At Narration Box we use Tailscale with Caddy's Cloudflare Let's Encrypt DNS-01 for internal DNS resolution + TLS for the apps that need it. In essence you get something like Google's internal "go/ links" except everything's hosted on the external DNS server and automatically protected by default by Tailscale since the IPs pointed to cannot be accessed publicly.

if you guys do technical blog posts addressing aspects of your toolchain, i request one on this.

You are not the first to ask :)

https://news.ycombinator.com/item?id=24436399

I will definitely do a writeup during/before the Christmas break.

ha, thanks! i will look for it!

Does ZeroTier let you expose a specific machine publicly? ie if I have a raspberry pi behind a NAT, will ZeroTier provide me with a public IP anyone can use to connect to it?

No, you still need to find a machine with a public IP. The usecase in parent comment mentioned only the SSH part, which is easier. But if you want to do forwarding from a specific machine to the public, you can do it manually.

This looks nice, Free tier even supports up to 50 devices.

zerotier is nice, but I have migrated to tailscale. Its based on wireguard and seems even better performance wise.

> Its based on wireguard and seems even better performance wise.

I hadn't considered that, but it makes sense. Since ZeroTier is layer 2, I'd expect it to become a leaky abstraction (at least for performance) in certain cases where algorithms are expecting other layer 2 hardware to be essentially directly connected with a wire when in reality they're connected over the internet.

What algorithms you have in mind? That would be a bad assumption, since layer 2 can be ethernet, but it may be i2c, or slip, or spacewire... Layer 2 does not mean "close" or "fast".

Yeah, tailscale does look nice, only one user on the free tier was a deal-breaker for me though.