Tailscale is best used as an additional layer of security rather than your only layer. I host everything behind tailscale as if it was the public internet, with proper authentication, https, etc.

So a failure in tailscale is not an issue on it's own because you'd then also have to find an exploit in what I'm actually hosting as well. Both of those things happening at the same time is much less likely.

Yet another single point of failure.

I don't see the reason for Tailscale instead of plain old simple Wireguard, it's WG under the hood anyway.

This exactly. All the extra stuff Tailscale provides buys convenience, but increases complexity, the attack surface of the stack, and adds commercial components to an otherwise open protocol. Call me old fashioned but I will keep managing keys manually.

+1

I am a relatively old school engineer. When building a bricks and mortar business recently I kept hearing about tailscale for remote access. Looked and saw it was just a wrapper over wireguard. I immediately went aha, there's a solid underlying project without the risk of something over the top trying to make life easier for people unwilling or unable to manage their own systems. Went with a direct wireguard on opnsense approach.

Bamn, proved right today.

Wireguard is perfectly elegant and maintainable as it is for me, and a wonderful improvement on traditional site to site VPNs.