January 2023 Summaries

The January Tailscale newsletter reflects on the community's innovative use of Tailscale, a VPN service that facilitates encrypted point-to-point connections using the WireGuard protocol, while also announcing job openings for collaborative, technical individuals. The newsletter highlights various community contributions, such as guides on securely ingressing into Kubernetes clusters and blocking ads with Pi-hole, along with positive user experiences emphasizing Tailscale's ease of use and integration. It also mentions events like the FOSDEM presentation and CactusCon sponsorship, and shares customer stories like Corelight's seamless transition to Tailscale after their traditional VPN was disrupted. Additionally, Tailscale is developing a learning library to educate users on topics such as software-defined networking and Internet Security Protocol (IPsec).

Configuration audit logs are now generally available for all Tailscale users, providing a detailed record of changes to a network's configuration, which is crucial for maintaining security and integrity. Admins can access these logs in the admin console, where they are presented in a table format with filtering options by user, time, and action, and are also accessible via API. The audit logs, which cannot be disabled and are enabled by default, assist in reviewing modifications such as device additions, ACL updates, or DNS setting changes, making it easier for both admins and auditors to track network changes.

Tailscale has enhanced its API authentication by introducing OAuth support, allowing for the creation of scoped access tokens tailored to specific operations and the ability to continuously generate or refresh tokens using OAuth clients. Previously, API requests were authenticated using simple API keys tied to the user who created them, with a maximum lifespan of 90 days, which was suitable for basic automation but not for more complex scenarios. The new OAuth implementation enables tailnet administrators to create OAuth clients that are not owned by individual users and do not expire, allowing for more granular and secure access control. These clients can generate short-lived access tokens for specific operations, such as managing devices or integrating third-party services, and are compatible with any standard OAuth 2.0 library supporting client credentials grants. The creation and use of OAuth client credentials are logged, can be revoked at any time, and are subject to the permissions allowed by the administrator's role. The feature is currently available in beta for all tailnets, with setup possible through the admin console's OAuth clients page.

Apple's platforms have a rich history of end-user programming and automation, evolving from BASIC on the Apple II to modern tools like Shortcuts, available on iOS 13 and macOS 12. Tailscale, a networking tool, has embraced this evolution by integrating with Shortcuts starting from version 1.36, allowing users to automate Tailscale functionalities directly on iOS and macOS. This integration enables users to manage connection states, use exit nodes, and switch between profiles efficiently, enhancing user experience with automations triggered by location, time, or specific conditions like Wi-Fi connections or battery levels. Shortcuts can be added to the home screen for quick access, and users can leverage Siri for status updates, promoting seamless and personalized control over their Tailscale workflows. The developers encourage users to share their creative automation solutions with the broader Tailscale community through social media and forums.

Traefik Proxy 3.0 beta has introduced support for Tailscale as a certificate resolver, simplifying the process of managing HTTPS certificates for services on a tailnet. This integration eliminates the need to separately handle certificates or expose endpoints for TLS challenges, as Tailscale can automatically manage and renew Let's Encrypt certificates when Traefik is running. The feature, which leverages Tailscale's ability to efficiently provision and renew certificates, streamlines access to devices and services behind Traefik Proxy without additional configuration hurdles. This development, praised for the collaborative efforts of engineers Kevin and Mathieu, can be implemented by enabling HTTPS in Tailscale and adding Tailscale as a certificate resolver in the Traefik configuration. Further details and sample configurations are available in Traefik's documentation and a deep dive post.

In 2022, Tailscale experienced significant growth and development, introducing new features such as Tailscale SSH, which enables SSH access to devices on a tailnet from any location without additional hardware or complex configurations. The company expanded its integration partnerships, enhancing its product's ease of use and deployability. Noteworthy achievements included a $100 million Series B funding round led by CRV and Insight Partners, attaining SOC 2 compliance, and doubling its workforce to over 70 employees. With hundreds of thousands of active users and more than 2,000 teams utilizing its networks, Tailscale remains committed to improving productivity and security, thanks to its passionate community and supportive investors.