Headscale

Headscale is the self-hosted replacement for Tailscale's coordination server. Your devices still run the official Tailscale clients and still build direct WireGuard tunnels to each other; the difference is that the server telling them who's who is yours. BSD-3 licensed, completely free, community-driven, no paid tier.

Running it is a single binary with SQLite, light enough for a Raspberry Pi, though it needs a publicly reachable endpoint. The 0.29 release closed a real chunk of the gap with Tailscale's SaaS: grants for application-level policy, SSH sessions that can require fresh OIDC approval, and policy tests that reject a bad ACL before it lands. One upgrade gotcha: wildcard ACLs no longer mean all IPs, and hostname collisions now renumber, which can change MagicDNS names.

Solo and homelab: free, and one of the most popular self-hosted networking tools going. Small teams: real savings vs Tailscale's $6/user/mo once you pass a handful of users. Large orgs: Tailscale's managed offering buys support and compliance you'd otherwise staff yourself.

The catch: you're the support team. No admin dashboard polish, no device posture checks, and DERP relays for hard NAT cases are extra setup or a dependency on Tailscale's public ones.