Headscale

Free: All of it. BSD-3-Clause, no paid tier, no hosted version. Supported per the docs: node registration (web auth and pre-auth keys), MagicDNS and split DNS, Taildrive and Taildrop, tags, subnet routers, exit nodes and via routing, an embedded DERP server, peer relays, ACLs and grants, Tailscale SSH, node attributes, policy tests and OIDC registration. Not supported in 0.29.5: Funnel, Serve, network flow logs, and OIDC groups in ACLs. Scope is a single tailnet.

Self-hosted: A server with a public IP, HTTPS on tcp/443, tcp/80 for Let's Encrypt HTTP-01, and udp/3478 if you enable the embedded DERP server (off by default; the default config points clients at Tailscale's public DERP map). SQLite is the default and recommended database; the config calls Postgres highly discouraged and kept for legacy reasons. Officially supported installs are the release binaries and DEB packages; container images are built but Docker and reverse proxies are not officially supported. Upgrades must step through every minor version. Clients are the official Tailscale apps, minimum v1.80.0. No built-in web UI; community UIs such as Headplane fill the gap.

Paid: None. The managed alternative is Tailscale: Personal is $0 for up to 6 users but only for non-commercial use, Standard is $8 per user per month, Premium is $18 per user per month, Enterprise is custom. Headscale's cost is a small public server plus your time.