Headscale

It replaces Tailscale's coordination server while using the same WireGuard-based protocol and official Tailscale clients.

Completely free and open source under BSD-3. You get the full mesh networking experience: devices register with your Headscale server, get assigned IP addresses, and establish direct WireGuard connections to each other. Supports ACLs (access control lists), DNS, MagicDNS, OIDC authentication, and pre-auth keys. No paid tier. The project is community-driven.

Homelabbers: this is one of the most popular self-hosted networking tools for a reason. Small teams: works great for connecting office and remote resources. Growing teams: evaluate if self-hosting the control plane saves enough over Tailscale's $6/user/mo. Large orgs: probably want Tailscale's managed offering for support and compliance.

The catch: you lose Tailscale's managed features: their admin dashboard, team management, device posture checks, and the convenience of zero-config. Headscale requires you to run and maintain the control server. Setup is straightforward (single binary + SQLite), but debugging mesh networking issues without Tailscale's support team is on you. Also, DERP relay servers (for when direct connections fail) need separate setup or you rely on Tailscale's public ones.