Tailcat Firewall Rules for Tailscale Exit Nodes

Who it's for

Indie devs and homelabbers who use Tailscale to share dev tools or services (e.g., a database or internal API) with a remote collaborator and today cope by opening a public port, using a VPN with manual key exchange, or by sharing a screen via a telepresence tool.

The problem

Time (minutes spent on manual ACL/SSH config per share) and legal (exposing a service publicly can violate data-protection obligations for client data).

How to build it

CLI + Tailscale ACL/SSH config generator; runs locally, reads your tailnet state via `tailscale status` and `tailcat--list`, then prints or applies the minimal ACL diff.

How it makes money

Hobbyists pay $5/month (or a one-time $20) via a Patreon/Gumroad for prebuilt binaries and a 5-minute setup video; power users pay to avoid a security incident that costs more than a coffee price.

Why it doesn't exist yet

Incumbents (Tailscale itself) focus on enterprise access control, not on the friction of securely exposing a single service to a single collaborator via tailcat; they assume you already know ACL syntax. The gap: a one-command wrapper that turns a tailcat connection into a persistent, scoped share — the missing usability layer between the raw `tailcat` binary and a full Tailscale admin UI.

First users

HN readers of the tailcat launch post who immediately want to share a port with a freelance collaborator but don't want to read ACL docs; they'll fork the repo and use it within the week.

Build size

1 person x 3 weeks: CLI in Go, reads `tailcat list`, generates ACL snippet, optional `tailscale ACL` call via API; excludes building a GUI or mobile app.

Biggest risk

Tailscale ships a native share-from-tailcat button in the admin panel within 6 months, making the CLI redundant.

Conditions for a hit (all 3 required)

• When run with `--share <localPort> --to <user>`, it prints an exact ACL snippet that allows that user to connect to that port via tailcat, verified by parsing `tailscale status` and a dry-run of `tailscale ACL` — no manual editing.
• It emits a shell script that, when run on the remote machine, connects with `tailcat --dial <localIP>:<port>` and logs a timestamped connection receipt to a local CSV file, so both parties have a 30-day usage record.
• In `--revoke <shareId>` mode, it deletes the exact ACL block it previously inserted (tracked via a comment marker) and prints a confirmation diff, in under 2 seconds, without touching unrelated rules.

How it's judged (in 6 months)

GitHub stars ≥800 on the repo, or ≥30 mentions on r/Tailscale in a single week by 2027-02-27(judgment date 2027-02-27)

AI self-confidence 55/100 — self-reported likelihood of meeting the criterion, not a business success rate