March 2022 Summaries

Tailscale's free plan remains free by maintaining low scaling costs compared to typical SaaS companies, focusing on privacy and leveraging word-of-mouth to promote its corporate plans. The company's unique hybrid centralized/decentralized architecture minimizes operational expenses by separating the control plane and peer-to-peer data plane, allowing for efficient management and reduced latency. While most SaaS companies track costs in product development, customer acquisition, and goods sold, Tailscale's costs are kept in check by focusing on product quality, self-serve payments, and community support, with a significant investment in tech support to handle early-stage user inquiries. Their business model, referred to as "bottom-up" or product-led growth, offers a free tier to individuals and charges incrementally for team and corporate features, encouraging users to introduce Tailscale in their workplaces. By doing so, the company ensures that while users enjoy free services, they promote Tailscale to potential paying customers, maintaining a balance between offering free services and achieving profitability without compromising user privacy.

Caddy is an open-source web server that simplifies managing HTTPS certificates for web applications on a Tailscale network, addressing the issue of browser security warnings when accessing internal web apps over HTTP. While Tailscale provides end-to-end encryption through WireGuard, browsers still require valid TLS certificates to recognize secure connections. Tailscale allows provisioning of HTTPS certificates from Let’s Encrypt for internal applications, and with Caddy's capabilities, these certificates can be automatically obtained and renewed for public web servers on a tailnet. The beta release of Caddy 2.5 enhances this functionality by automatically recognizing and utilizing Tailscale network certificates for domains, simplifying the setup process. To integrate Caddy with Tailscale, users must ensure HTTPS certificates are enabled on their tailnet and either run Caddy as root or configure permissions to access Tailscale’s socket, allowing Caddy to seamlessly manage the certificates without additional configuration.

Tailscale has simplified server management by allowing tagged nodes to bypass key renewal, a change that removes the need for periodic reauthentication of these devices, which typically lack an associated user. This update means that when devices are authenticated and assigned an ACL tag, their key expiry is disabled by default, simplifying management especially for servers, subnet routers, or exit nodes. Administrators can easily manage key expiry settings through the admin console or API, ensuring flexibility. Recent features facilitate the process of setting up a server on Tailscale by using ACL tags to assign permissions and generate auth keys for authentication, streamlining the integration of servers into a network without repeated reauthentication, thereby enhancing ease of maintenance and automation.