F28-TS: Yes
Rationale
Linux endpoints can constrain their DERP intermediary through the existing TS_DEBUG_USE_DERP_ADDR and TS_DEBUG_ALWAYS_USE_DERP controls. setDERPMap replaces the control-provided map with one hostname in synthetic region 999, omits other regions, and defaults to HTTPS/443. bindSocket disables normal UDP sockets when always-DERP is enabled. Peers must use matching maps. The author of issue 7841 explicitly confirms that this combination works when communicating clients agree on the map; the reported failure mixed a normal control map with overridden maps. This supplies the missing compatibility evidence and supports a bounded source inference for F28: selecting an accessible managed DERP hostname constrains the relay contact while retaining the selected components.
Assessment method
Pinned source inference corroborated by developer exchange report; no local runtime test
Source context
Tailscale issue 7841 follow-up and magicsock sources at 566f89e0fb2a
Outstanding qualification
Advanced/debug configuration requiring control of daemon startup and matching configuration at both endpoints, not an ordinary per-flow path selector or unilateral steering of an unmodified remote peer. Use a managed DERP hostname with valid TLS; HTTP-only development mode, self-hosted relays and Headscale are not added to the selected profile. The issue describes a developer test, not a current managed-service qualification; the HTTPS managed-host application is source inference and was not exercised here. Granularity is the selected relay hostname/service, not hidden IP hops or every internal regional mesh server. An unavailable or mismatched sole region can break delivery; no fallback to an omitted region is credited. Tailnet Lock, authorization and control-service dependencies remain. F28 requires a capability and enforcement mechanism, not production-support certification.
Public sources
- https://github.com/tailscale/tailscale/issues/7841#issuecomment-1518491495
- https://github.com/tailscale/tailscale/blob/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/wgengine/magicsock/debugknobs.go
- https://github.com/tailscale/tailscale/blob/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/wgengine/magicsock/derp.go
- https://github.com/tailscale/tailscale/blob/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/wgengine/magicsock/magicsock.go
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round600.html
- round600-sources.json