Security · checked 2026-10-19Can I vibecode Tailscale?
KINDA· weekend project
The part a prompt can rebuild is the tunnel: WireGuard on a VPS, a script that enrols devices, names, and a firewall file that says who may reach what. That gives you your laptop, phone and home server on one private network in a weekend, with the official WireGuard apps as clients. It is a hub and spoke, so every packet takes a detour through the VPS and there is no direct path between devices. Tailscale's actual product, a control plane that punches through NATs, a relay fleet and clients for every OS with single sign-on, is not something one session reproduces.
$8/moprice per seat
$96you'd save a year
weekendbuild time
—people replaced it
What you need on hand.
DifficultyAdvanced · Real infrastructure or OAuth work.
TimeA weekend; testing on real devices is the slow part
- Claude Code, Codex or CursorAny of them can run the prompt.
- A Linux VPS with rootAbout $5 a month; it needs a public IP and one open UDP port.
- Python 3.12 and wireguard-toolsThe network-namespace test needs root on a Linux machine.
- A policy.json you write yourselfCopy the rules you rely on from your Tailscale access controls first.
Before you buildIf you are one person with under 6 users, Tailscale Personal is free, with direct connections and clients on every OS. Build this only if you want to own the control plane; Headscale does that with the official clients.
- 1. Install one agent: Claude Code, Codex, Cursor.
- 2. Make an empty folder and open it in the agent.
- 3. Paste the prompt below, press enter, and answer its questions as it builds.
The prompt
Build me a small hub-and-spoke WireGuard mesh to replace Tailscale for my own devices. Requirements: - Python 3.12: a FastAPI hub (`uvicorn`) that runs on one Linux VPS with `wireguard-tools`, plus a CLI `meshctl` (typer) for the devices. Install with `pip install -e .`. - Hub storage: stdlib sqlite3 in ./data/hub.db: peers (name, public key, tunnel IP from 100.64.0.0/24, tags, advertised subnets, last handshake) and one-time enrolment tokens that expire after 15 minutes. - Enrolment: `meshctl join https://hub.example.com <token>` makes the keypair on the device (the private key never leaves it), sends the public key, receives its IP and the hub endpoint, writes the wg config and brings it up. The hub adds the peer live with `wg set`, with no restart. - Routing: every peer sends mesh traffic (100.64.0.0/24 plus advertised subnets) to the hub, which forwards between peers. `meshctl advertise 192.168.1.0/24` turns a home machine into a subnet router for that LAN. - Names: the hub runs `dnsmasq` for <peer>.mesh. The README explains how to send only .mesh queries to it (a systemd-resolved routing domain on Linux, a resolver file on macOS). - Access rules: ./data/policy.json maps tags to allowed destinations and ports, e.g. "tag:laptop" to "tag:server:22,443". The hub renders it into an nftables forward chain, default deny, applied in one atomic transaction. - UI: one server-rendered page behind a password in .env: peers with last-handshake age, token creation, the policy editor with a dry-run diff, and a revoke button that drops a peer immediately. - Test: a script that builds three peers in Linux network namespaces and proves allowed traffic passes and denied traffic is dropped. It needs root. - No accounts, no telemetry, local-first. Outbound calls: none besides the tunnel itself. - Out of scope: direct device-to-device paths (NAT traversal), relay fleets, SSO, exit nodes, SSH features, a native phone app (print the config as a QR code for the official WireGuard app). - README: open UDP 51820 and nothing else, a plain note that all traffic goes through the hub, and backups.
Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.
Then keep going
Next prompts, same folder.
The first prompt builds the core. Run these one at a time in the same folder to grow it into your own Tailscale.
Extend the WireGuard mesh in this folder. Requirements: - `meshctl exit-node on` for a peer; the hub allows that peer to be chosen, and `meshctl use-exit <peer>` changes the device's AllowedIPs to 0.0.0.0/0 and ::/0 through the hub. - The hub enables forwarding and an nftables masquerade rule for its public interface, and the policy file controls which tags may use an exit. - Show the exit in use in the UI, with a button to turn it off for a peer. - Keep DNS leak-free: while an exit is on, the device resolves through the hub's dnsmasq. - Update the README with the warning that the hub's address is what websites see.
Add monitoring to the WireGuard mesh in this folder. Requirements: - Every 30 seconds the hub reads `wg show wg0 dump` and stores the latest handshake and bytes transferred per peer. - A peer with no handshake for 3 minutes is marked offline; flipping state sends one message to a webhook URL in .env (ntfy or Discord format) and logs it. - A history page with an online and offline timeline per peer for the last 7 days. - Update the README.
Add key rotation to the WireGuard mesh in this folder. Requirements: - `meshctl rotate` makes a new keypair on the device, sends the new public key signed with the old private key, and the hub swaps the peer with `wg set` while keeping its IP and tags. - Keep the old key valid for 5 minutes so the device can switch without dropping the tunnel. - A hub setting that asks devices to rotate every 90 days; `meshctl status` shows the age of the current key. - Tests for a failed rotation: the device must keep working on the old key. - Update the README.
What you lose
- Direct device-to-device connections: traffic goes through your hub, so latency and bandwidth depend on the VPS
- Relay servers around the world as a fallback on hostile networks
- Login through an identity provider, SCIM and device posture checks
- MagicDNS, exit nodes, Funnel and Tailscale SSH
- Clients that join the network with one tap on every OS, phones included
Why people still pay
Individuals mostly pay nothing, since Personal is free for up to 6 users. Teams pay per user for unlimited users, SCIM, device-posture checks and roles, and for a connection that works behind hotel and office NATs without anyone opening a port. The WireGuard tunnel is a commodity; the coordination and relays are what is being sold.
Tailscale or your own copy?
Seats
Over
Your usage
12h ×$/h
Tailscale, 1 yr$96
Your own copy, 1 yr$70running + build session
You keep$26pays for itself in 4 months
Estimate · The running cost is a small VPS. The build is token usage on your agent plan; most of it goes on debugging firewall rules and routing.
Take your data, then cancel.
1 · Take your data out of Tailscale
- 1Open Access controls in the admin console and copy the policy file, a declarative HuJSON document, into your own repo. The page also mentions editing it through GitOps or the API.
- 2The Machines page lists device names, IPs, tags and advertised routes: write down the ones other systems rely on, such as DNS names, SSH config entries and firewall rules that mention 100.x addresses.
- 3There is no data export in the sense of files or history: a tailnet is configuration, so the policy file and the device list are what you carry over.
- 4Network flow logs and log streaming are Premium features; export or stream them before you downgrade if you need the history.
2 · Cancel Tailscale
- 1You need to be an Owner, Admin or Billing admin. Open the Billing page of the admin console.
- 2In Your plan, open the menu and choose Cancel subscription, review what you will lose and confirm. This moves the tailnet to the free Personal plan.
- 3The change happens at the end of the current billing period, with no prorated charge, and your plan stays until then. A Scheduled changes banner lets you cancel it before the date.
- 4More than 6 users? Delete or suspend users first, or Personal can't take the tailnet. Bought through Azure Marketplace? Cancel it in the Azure portal.
- Deleting the tailnet is a different, permanent step: node and user data are removed and subscriptions cancel at once. Downgrading is the reversible one.
- Headscale and NetBird can host the control plane yourself; Headscale keeps the official clients and covers one tailnet, and not every enterprise feature exists there.
- Features tied to the plan you leave (SCIM, device posture, more ACL groups, just-in-time access) may stop being available once the downgrade takes effect, as the downgrade page says.
- Update anything that points at tailnet IPs or MagicDNS names before moving, since a new network will hand out new addresses.
The escape hatch
Don't feel like building it? These are already free.
HeadscaleOpen sourceBSD-3-Clause reimplementation of Tailscale's control server that works with the official clients; one tailnet, aimed at personal use and small organisations. Its README advises against running it behind a reverse proxy or in a container.★ 45k · active Oct 2026 · self-host, real ops
LinuxVisit ↗NetBirdOpen sourceWireGuard-based mesh with SSO and access policies; the repo is BSD-3-Clause apart from the management, signal and relay parts, which are AGPL-3.0. Self-hosted or cloud.★ 30k · active Oct 2026 · docker to self-host
Linux, macOS, Windows, iOS, AndroidVisit ↗NebulaOpen sourceMIT overlay network from Slack with its own certificate authority and lighthouse nodes; you run the lighthouse and issue certificates yourself.★ 18k · active Oct 2026 · self-host, real ops
Linux, macOS, Windows, iOS, AndroidVisit ↗
LinuxVisit ↗NetBirdOpen sourceWireGuard-based mesh with SSO and access policies; the repo is BSD-3-Clause apart from the management, signal and relay parts, which are AGPL-3.0. Self-hosted or cloud.★ 30k · active Oct 2026 · docker to self-host
Linux, macOS, Windows, iOS, AndroidVisit ↗NebulaOpen sourceMIT overlay network from Slack with its own certificate authority and lighthouse nodes; you run the lighthouse and issue certificates yourself.★ 18k · active Oct 2026 · self-host, real ops
Linux, macOS, Windows, iOS, AndroidVisit ↗
The numbers
Tailscale pricing
| Plan | Monthly | Annual, per month | What you get |
|---|---|---|---|
| Personal | $0 | $0 | Up to 6 users, unlimited user devices, up to 3 ACL groups, 50 tagged resources, 1,000 ephemeral minutes a month; subnet routers, exit nodes, MagicDNS, ACLs, Funnel and Tailscale SSH for up to 5 hosts. |
| Standard | $8/user | — | Unlimited users, up to 10 ACL groups, SCIM user and group provisioning, MDM configuration, device posture integrations with MDM, EDR and XDR, advanced user roles. |
| Premium | $18/user | — | Everything in Standard plus up to 300 ACL groups, 10,000 ephemeral minutes a month, just-in-time access, advanced Tailscale SSH, network flow logs, log streaming, regional routing. |
| Enterprise | custom | — | Custom device quantities and limits, a solutions engineer, a custom MSA, custom tailnet subdomains, pay by invoice. |
- Free tier
- 6 users and 3 ACL groups; no SCIM, MDM or device-posture integrations.
- Billing
- Standard and Premium are billed per purchased seat at the start of each month, whether the seat is used or not. Added seats are prorated, removed seats take effect next cycle, and vacant seats still bill. The pricing page lists no annual discount.
- Hidden costs
- Mullvad exit nodes are $5 a month for every 5 devices, and extra tagged resources are $1 a month each. Standard caps ephemeral workloads at 1,000 minutes a month.
- Source
- tailscale.com
Also on the list
Related apps
Personal is free for up to 6 users, with unlimited devices, 3 ACL groups, 50 tagged resources and basic Tailscale SSH.
Kinda. The core is a weekend build with the prompt on this page, but real gaps remain: Direct device-to-device connections: traffic goes through your hub, so latency and bandwidth depend on the VPS, Relay servers around the world as a fallback on hostile networks.
About $8 a month on the Standard plan per seat, $96 a year (checked 2026-10-19).
Direct device-to-device connections: traffic goes through your hub, so latency and bandwidth depend on the VPS; Relay servers around the world as a fallback on hostile networks; Login through an identity provider, SCIM and device posture checks; MagicDNS, exit nodes, Funnel and Tailscale SSH; Clients that join the network with one tap on every OS, phones included. If any of those matter to you, keep paying.
Yes: Headscale (open source), NetBird (open source), Nebula (open source).