Headscale gives you the half of Tailscale that isn't open source: the coordination server. Run it yourself and the official Tailscale clients (with their excellent NAT traversal and platform support) connect to infrastructure you control, with no per-user pricing and no third party holding your network's keys. This guide is the practical walkthrough: install from the official packages, TLS done the simple way, users and ACLs, the embedded DERP relay on your own network, and the honest operational limits of a deliberately small project.