Is there any intent to make that just a setting? Using MDM for something like that as an individual seems a little over the top. I couldn't immediately find any information about how to configure this if I wanted to using MDM, even if it was the only option.

You can create MDM profiles even without a MDM server etc by using Apple Configurator 2. You will need a Mac however. You can then install those profiles manually.

A simple setting in the app would be far easier yeah. I would suspect that the ease of people bypassing the paid service is probably not a priority for them ;)

Personally I never even tried tailscale as I try to avoid Google. I definitely don't want to use my Google account to log into it and give Google more information.

But tinc serves my usecase well. The peer injection is a bit of a worry there too though. Especially because tinc peers are able to add any peers on their own (it's a feature meant to provide easier configuration).

I tried nebula extensively too but it didn't add enough over tinc to make it worthwhile switching especially now that tinc has an Android app.

I realize, but it's still a pain to do, and how to actually configure TailScale like this is completely undocumented, I couldn't find any mention of this feature outside of a hacker news comment. On the OSX application there's a hidden menu (hold option) which allows you to choose a different master server, but not enter your own, which is so close to being usable but just out of reach.

Is there a similar setting for Android app? I've tried building .apk with forked version of tailscale, but stopped after I saw issue on github about inability to login via auth key (https://github.com/tailscale/tailscale/issues/675). I thought headscale didn't support auth through email account?

Any docs or tips on how the mobileconfig or configuration keys look like?

Figured it out :)