The easiest, most secure way to use WireGuard and 2FA.
Go to file
Harry Harpham 1b88e93ff5 ipn/ipnlocal: allow retrieval of serve config ETags from local API
This change adds API to ipn.LocalBackend to retrieve the ETag when
querying for the current serve config. This allows consumers of
ipn.LocalBackend.SetServeConfig to utilize the concurrency control
offered by ETags. Previous to this change, utilizing serve config ETags
required copying the local backend's internal ETag calcuation.

The local API server was previously copying the local backend's ETag
calculation as described above. With this change, the local API server
now uses the new ETag retrieval function instead. Serve config ETags are
therefore now opaque to clients, in line with best practices.

Fixes tailscale/corp#35857
Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-16 15:28:31 -07:00
.bencher bencher: add config to suppress failures on benchmark regressions. 2021-10-01 16:16:02 -07:00
.github .github/workflows: double the timeout for golangci-lint (#18404) 2026-01-14 11:53:14 -08:00
appc appc,feature: add the start of new conn25 app connector 2025-12-09 10:26:01 -08:00
atomicfile all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
chirp all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
client client/local: add method to set gauge metric to a value 2025-12-16 14:11:33 -08:00
clientupdate cmd/distsign: add CLI for verifying package signatures (#18239) 2026-01-07 11:04:14 -08:00
cmd net/netmon: move TailscaleInterfaceIndex out of netmon.State (#18428) 2026-01-16 14:53:23 -05:00
control cleanup: fix typos across multiple files 2025-12-02 07:16:38 -08:00
derp derp/derpserver: add a unique sender cardinality estimate 2025-11-26 12:23:35 -08:00
disco disco: add missing message types to MessageSummary (#17081) 2025-09-09 14:54:22 -07:00
docs docs/windows/policy: use a separate value to track the configuration state of EnableDNSRegistration 2026-01-16 12:30:53 -06:00
doctor all: remove non-applicable "linux" deps on Android 2025-05-07 21:05:13 -07:00
drive all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
envknob syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging 2025-11-16 19:13:59 -08:00
feature cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
gokrazy go.toolchain.rev: update to Go 1.25.5 (#18123) 2025-12-17 18:17:25 -08:00
health ipn/ipnlocal: use an in-memory TKA store if FS is unavailable 2025-11-17 18:12:33 +00:00
hostinfo hostinfo, ipnlocal: add optional os-specific callback for querying the hostname (#15647) 2025-04-14 15:02:32 -04:00
internal cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
ipn ipn/ipnlocal: allow retrieval of serve config ETags from local API 2026-01-16 15:28:31 -07:00
jsondb all: update copyright and license headers 2023-01-27 15:36:29 -08:00
k8s-operator k8s-operator,kube: allowing k8s api request events to be enabled via grants (#18393) 2026-01-16 13:29:12 +00:00
kube k8s-operator,kube: allowing k8s api request events to be enabled via grants (#18393) 2026-01-16 13:29:12 +00:00
licenses net/portmapper, go.mod: unfork our goupnp dependency 2026-01-08 11:42:36 -05:00
log all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
logpolicy all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
logtail net/netmon, wgengine/userspace: purge ChangeDelta.Major and address TODOs (#17823) 2025-12-17 12:32:40 -05:00
maths maths: add exponentially weighted moving average type 2025-02-25 11:59:19 -08:00
metrics metrics: add a NewSet and Set.NewLabelMap helpers 2026-01-13 20:08:24 +00:00
net net/netmon: move TailscaleInterfaceIndex out of netmon.State (#18428) 2026-01-16 14:53:23 -05:00
omit cmd/tailscaled, ipn/conffile: support ec2 user-data config file 2024-05-30 09:49:18 -07:00
packages/deb all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
paths all: detect JetKVM and specialize a handful of things for it 2025-07-10 15:07:19 -07:00
portlist portlist: skip tests on Linux 6.14.x with /proc/net/tcp bug (#18185) 2025-12-10 18:37:03 -08:00
posture util/syspolicy/policyclient: add policyclient.Client interface, start plumbing 2025-09-01 09:34:29 -07:00
prober all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
proxymap syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging 2025-11-16 19:13:59 -08:00
release all: use Go 1.20's errors.Join instead of our multierr package 2025-10-01 08:10:59 -07:00
safesocket ipn/ipnauth, safesocket: defer named pipe client's token retrieval until ipnserver needs it 2025-12-23 14:04:45 -06:00
safeweb safeweb: Set Cross-Origin-Opener-Policy for browser requests (#15936) 2025-05-09 13:44:36 -07:00
scripts scripts/installer.sh: add ultramarine to supported OS list 2026-01-05 12:10:18 -08:00
sessionrecording sessionrecording: fix regression in recent http2 package change 2025-10-29 13:55:16 -07:00
ssh/tailssh ssh/tailssh: send audit messages on SSH login (Linux) 2026-01-05 16:53:05 -08:00
syncs syncs: add means of declare locking assumptions for debug mode validation 2025-11-26 13:04:28 -08:00
tailcfg tailcfg, control/controlclient: start moving MapResponse.DefaultAutoUpdate to a nodeattr 2025-11-25 10:45:34 -08:00
tempfork feature/c2n: move answerC2N code + deps out of control/controlclient 2025-10-04 13:16:49 -07:00
tka tka: add some more tests for Bootstrap() 2025-12-08 15:33:43 +00:00
tool tool/gocross: update gocross-wrapper.ps1 to use absolute path for resolving tar 2026-01-15 10:29:46 -07:00
tsconsensus tsconsensus: skip integration tests in CI 2025-11-25 10:53:40 -08:00
tsconst health: compare warnable codes to avoid errors on release branch (#17637) 2025-10-24 12:08:35 -04:00
tsd cmd/tailscale,ipn: add Unix socket support for serve 2025-12-04 11:06:06 -08:00
tsnet tsnet: allow for automatic ID token generation 2026-01-14 09:02:43 -07:00
tstest net/portmapper, go.mod: unfork our goupnp dependency 2026-01-08 11:42:36 -05:00
tstime tstime: add GoDuration which JSON serializes with time.Duration.String (#15726) 2025-04-17 15:51:41 -07:00
tsweb tsweb: add Unwrap to loggingResponseWriter for ResponseController (#18195) 2025-12-12 12:05:05 +00:00
types ipn,ipn/local: always accept routes for Tailscale Services (cgnat range) (#18173) 2026-01-14 18:20:00 +00:00
util feature/featuretags: make QR codes modular (#18358) 2026-01-08 10:28:40 -08:00
version clientupdate, util/osshare, util/winutil, version: improve Windows GUI filename resolution and WinUI build awareness 2025-10-10 12:11:13 -06:00
wf all: rename variables with lowercase-l/uppercase-I 2025-11-18 09:12:34 +00:00
wgengine ipn,ipn/local: always accept routes for Tailscale Services (cgnat range) (#18173) 2026-01-14 18:20:00 +00:00
wif cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
words words: 33 tails and 26 scales (#18213) 2025-12-16 12:20:33 +00:00
.gitattributes .: add .gitattributes entry to use Go hunk-header driver 2021-12-03 17:56:02 -08:00
.gitignore cmd/k8s-operator: Add NOTES.txt to Helm chart (#16364) 2025-06-25 14:14:17 +01:00
.golangci.yml .github: Bump golangci/golangci-lint-action from 6.5.0 to 7.0.0 (#15476) 2025-04-14 16:04:36 -06:00
ALPINE.txt docker: bump alpine v3.19 -> 3.22 (#17155) 2025-09-17 20:22:24 +01:00
api.md {api.md,publicapi}: remove old API docs (#13468) 2024-09-13 14:10:33 -06:00
assert_ts_toolchain_match.go tailscaleroot: panic if tailscale_go build tag but Go toolchain mismatch 2024-10-06 15:22:04 -07:00
AUTHORS Move Linux client & common packages into a public repo. 2020-02-09 09:32:57 -08:00
build_dist.sh build_dist.sh: keep --extra-small making a usable build, add --min 2025-10-06 21:15:25 -07:00
build_docker.sh build_docker.sh: support including extra files (#17405) 2025-10-02 13:29:03 +01:00
CODE_OF_CONDUCT.md CODE_OF_CONDUCT.md: update code of conduct 2025-10-28 08:58:00 -07:00
CODEOWNERS CODEOWNERS: add the start of an owners file 2023-08-16 15:57:29 -07:00
Dockerfile .github/workfkows,Dockerfile,Dockerfile.base: add a test for base image (#18180) 2025-12-12 18:10:00 +00:00
Dockerfile.base .github/workfkows,Dockerfile,Dockerfile.base: add a test for base image (#18180) 2025-12-12 18:10:00 +00:00
flake.lock .github/Makefile/flake: update nix flake support (#16636) 2025-08-19 10:46:07 -04:00
flake.nix cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
go.mod cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
go.mod.sri cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
go.sum cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
go.toolchain.branch go.toolchain.branch: bump to go1.25 (#16954) 2025-08-26 07:44:26 -07:00
go.toolchain.rev go.toolchain.rev: update to Go 1.25.5 (#18123) 2025-12-03 11:20:46 -08:00
go.toolchain.rev.sri go.toolchain.rev: update to Go 1.25.5 (#18123) 2025-12-03 11:20:46 -08:00
go.toolchain.version go.toolchain.rev: update to Go 1.25.5 (#18123) 2025-12-03 11:20:46 -08:00
gomod_test.go go.mod: add test that replace directives aren't added in oss 2023-09-29 12:31:52 -07:00
header.txt cmd/k8s-operator: operator can create subnetrouter (#9505) 2023-12-14 13:51:59 +00:00
LICENSE all: update tools that manage copyright headers 2023-01-27 15:36:29 -08:00
license_test.go wgengine/router{,/osrouter}: split OS router implementations into subpackage 2025-09-29 14:04:57 -07:00
Makefile Makefile, cmd/*/depaware.txt: split out vendor packages explicitly 2025-10-01 13:02:06 -07:00
PATENTS Move Linux client & common packages into a public repo. 2020-02-09 09:32:57 -08:00
pkgdoc_test.go all: skip looking for package comments in .git/ repository (#15384) 2025-03-21 14:46:02 -07:00
pull-toolchain.sh flake.nix: update Nix to use tailscale/go 1.25.2 (#17500) 2025-10-08 14:37:47 -04:00
README.md README: update the version of Go in the README 2025-09-29 22:09:25 +01:00
SECURITY.md Add a SECURITY.md for vulnerability reports. 2020-02-11 10:26:41 -08:00
shell.nix cmd,feature: add identity token auto generation for workload identity (#18373) 2026-01-14 15:00:59 +00:00
staticcheck.conf all: cleanup unused code, part 2 (#10670) 2023-12-21 17:40:03 -08:00
update-flake.sh flake.nix: update Nix to use tailscale/go 1.25.2 (#17500) 2025-10-08 14:37:47 -04:00
version_tailscale_test.go tailscaleroot: panic if tailscale_go build tag but Go toolchain mismatch 2024-10-06 15:22:04 -07:00
version_test.go .github/workflows: test that ./go/tool version matches go mod version 2025-06-16 15:04:10 -07:00
version-embed.go Fix various linting, vet & static check issues 2025-01-04 15:11:10 -08:00
VERSION.txt VERSION.txt: this is v1.95.0 (#18414) 2026-01-14 14:19:17 -08:00

Tailscale

https://tailscale.com

Private WireGuard® networks made easy

Overview

This repository contains the majority of Tailscale's open source code. Notably, it includes the tailscaled daemon and the tailscale CLI tool. The tailscaled daemon runs on Linux, Windows, macOS, and to varying degrees on FreeBSD and OpenBSD. The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code.

Other Tailscale repos of note:

For background on which parts of Tailscale are open source and why, see https://tailscale.com/opensource/.

Using

We serve packages for a variety of distros and platforms at https://pkgs.tailscale.com.

Other clients

The macOS, iOS, and Windows clients use the code in this repository but additionally include small GUI wrappers. The GUI wrappers on non-open source platforms are themselves not open source.

Building

We always require the latest Go release, currently Go 1.25. (While we build releases with our Go fork, its use is not required.)

go install tailscale.com/cmd/tailscale{,d}

If you're packaging Tailscale for distribution, use build_dist.sh instead, to burn commit IDs and version info into the binaries:

./build_dist.sh tailscale.com/cmd/tailscale
./build_dist.sh tailscale.com/cmd/tailscaled

If your distro has conventions that preclude the use of build_dist.sh, please do the equivalent of what it does in your distro's way, so that bug reports contain useful version information.

Bugs

Please file any issues about this code or the hosted service on the issue tracker.

Contributing

PRs welcome! But please file bugs. Commit messages should reference bugs.

We require Developer Certificate of Origin Signed-off-by lines in commits.

See commit-messages.md (or skim git log) for our commit message style.

About Us

Tailscale is primarily developed by the people at https://github.com/orgs/tailscale/people. For other contributors, see:

WireGuard is a registered trademark of Jason A. Donenfeld.