nebula-mesh-admin VS go

Nebula is great - super simple to set up and get started if you have a VM to use as a lighthouse. Lots of cloud providers free tiers are have enough resources to host a lighthouse as well.

Certificate management is its one weakness at the moment. There are a growing number of projects floating around attempting to solve that though:

* https://github.com/unreality/nebula-mesh-admin

As other have suggested, Nebula (https://github.com/slackhq/nebula) is pretty elegant. It has groups-based access built in which is extremely convenient.

You can bolt-on SSO fairly easily - just create a certificate signing service. I created https://github.com/unreality/nebula-mesh-admin in a weekend, so its fairly easy to add a SSO flow in.

The last two sections are gold:

> ### Wait, you did what?

> Time for the philosophizing I promised.

> People are often surprised and sometimes horrified when they learn that Tailscale maintains its own fork of the Go toolchain. Tailscale is a small startup. Isn’t that a horrible distraction, a flagrant burning of [innovation tokens](https://mcfunley.com/choose-boring-technology)?

> Maybe. But the thing is, you write code with the engineers you have.

> We had a problem: We kept crashing on iOS, and in addition to being awful, it was preventing us from adding features.

> Another team might have decided to cut even more features on iOS to try to achieve stability, or limited in some way the size of the tailnet that iOS could interact with.

> Another team might have radically redesigned the data structures to squeeze every last drop out of them.

> Another team might have rewritten the entire thing in Rust or C.

> Another team might have decided to accept the crashes and attempted to mitigate the pain by making re-establishment of connections faster.

> Another team might have decided to just live with it and put their focus elsewhere.

> The Tailscale team has Go expertise, spanning the standard library to the toolchain to the runtime to the ecosystem. [It’s an asset](https://danluu.com/in-house/), and it would be foolish not to use it when the occasion arises. And the fun thing about working on low level, performance-sensitive code is that that occasion arises with surprising frequency.

> Blog posts about how people solve their problems are fun and interesting, but they must always be taken with a healthy dose of context. There may be no other startups in existence for which working on the Go linker would be a sensible choice, but it was for us.

> ### Surprise twist ending

> With the Go linker work [newly completed](https://github.com/tailscale/go/pull/20), we set out to confirm our analysis. What would footprint say?

> As expected, footprint approved:

> ```

All the hoop-jumping I can think of is open-source. https://github.com/tailscale/go has the Go toolchain changes for size reduction (though most get upstreamed), and the rest of the size reduction stuff comes from lazy configuration, i.e. keeping as little idle state as possible. But that's useful for memory reduction on all platforms, so it's just in the general network engine at https://github.com/tailscale/tailscale .