Flocks doesn’t ship a transport. It speaks over whatever transport your mesh already uses:
TransportWhy
TailscaleZero-config WireGuard mesh; ACLs out of the box.
WireGuardSelf-managed, kernel-level, maximum control.
CustomAny IP-routable network; supply your own CA + PKI.
The gateway and roost don’t care which one — they require a routable IP and a TLS cert (in production).
The private network is not the trust boundary. Even on Tailscale, Flocks expects every node to prove its identity over Ed25519. Don’t treat “they can reach me” as “they’re allowed to talk to me.”