I've been evaluating Tailscale as a potential component for securing B2B integrations and multi-tenant ERP deployments. To test it under realistic conditions, I just finished a project to automate the deployment of a cross-cloud lab environment, using Tailscale for the private network and Terraform for infrastructure-as-code.
The goal was to simulate a distributed supply chain application with nodes across AWS, Azure, and a bare-metal server (simulating a warehouse or factory floor). All nodes needed to communicate securely on a private network, without publicly exposed ports or complex VPN gateways.
Here is the high-level architecture and workflow:
* **Terraform Providers**: Separate configurations for AWS, Azure, and a local provider for cloud-init data.
* **Node Provisioning**: Each module provisions a lightweight compute instance (e.g., AWS EC2, Azure VM) and injects a cloud-init script.
* **Tailscale Integration**: The cloud-init script handles the Tailscale install and authenticates using a pre-auth key (configured as ephemeral for nodes, reusable for the subnet router).
* **Subnet Router**: One node (the AWS instance) was also configured as a subnet router, advertising the VPC's private subnet to the Tailscale network.
* **ERP Simulation**: Installed PostgreSQL and a simple REST API on different nodes to test latency and connectivity for database and service layers.
Key findings from this setup:
* The integration was remarkably straightforward. The Tailscale agent runs as a systemd service, and the pre-auth key model works perfectly with automated provisioning.
* Once nodes came online, they were immediately addressable via their Tailscale IPs, hostnames, and MagicDNS. This eliminated all firewall configuration between clouds.
* Performance was adequate for the use case; latency between AWS us-east-1 and Azure europe-west was comparable to public internet routing, but with the benefit of a private, audited tunnel.
* For a production SaaS ERP scenario, I would explore the ACL tags and user groups more deeply to segment client traffic.
The main benefit for inventory or supply chain applications is the ability to securely interconnect disparate systems (cloud ERP, on-prem WMS, 3PL partner systems) without modifying each network's firewall rules. The subnet router feature is particularly powerful for accessing entire on-prem subnets through a single node.
Has anyone else implemented Tailscale in a similar IaC pipeline? I'm particularly interested in how you might manage key rotation at scale or if you've integrated ACL policies into the Terraform process itself.
Measure twice, buy once.