[package]
name = "tunnr-tailscale"
version = "0.1.0"
description = "Tailscale interop for WireGuard: turns a coordination server's netmap into a peer set for wg-appliance-core's data plane, using Tailscale's own BSD-3-Clause wire model rather than a re-implementation of it — and refuses to call that peer set a tailnet membership while DERP and disco are missing, because a node without them is unreachable rather than degraded."
edition = "2021"
license = "MIT OR Apache-2.0"
repository = "https://codeberg.org/nordisk/tunnr-tailscale"
keywords = ["wireguard", "tailscale", "vpn", "interop"]
categories = ["network-programming"]
[dependencies]
# THE SEAM, same as tunnr-mullvad's: both providers produce the SAME peer set
# type, and that is the whole point of the repository. Two providers must never
# become two tunnel implementations.
# PATH, not registry — same reason as `tunnr-mullvad`: one source of the peer
# spec, or two providers become two tunnel implementations after all.
wg-appliance-core = { path = "../edda/crates/wg-appliance-core", version = "0.1.2", default-features = false }
# Tailscale's OWN wire model, from `tailscale/tailscale-rs` (BSD-3-Clause),
# published on crates.io. Their coordination protocol is a version-coupled
# contract documented mostly by that source, so a hand-written parser would be
# a second definition of it that drifts silently; depending on theirs makes
# their release the update. Attribution in THIRD-PARTY.md.
#
# What is deliberately NOT taken, measured 2026-09-05 with `cargo tree -e
# normal` over a resolved crates.io closure:
# * `ts_derp` / `ts_control` / `ts_transport` — `ts_transport` depends
# unconditionally on `dyn-eq 0.1.3`, which is MPL-2.0. No feature gate
# removes it, and this workspace takes no copyleft.
# * `ts_control` / `ts_derp` / `ts_http_util` — `ts_tls_util` hardcodes
# `tokio-rustls features = ["aws-lc-rs"]`, dragging `aws-lc-sys` (a
# BoringSSL fork built with cmake + cc) into a distroless static appliance.
# The crate below resolves to a closure with zero copyleft, zero `-sys` crates
# and zero `cc`; `tunnr-licence` proves the copyleft half on every build.
#
# CORRECTION to the tidier version of that sentence: this WORKSPACE is not C-free.
# `boringtun 0.7.1`, reached through `wg-appliance-core`, depends on `ring 0.17`
# unconditionally (no feature gate), so the appliance already links C and did
# before this repo existed. The decisive objection to ts_control/ts_derp is
# therefore MPL-2.0, not "the first C".
ts_control_serde = "0.5.0"
# The IP-network types `ts_control_serde` expresses AllowedIPs in. Matched on
# directly, so it is a direct dependency rather than a re-export we assume.
ipnet = "2.12"
[dev-dependencies]
serde_json = "1"
[lints.rust]
missing_docs = "warn"