I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks very reasonable. Wishing your product much success.
I have tried to use Headscale with Tailscale clients and have been fairly successful in achieving a private P2P VPN. Since I have a lot of spare servers, was able to setup a GUI, Headscale server and configure Tailscale clients across different OS flavors. But it is not for the faint of heart or non-technical folks or for enterprise use. What I have implemented was for personal use and it has it's own pitfalls / troubleshooting stuff which actually consumed a lot of time and effort.
Is there an open source option with Firezone where I could try it out to have a head to head comparison (or if a comparison that already exists) or a guide that could be used for setting up one's own server and client apps for a self-hosted and self-managed solution using Firezone?
Please recommend / respond with the opinion of whether the thought process is worth it? Thanks.
We do have a self-hosted community support channel on Discord if you are feeling adventurous: https://discord.gg/DY8gxpSgep
I would recommend starting here with a local development cluster:
https://github.com/firezone/firezone/blob/main/docs/CONTRIBU...
Strong FOSS projects tend to have multiple options for commercial support. So, if a hostile company acquires your commercial support provider, looking at you Broadcom, you have some options to move to someone friendlier for support.
So, for my employer it is about having options.
Tailscale is building a remarkable moat at extraordinary pace: capabilities real commercial use needs, on pricing that doesn't penalize the security-minded startup.
One key difference with their platform is the recognition so often missed inside the HN bubble that most B2B and B2C are on M365 and Entra, not Google like 3 devs in a cafe. Tailscale seems to understand the difference, but rather than going "enterprise" brings the startup ways into the business context, letting a business be like a startup while still complying with "requirements" such as sound patterns for tying into legacy internal and third party systems and networks.
A related difference is emphasis on "everything as code" from config to policy, enabling gitops of course, but also easier integration and automation.
That said, Firezone's choice to let groups flow from IdP and map resources to groups, can be a competitive advantage, since the only thing better than everything as code is no-code, meaning, no moving parts. For instance, with Firezone, you can make systems automatically accessible to Microsoft Teams, team by team. Adding someone to a team or kicking them from a team, can give them access or remove their access. That's a massive security gain and overhead reduction.
But the biggest differentiation seems to be solving corner cases that come up in real world use and rolling those out faster than firms can come up the curve in their own Zero Trust implementation. Tailscale must have an excellent forward-deployed product sensing practice, to either discover or listen to these problems from commercial users then tackle them and get it rolled out for all customers. Their docs are also use-case focused and self-service empowering: https://tailscale.com/kb/1300/production-best-practices with a clear understanding of how devs spend their time https://tailscale.com/kb/1360/developer-tools and generally organized by the "Diataxis" systematic approach to technical documentation authoring: https://diataxis.fr/
Finally, contrary to popular practice here, Tailscale don't have predatory pricing for SSO, no “SSO tax”.
The $0 plan includes SSO. Even if you're a one person shop, there's no reason not to get SSO going for yourself, every future SaaS you integrate with, and every future onboarding/offboarding will thank you. Switching to this later is far more costly than adopting it early, and we should all be supporting one another to make SSO (or Oauth2+OIDC) the norm instead of an "Enterprise Call Us" pricing discriminator.
It's great to see Firezone including OIDC in the starter plan, as that brings most of what anyone needs from "SSO", without most of the headaches. And this benefits Firezone too, they can't leak user passwords.
"Zero Trust" (such a terrible name for a pattern that actually means "enable trust on everything that matters") is a big deal, and more focus on this space is huge. It's worth building in this ecosystem, and worth paying attention to what overachievers are getting right.