What is not built
Named plainly, so nothing surprises you later.
The guide's own closing list, reproduced rather than summarised. Its opening line is that a guide which oversells is worse than no guide, because the first thing that doesn't work takes the rest of it down with it.
Not implemented
- Custom Domains — The sidebar says Soon. There is no implementation.
- IPv6 routes, Resources and exit nodes — Not started.
- A Terraform provider — Deliberately not started — configuration as a file covers the same ground.
- A Kubernetes operator — Beyond running the daemon as a pod.
Partial or unproven
- Single sign-on is a preview — Less real-world exposure than the rest.
- IPv6 inside the mesh is half-built — Devices can be given IPv6 addresses, but it is off unless enabled per group, reachable only from the database, and a peer with any port rule still denies IPv6. IPv6 between peers — a direct path where IPv4 cannot connect — is finished and on by default, which is a different thing.
- SCIM has never been pointed at a real tenant — It is implemented and untested against a live identity provider.
- The Reverse Proxy Host path — Has never been run against a real carrier-NAT line.