How littledivy/tailnet-do works
tailnet-do runs Tailscale’s userspace client inside a Cloudflare Durable Object, exposing the node to Workers and other tailnet devices. A Worker can use the Durable Object RPC methods to reach private hosts; the node can also serve HTTP or TCP to tailnet peers, and can be configured as an exit node or subnet router. The JavaScript layer adapts Cloudflare sockets and Durable Object storage to the Go/Wasm engine. Some advertised capabilities are documented but their implementation details are not shown in the excerpts, so those links cite the README.
Main entry points: main.go Tailscale engine · index.js Tailnet API · go Exit node · wasm_exec.js Go Wasm runtime
Components 20
Worker API
- TailnetObject
src/index.js - Tailnet API
src/index.js - Go Wasm runtime
src/wasm_exec.js
Tailnet node
- Tailscale engine
go/main.go - Node lifecycle
go/main.go - Identity and status
go/main.go
Tailnet traffic
- Peer TCP dial
go/main.go - Tailnet HTTP client
go/main.go - Tailnet HTTP server
go/main.go - Tailnet TCP listener
go/main.go - Exit node
go - Subnet router
go
Platform and network
- DO state storage
- Cloudflare sockets
- DNS over HTTPS
src/index.js
Other components
- Worker
- Tailnet peers
- Control plane and DERP
- Private hosts
- Internet destinations
Connections 22
- Worker → TailnetObject: calls RPC
README.md - TailnetObject → Tailnet API: starts node
src/index.js - Tailnet API → Go Wasm runtime: loads runtime
src/index.js - Tailnet API → Tailscale engine: creates node
src/index.js - Tailscale engine → Node lifecycle: starts node
go/main.go - Tailnet API → DO state storage: reads and writes state
src/index.js - Tailscale engine → Control plane and DERP: connects by WebSocket
README.md - Tailscale engine → Identity and status: reports status
go/main.go - TailnetObject → Peer TCP dial: exposes connect
README.md - TailnetObject → Tailnet HTTP client: exposes fetch
README.md - Worker → Private hosts: requests via node
README.md - Tailnet API → Cloudflare sockets: opens sockets
src/index.js - Tailscale engine → Cloudflare sockets: dials outbound
go/main.go - Tailscale engine → DNS over HTTPS: queries DNS
src/index.js - Peer TCP dial → Private hosts: dials TCP
README.md - Tailnet peers → Tailnet HTTP server: sends HTTP
README.md - Tailnet peers → Tailnet TCP listener: opens TCP
README.md - Tailnet HTTP server → Identity and status: resolves caller
go/main.go - Node lifecycle → Exit node: configures option
README.md - Node lifecycle → Subnet router: advertises routes
README.md - Exit node → Internet destinations: forwards TCP
README.md - Subnet router → Private hosts: routes traffic
README.md