(I'm in no way affiliated, but stumbled upon it on twitter a few weeks ago)
(I'm in no way affiliated, but stumbled upon it on twitter a few weeks ago)
He's asking for a central server where he can retrieve/update/manage end-user keys, likely: because helpdesk.
You could in theory do this with any number of the existing team password managers, but I think he'd like integration directly to wireguard.
Edit: care to reply rather than just downvote? All of their documentation and examples state exactly what I'm saying. They're turning all the devices into endpoints and creating a mesh - he doesn't want users bypassing his SINGLE VPN endpoint into the company or talking directly to each other based on his description. He wants Cisco Anyconnect - only wireguard.
https://news.ycombinator.com/item?id=22665589
It doesnt look like a nail/hammer/screw at all. Tailscale isnt configured how he wants out of the box, but using SSO to control access isnt a massively complex hurdle. Anyone with Office 365 will be able to use their Office account to authenticate, which is basically Cloud Active Directory, and way better (if its something you have) than maintaining a separate username/password database for the VPN.
ACLs and a relay node are a good fit for the request. https://tailscale.com/kb/1019/install-subnets
Cloud SSO might be a deal breaker, but it doesnt make the solution the wrong class of solution.