VMs) making it super easy to embed private, obsfucated, secure connectivity directly into your apps. Heck, you don't even need listening ports on the host OS network, therefore you app cannot be found or attacked from network/IP. Here is a good blog using Go SDK as an example - https://blog.openziti.io/go-is-amazing-for-zero-trust https://blog.openziti.io/go-is-amazing-for-zero-trust