Being a mesh means most connections are direct and do not go through any infrastructure which costs Tailscale money, making a Free tier economically workable.
It is the Tailscale client, compiled to WASM, maintaining the keys for connections to nodes on the tailnet. Connections opened from the browser engine don't get the ability to reach the tailnet.
The Tailscale VPN client, the same one which runs on other devices, is compiled to WASM. It handles all of the key exchanges to connect to the tailnet. The SSH session is running as a WASM Tailscale client.
The browser, opening connections from within the browser engine, doesn't have the keys for SSH or VPN access.
I'll mention one more time: if you'd like to contact [email protected] we can set up a time to talk about upcoming features and philosophy on releasing them.
For me it was trying to build an AWS Lambda function where I'd deploy a new version and visit the URL, then wait for the CloudWatch logs. And wait. And wait. It might only be two minutes but that is long enough for me to want some tea, maybe look at some other issue filed that morning and see if I can make progress in diagnosing it, and WHOOPS I GOT DISTRACTED FOR HALF AN HOUR.
fly.io is instantaneous. I deploy, I see the result, I fix it, I deploy again and figure out the next problem. It is a pleasant environment to develop in.
Being a mesh means most connections are direct and do not go through any infrastructure which costs Tailscale money, making a Free tier economically workable.