Tailscale is great, but for anything more than toy uses, particularly business uses, where it's a critical part of your infra, you should consider paying Tailsc

Tailscale is great, but for anything more than toy uses, particularly business uses, where it's a critical part of your infra, you should consider paying Tailscale or using Nebula. My biggest reasons for saying this are: Headscale config errors (including ACL issues) will take down the whole Tailnet until you can get it corrected, setting up extra "relay" nodes is fairly likely and somewhat "hard" (especially without a dedicated IP), and headscale can take quite a few resources. Data point: I recently set up a ~200 node Tailnet with headscale and in retrospect wish I had gone with Nebula. Tailscale's "magic" can be nice, but it can also lead to network weirdness. For example, I can't seem to use the tailnet to route traffic between sites without turning on "accept-routes", but turning that on causes traffic for local ethernet segments on those nodes to be routed over the Tailnet. Reasons I went with Headscale/Tailscale over Nebula: We could enforce periodic re-logins on user workstations, Tailscale was good at routing around networking problems (Nebula has since added similar functionality), Tailscale's self-service is really nice (A user can login from any of their devices using OIDC, Nebula you have to generate a cert). Tailscale and Headscale are both fantastic, just beware of the limitations.