~/adr/003-twingate-over-tailscale
Twingate ZTNA over Tailscale for RDS remote access
accepted $ decided 26 Oct 2025
$ diff decision consequence
Decision
Migrate remote access from Tailscale (WireGuard/UDP) to Twingate ZTNA, whose
connectors open outbound TCP/TLS that reads as ordinary HTTPS to DPI filters —
no public IP, no inbound firewall rules (full story in ~/work/rds-migration-tailscale-to-twingate).
Consequences
- + Access restored over a weekend with zero business downtime; TLS blends into allowed traffic.
- + Least-privilege resource policies replace flat mesh membership.
- − Vendor dependency moves from Tailscale’s control plane to Twingate’s; connector host becomes a single egress point to monitor.