Machines
List nodes, generate pre-auth keys, copy tailscale logout then tailscale up.
What ships today
Single tenant, SQLite, local login plus TOTP. Click through the dummy console — Machines, Apps, Users, Workspaces, Policies, Audit, Keys — then see how traffic actually flows.
Static mock of the real sidebar. Dummy rows only.
Each card is a console area you can open after setup.
List nodes, generate pre-auth keys, copy tailscale logout then tailscale up.
Publish a mesh address on a hostname. Edge reverse-proxies onto 100.x. Not Funnel.
Owner, Super admin, Admin, Member. Local credentials always on; OIDC when three env vars are set.
Isolation unit. Maps to a Headscale ACL group. Peers that share a workspace see each other.
Orthogonal labels such as prod, uat, and dev. They are not isolation by themselves.
Intent in the console compiles to Headscale HuJSON. Apply from Settings → Policy file.
System and network logs with an append-only hash chain for control-plane actions.
Reusable or one-shot auth keys bound to workspaces and tags. Edge uses a tag:edge key.
Hover a box. Devices join through the edge container. Core keeps state in SQLite or Postgres. A published app stays on the device that runs it.